Understanding YouTube giveaway scams: are teens more susceptible?

Fraud is a persistent and growing problem online. A common social engineering tactic used by fraudsters is to create websites that purport to offer free goods or services, such as iPads, gift cards, and mobile game currency.

In these giveaway scams, fraudsters often advertise these websites through YouTube videos that link victims to the website, where they are directed to complete surveys or other tasks, but ultimately receive no compensation.

“It’s not a scam that necessarily causes large monetary damage,” explains Elijah Bouma-Sims, a Ph.D. student in Carnegie Mellon University’s Software and Societal Systems Department. “It’s more of a risk to people’s personal information, and also presents a risk that they might get a virus on their computer or device.”

The fraudsters’ frequent use of mobile game currency as bait in these scams, along with the topics of many of the YouTube videos that funnel victims to the fraudulent websites, indicate that teenagers are a primary target audience for YouTube giveaway scams. Because of their potential harm to children, Bouma-Sims and a team of Carnegie Mellon researchers wanted to learn more about the nature of these scams, and determine whether teens are more susceptible to falling for them than adults.

In their paper, “The Kids Are All Right: Investigating the Susceptibility of Teens and Adults to YouTube Giveaway Scams,” the researchers detail the findings of their human subjects research in this area. This study is among the first to compare the susceptibility to internet fraud of adult and teenage users, and sheds light on an understudied area of social engineering.

The research team started by conducting three rounds of organic searches on YouTube to identify giveaway scams that appeared to target teenagers.

“If you do organic searches on YouTube for phrases like ‘free mobile game currency’ or ‘free Spotify Premium,’ you’ll come up with some things that are legitimate offers, other things that are fake and are intended to just grab a user’s attention, and a third category of things that are fake and intended to give someone a virus or collect their personal data,” said Bouma-Sims.

Using data from the third category, the researchers conducted a scenario-based experiment with a sample of 85 American teenagers (ages 13 to 17) and 205 adult crowd workers to investigate how users reason about and interact with YouTube giveaway scams.

Utilizing a design meant to mimic the process of YouTube scam victimization, the research team asked participants to imagine they were advising a friend searching on YouTube for ways to earn free Roblox Robux, a form of game currency, or gain free access to Spotify Premium, a paid subscription services that gives users access to Spotify’s full music library without ads.

The participants reviewed sample search results and watched sample YouTube videos and provided both open- and closed-ended feedback on which videos they thought presented scams, and which videos they thought presented legitimate offers that they would recommend to their friend.

The participants also shared demographic and behavioral information as well as scam ratings to contextualize their responses and measure potential predictors of fraud victimization.

The researchers found that most participants recognized the fraudulent nature of the videos, with only 9.2 percent of participants believing that the scam videos offered legitimate deals. Teenagers did not fall victim to the scams more frequently than adults, but they reported more experience searching for terms that could lead to victimization.

“I was surprised that there wasn’t an age difference,” said Bouma-Sims. “It may be that the age range of teenagers is too old already for this to be something that they would fall for.”

The research team will present its findings at next week’s Network and Distributed System Security (NDSS) Symposium in San Diego. For his part, Bouma-Sims hopes that this will lead to further research on online scams that target children and teens, and he emphasizes the need for content moderators and service providers to take action to remove scam videos or provide warnings about giveaways and free offers to mitigate the exposure of users to these scams.