Meta is allowing a visa scam to target migrants on Facebook and WhatsApp with false promises of jobs and housing in Canada, according to a Tech Transparency Project (TTP) investigation that illustrates how the company enables the exploitation of vulnerable users.

Posts from Facebook accounts claiming to belong to immigration lawyers are spreading in multiple Facebook and WhatsApp groups for migrants, offering free travel to Canada, along with employment services and accommodation in that country. But they drive migrants to websites that simply harvest their personal data.

The websites tell users they must invite their friends via WhatsApp before they can access the visa program, turning them into unwitting spreaders of the scam. The sites, however, never produce the promised visa information—or any legitimate information about Canadian immigration.

The Canadian government and fact checkers have repeatedly warned about this visa scam. But Meta, the owner of Facebook and WhatsApp, doesn’t appear to be taking any action against the posts, which violate its policies against fraud and deception. The findings raise new questions about how Meta is facilitating the exploitation of migrants who are desperate to reach the U.S., Canada, and other countries.

TTP’s investigation shows that Google also plays a role in propping up this scam. Some of the fake visa websites use Google’s analytics and advertising tools, allowing them to collect more data about people who visit the sites and make money off of those page views. Google allows this even after blocking phishing sites run by the same individuals behind the visa scam.

Fake employment opportunities are a common strategy for scammers who want to exploit migrants. These deceptions can be difficult for migrants to detect, as we saw with the group of Venezuelan migrants flown to Martha’s Vineyard as part of a political stunt by Florida Gov. Ron DeSantis. (Those migrants were reportedly promised job training, cash, and housing assistance to make the trip.) The Canadian visa scam examined by TTP uses the same basic scheme—and is making the most of Meta and Google platforms to draw in new victims.

TTP identified dozens of nearly-identical Facebook and WhatsApp posts advertising the fake visa program in groups for migrants from Central America, South America, and Africa. The posts state that Canada is recruiting more than 450,000 migrant workers and promise financed travel, free housing, immediate work permits, and legal assistance from the Canadian government for all migrants over the age of 16.

The posts all link to third-party websites that mine user data. These sites collect the user’s name, email, marital status, age, and occupation, but don't provide any legitimate information or services related to Canadian immigration policies.

It appears that posts linked to the Canadian visa scam began to circulate in early 2022. Most of the websites linked in associated social media posts were registered in February.

Almost immediately after these posts started appearing online, fact checkers flagged the job ads as false. The Canadian government also issued warnings about the posts on Facebook, stating that the claims are false and could be designed to defraud migrants.

“Do not trust everything that is shared on social networks, they can solicit confidential information and make you a victim of manipulation,” the Honduran national police wrote in response to the Canadian visa posts.

The Honduran police called it a possible “phishing” scam designed to steal people’s sensitive personal information. In February, a cyber expert told a fact-checking site that this information could be used for identity theft.

Some early versions of the scam post used the link shortening service TinyUrl to direct users to the fake visa application website. By Feb. 25, TinyUrl had terminated the link, citing its policy barring the use of its service for spam, fraud, or moneymaking scams.

But Meta—which boasts a 40,000-person safety and security team—has failed to take decisive action against the scam ads, which continue to flood migrant-focused groups on its platforms. The posts violate Facebook’s community standards around spam, which prohibit content that “contains a link that promises one type of content but delivers something substantially different.” They also violate the Facebook policy prohibiting fraud and deception, specifically grant and benefits scams.

WhatsApp also bars users from “publishing falsehoods, misrepresentations, or misleading statements.” 

All of the Canadian visa scam websites analyzed by TTP prompt users to send spam messages. Once users enter their personal information, the sites prompt them to send a copy of the scam message to their friends or WhatsApp groups before they can proceed with a web form that promises to lead to visa information. This appears to violate Facebook’s policy prohibiting posts that link to “pages that require users to like, share, or otherwise engage with content before gaining access to content.”

While the language of these prompts can vary across sites, every site requires users to send the same message to at least 15 people before they can access the promised visa information. One such site says, in Spanish, “Your Canada visa form will be available as soon as you click the ‘Invite Friends/Group’ button below to share this information with 15 friends or 5 groups on WhatsApp. … If you do not complete this step correctly, the visa form page will not load.”

The “Invite Friends/Group” button launches WhatsApp and preloads a message that is identical to the posts advertising the fake visa program that TTP observed on Facebook. The technology uses a WhatsApp developer tool called a “custom URL scheme” to seamlessly open WhatsApp and prefill the spam message. In this way, the tool turns unsuspecting victims seeking employment and travel assistance into spammers, ensuring that the false narrative about Canadian work visas continues to spread.

Sending the required WhatsApp messages allows the user to click the “Visa form” button, but the button does not lead users to a government website or form. Instead, it redirects to another page on the scam site, containing no useful information about real migration programs.

Many of the posts promoting the Canadian visa scam originated from an account belonging to a “Janelis Osoria,” a supposed immigration lawyer. In the months since the scam began, the account changed its name to “Osoria Rosados” and then to "Janelis Rosados." 

As of this writing, the Janelis Osoria/Osoria Rosados account remains active on Facebook, where it has posted almost exclusively about the Canadian visa scam for the past six months. The account prompts users who respond to posts about work in Canada to direct message them privately for more information. Facebook appears to have taken no action against the account, despite its repeated violations of platform policies.

It's unclear if Janelis Osoria is a real person. Although the Facebook account uses images of U.S. passports and implies that Osoria has expertise in U.S. immigration law, commercial databases have no record of a person by that name in the United States.

Another fake immigration law firm, Visa Inmigracion Service, has published several posts that are nearly identical to the Canadian visa scam, but they promote jobs and social services in the United States. Like the Canadian visa scams, the ads promise access to hundreds of thousands of jobs (in this case, 670,000 jobs), travel costs, and visa assistance.

The Visa Inmigracion Service posts use Facebook’s Messenger for Business tool, which launches a pre-filled direct message to the fake law firm with the click of a button. Users who click on the button will send Visa Inmigracion Service a message that says, “I want to talk to an adviser.” Facebook says that pages that use this feature must register their apps and undergo “Business Verification,” a process designed to help the platform confirm that business accounts represent a legal entity. The fact that a fake legal services firm spreading blatant misinformation appears to have passed this verification raises questions about Meta’s vetting process.

Unlike the Facebook accounts, websites linked in Facebook and WhatsApp posts promoting the Canadian visa scam can be traced to real people. A Massachusetts woman named Brenda Paulino Valdez appears to have registered at least two websites containing the fake Canadian visa application, alongside additional scam websites attempting to trick applicants seeking government benefits in Mexico and the United States. The sites all appear to use a German web hosting provider named Contabo.

Google has flagged three of Valdez’s sites purporting to help users apply for food stamps as malicious and has blocked access to them in the Chrome browser. But the two sites promoting the Canadian visa scam remain active, and the source code for one of the sites, encuentratrabajoencanada.com, shows that it uses Google’s free analytics tools. Security researchers have warned that online scammers can exploit Google Analytics to deceive users into giving up their sensitive data.

The terms of use for Google Analytics do not appear to specifically prohibit the use of analytics tools on phishing or spam sites. They do, however, require sites that use analytics to “have and abide by an appropriate Privacy Policy and … comply with all applicable laws, policies, and regulations relating to the collection of information from Users.”

The visa scam link suspended by TinyUrl in February once directed users to a subdomain of the website finanzasjuegos.com. That URL now redirects to the fake visa application on another domain. Finanzasjuegos.com appears to be the work of a web designer named Chenet Valcourt Chinayder. The author listed on finanzasjuegos.com uses the same username as Chinayder’s Instagram account, and the finanzasjuegos.com web administrator’s email address begins with “chenet.”

Finanzasjuegos.com participates in Google’s third-party advertising network, which means that Chinayder earns money from the search and advertising giant. Although the fake visa application itself does not appear to show Google ads, ads do appear alongside blog posts on finanzasjuegos.com about travel to Canada, and on the unrelated landing page where the site sends users after clicking through the fake visa application. This appears to violate Google’s advertising policies, which prohibit falsely claiming an affiliation with another organization, enticing users to engage with content under false pretenses, and tricking users into giving up personal information.

The Canadian visa scam is notable for its brazenness. The same accounts post identical misinformation messages over and over. Those posts lead to websites transparently designed to mine user data and spam other users without providing any of the information that they promise. The subject of the posts, the Canadian government, has clearly and repeatedly condemned the scam. Yet Meta continues to allow posts amplifying the visa scam to circulate unchecked, suggesting that it’s not conducting even the most basic content moderation.

For its part, Google continues to support the scam sites with ads and analytics tools even though it has identified similar sites by the same developers as phishing schemes, suggesting that it too fails its most basic moderation test.  

These oversights can have real consequences. The recent deception of migrants sent to Martha’s Vineyard shows that fake offers of jobs and public assistance are often difficult to detect for migrants who are seeking help after the arduous journey north. Meta and Google have policies against this kind of scam activity but are failing to enforce those policies, putting migrant users at risk.