Did no one want to share the birthday photo of this grandmother on her 120th birthday? Or the one of that baby with the handicap? Or the dead mother? No, that's not true: these kinds of deceptive stories are often a ruse with the sole purpose of manipulating people for financial gain by tricking them into clicking ads or installing malware.
In the case of the grandmother: according to her family, she was 117 years old when she died in 2017, shortly after this photo was taken. The grandson had posted this picture to his Instagram account, but he never asked people to share the photo. This post is a classic example of a type of scam that has been circulating on Facebook for years using photos stolen from other people.
The emotionally manipulative story about the grandmother appeared as a post (archived here) on the Facebook page, "Prayer Warriors Of Christ," on June 10, 2020. The linked RELAJDG.BLOGSPOT.COM article (archived here) is titled, "Today is my grandmothers 120th Birthday and nobody wants To Share Her birthday photo." The article isn't really an article at all. Clicking the link will open a blog page with the same photo again, and this captioning under it:
VIEW MORE OF HER PICTURESSHARE HER PICTURES AND WISH HER A HAPPY BIRTHDAY
This is what the post looked like on Facebook at the time of writing:
(Source: Facebook screenshot taken on Wed Jul 8 15:19:02 2020 UTC)
This is what the blog page looks like. (Due to the malware threats at these deceptive blog posts we will not be linking to them directly.) 
This type of scam has several steps to it.
The first step is to catch the viewer's attention with a picture and a story. The photos usually have to do with illness, physical deformities, disabilities, amputation, scars, tragedy and violence. The very young and very old are the most common subjects. The photos are usually real but they are typically old photos that have been circulating for years. The attached stories may be entirely fictional, or true, but outdated. The people in the photos do not benefit in any way from the well-wishes in the comments or the shares of the posts. Not only are they not helped by the attention these posts get, this exploitation is an invasion of their privacy. In some cases the circulation of old photos of a sick child or a grandparent who has since died, forces the family to relive their loss and the insult of having their loved one's photos misused.
Is it enough to show a graphic photo with a sad story? No. For the icing on this cake there is often the common lie that it is someone's birthday ... and if that is not enough, there is also a guilt trip, that no one will share the post because of some embarrassing reason. The three "Grandmother's 120th birthday" posts were made on June 8, 10 and 17. Each points to a different website running the same scam.
Share-baiting is the practice of manipulatively encouraging people to share a post. Many of these scams go so far as to give the viewer instructions, not to just share on their own timeline, but to share the post into groups (or share into five groups!). Some posts even soften the request by emphasizing that they are not asking for money, just one share. The more a post is shared, and the more comments it collects, the more it will be seen. If a player can get many people to leave a comment, "Happy Birthday," or "Get well soon!" This will cause more people to see the post everywhere it has been shared -- and if more people see the post, more will click the link.
These manipulation tactics are very precise. They are designed for a person with a kind and trusting heart, who is naive about internet scams. The kind of person who fails to see the deception in step one is more likely to fall for what is coming next. This scam is supported by a whole ecosystem to spread it and an audience to manipulate. This goes beyond the individual posts, the websites and the people planting the links. The Facebook Pages and groups offering (or tolerating) this type of content usually are not doing it by accident. They are cultivating an audience for these scammers to take advantage of.
The second step of the scam takes the viewer to some website off-Facebook. Often these are free blogs set up on blogspot.com or another service. Now the viewer is looking at the same photo that caught their attention back on Facebook. There is nothing new here. There is nothing to add to the story ... but there is a caption promising to see more pictures, maybe even "watch a video" or to share. Below are some examples of false promises on the blog pages:
These pages never deliver what is promised. There are no more pictures to see, there never were. The whole point of this from the very beginning ... the "Grandmother on her birthday" or the child, "Nobody thinks I'm beautiful"... that was just to take the user off Facebook, to get them to this point. Now they will be tricked to click one of these deceptive prompts to "see more," in order to open a webpage that will frighten them. It will say something is wrong with their computer. The warning page will offer a way to "fix" this fictional problem -- a "FREE" download.
Here is a collection of deceptive warning pages Lead Stories encountered while researching this story:
In almost all cases these downloads do require the user to click "allow" or "continue" to the download, but sometimes the pop-ups will continue to push messages at a person trying to back away, "Are you sure?" One tab that makes alarm sounds, one vibrates and makes a "wrong answer" noise if your cursor moves to X it out. We did encounter a download that initiated without any interaction at all -- that was stopped by virus protection. Some of Facebook's most vulnerable users are being targeted by this scam.
What is the purpose of these downloads? The blog Malwaretips.com has an article that explains about adware and how to remove it from an infected computer. The article (here)(archived here) titled, "How to remove Powerapp.download pop-up ads (Virus Removal Guide)," explains specifically about Powerapp.download, which we encountered most frequently from these websites. Malwaretips.com explains:
When it comes to adware, these malicious programs are bundled with other free software that you download off of the Internet. Unfortunately, some free downloads do not adequately disclose that other software will also be installed and you may find that you have installed adware without your knowledge. Once an adware program is installed on your device, whenever you will browse the Internet, unwanted advertisements from Powerapp.download will pop-up.
Here are a few typical signs that you have adware on your system:
- Advertisements appear in places they shouldn't be.
- Your web browser's homepage has mysteriously changed without your permission.
- Web pages that you typically visit are not displaying properly.
- Website links redirect to sites different from what you expected.
- Browser popups appear which recommend fake updates or other software.
- Other unwanted programs might get installed without your knowledge.
To summarize: Photos of people are used without permission to construct manipulative Facebook posts. People feel obliged to comment and share the posts, because the captions make them feel guilty. The posts are seen by a larger audience due to the engagement, and that audience is exposed to the links in the posts. At those websites, people are encouraged to click to see more photos. The links they click do not take them to more photos, instead they are taken to fake "warning" pages where they are encouraged to download malicious programs they don't need that could harm their computer. Scammers profit from the adware people install on their computers. The entire system start to finish works toward the goal of tricking someone to download a malicious program.
Lead Stories recently wrote about a similar scam using stolen photos: "Fact Check: Photo Does NOT Show Mother And Premature Baby With Coronavirus"
Courtney Westlake is a mom who wrote a blogpost titled, "WHY YOU SHOULDN'T "TYPE AMEN AND SHARE" POSTS OF SICK CHILDREN" (archived here) that outlines her painful first person experience as a mom, when photos of her baby daughter were stolen to be used for scams like this.
As for the dear grandmother whose photos were taken from her grandson's Instagram, according to her family (archived here) they will miss their Mami Agba forever.
