Skip to content
Naked Security Naked Security

Review that! Fake TripAdvisor review peddler sent to jail

Jail time for fake reviews is “a landmark ruling for the Internet,” TripAdvisor said.

The owner of a fake-review factory is going to get a chance to write a review about his trip to the inside of an Italian jail.
TripAdvisor announced (PDF) on Wednesday that, in one of the first cases of its kind, the criminal court of the Italian city of Lecce has ruled that writing fake reviews, under a fake identity, is criminal conduct.
In a decision handed down in June, the court sentenced the owner of PromoSalento – a business that sold fake review packages to Italian hospitality businesses – to nine months in prison and ordered him to pay about 8,000 Euros (USD $9300) in costs and damages. He hasn’t been named.
Understandably enough, given that its business model relies on disseminating authentic reviews by actual patrons, TripAdvisor is pretty stoked about the decision:

We see this as a landmark ruling for the internet. Writing fake reviews on TripAdvisor has always been a violation of the law in many jurisdictions… However, this is the first time we have seen the laws being enforced to the point of securing a criminal conviction.

Businesses are hungry for good reviews: as in, those that come from customers and which are stripped of marketing speak. A Harvard Business School study recently determined that a one point improvement in a restaurant’s score on Yelp could increase its revenue by as much as 5-9%.
With that much business at stake, you can see how dishonest entrepreneurs would be happy to step in and fill the need by cooking up and selling rave reviews.
That’s why, in 2015, Amazon sued over 1,000 people for posting fake reviews on its marketplace. Also in 2015, a number of diners, critics and restaurateurs, frustrated by what they saw as a plethora of fake reviews on TripAdvisor, took to Twitter to campaign under the #noreceiptnoreview hashtag.
It was all about asking the popular review site to insist on screenshots of receipts before approving new reviews. The campaign didn’t go anywhere, for some good reasons: as TripAdvisor pointed out, a group of individuals who eat out together all have a right to leave a review, even if the table only gets one receipt.
You can see why the idea was compelling, though: Supporters thought such a move would help restore trust in TripAdvisor, as well as other similar sites that rely on the accuracy of their reviews to maintain and build their traffic.


TripAdvisor says that it first heard about PromoSalento in 2015, when its fraud investigators identified a new illegal business in Italy that was offering to write fake reviews for hospitality businesses to boost their profile on TripAdvisor. Several Italian businesses forwarded the emails to TripAdvisor, which launched the investigation that would ultimately see the unidentified person behind PromoSalento sent to jail.
TripAdvisor says it supported the prosecution of PromoSalento as a civil claimant by sharing evidence from an extensive in-house fraud investigation and providing support from its Italian legal counsel.
In an investigation spotlight, the company described how it used digital forensics to identify and analyze links between PromoSalento and attempted submissions to its site. It found that the bogus-review seller had attempted to submit more than 1,000 reviews on hundreds of properties – reviews that were either blocked or removed.
PromoSalento tried to skirt TripAdvisor’s blocks by regularly changing usernames and email addresses, but the review site’s fraud detection processes sussed out the IP addresses, browser types and even the screen resolution of a reviewer’s device to weed them out.

Based on that analysis, we were able to see a trail of digital and behavioral ‘breadcrumbs’ that led our team straight back to PromoSalento.

Busting the fake-review factory was only half of the equation, though. TripAdvisor also went after the businesses that were buying the bunk. It wound up linking several hundred businesses to fake reviews submitted by PromoSalento, notified those businesses, and penalized them by demoting their positions in its rankings.
If that didn’t slap some sense into a given business, TripAdvisor then issued them a red badge: a notice displayed on a business’s TripAdvisor listing page warning travelers that the business has been trying to manipulate reviews and outlining the type of fraud it spotted.
In most cases, a fake-review business is rarely heard from again once it realizes that TripAdvisor is wise to its tricks. But in the case of PromoSalento, the Italian Postal and Communications Police were already on to them. They’d been tipped off by a restaurateur from Trieste who had received advertising emails from the fake-reviewer. The police investigation into PromoSalento sealed the deal, delivering enough evidence of criminal conduct to send the case to court.
The news of the resulting prison sentence and fine for the owner of PromoSalento was well received by TripAdvisor:

This is the first time we have seen the laws being enforced to the point of securing a criminal conviction. The judgment makes clear that writing fake reviews constitutes criminal conduct under laws relating to impersonation fraud.


3 Comments

That’s good to hear Lisa. I hope this sets a precedent – not just for businesses, but for fake information posted online to discredit people personally.

Comments are closed.

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?