By Jim Finkle
BOSTON (Reuters) - In the world of cyber fraud, a fake fan on Instagram can be worth five times more than a stolen credit card number.
As social media has become increasingly influential in shaping reputations, hackers have used their computer skills to create and sell false endorsements - such as "likes" and "followers" - that purport to come from users of Facebook, its photo-sharing app Instagram, Twitter, Google's YouTube, LinkedIn and other popular websites.
In the latest twist, a computer virus widely used to steal credit card data, known as Zeus, has been modified to create bogus Instagram "likes" that can be used to generate buzz for a company or individual, according to cyber experts at RSA, the security division of EMC Corp.
These fake "likes" are sold in batches of 1,000 on Internet hacker forums, where cyber criminals also flog credit card numbers and other information stolen from PCs. According to RSA, 1,000 Instagram "followers" can be bought for $15 and 1,000 Instagram "likes" go for $30, whereas 1,000 credit card numbers cost as little as $6.
It may seem odd that fake social media accounts would be worth more than real credit card numbers, but online marketing experts say some people are willing to spend heavily to make a splash on the Internet, seeking buzz for its own sake or for a business purpose, such as making a new product seem popular.
"People perceive importance on what is trending," said Victor Pan, a senior data analyst with WordStream, which advises companies on online marketing. "It is the bandwagon effect."
Facebook, which has nearly 1.2 billion users, said it is in the process of beefing up security on Instagram, which it bought last year for $1 billion. Instagram, which has about 130 million active users, will have the same security measures that Facebook uses, said spokesman Michael Kirkland.
He encouraged users to report suspicious activity through links on Facebook sites and apps.
"We work hard to limit spam on our service and prohibit the creation of accounts through unauthorized or automated means," Kirkland said.
KNOWING WHEN TO STOP
The modified Zeus virus is the first piece of malicious software uncovered to date that has been used to post false "likes" on a social network, according to experts who track cyber crime.
Fraudsters most commonly manipulate "likes" using automated software programs.
The modified version of Zeus controls infected computers from a central server, forcing them to post likes for specific users. They could also be given marching orders to engage in other operations or download other types of malicious software, according to RSA.
Cyber criminals have used Zeus to infect hundreds of millions of PCs since the virus first surfaced more than five years ago, according to Don Jackson, a senior security researcher with Dell SecureWorks.
That the virus is now being adapted to target Instagram is a sign of the rising importance of social media in marketing, and the increasing sophistication of hackers trying to profit from the trend.
Online marketing consultant Will Mitchell said he sometimes advises clients to buy bogus social-networking traffic, but only to get an early foothold online.
When asked about the ethics of faking endorsements, Mitchell replied, "It's fine to do for the first 100, but I always advise stopping after that."
He said one of his clients once bought more than 300,000 "likes" on Facebook against his advice, a move that Mitchell felt damaged the client's reputation. "It was just ridiculous," he said. "Everybody knew what they were doing."
Still, experts say schemes to manipulate social networks are unlikely to go away. Creating fake social media accounts can also be used for more nefarious purposes than creating fake "likes," such as identity theft.
"The accounts are always just a means to an end. The criminals are always looking to profit," said computer security expert Chris Grier, a University of California at Berkeley research scientist who spent a year working on a team that investigated fake accounts on Twitter.
(Reporting by Jim Finkle; Editing by Tiffany Wu and Claudia Parsons)
Hey! That's Mine
One of the app's ultimate sins? Copycating. Make your own content and respect your fellow Instagrammers. It's not polite (or entirely legal) to take a screen shot of another person's photo, change the filter, and pretend like it's your own.
Avoid The Cliche
There are things you're going to want to snap a picture of -- cats, the shoes on your feet, greasy food, an artsy shot of nothing, etc. -- but beware of falling into an Instagram cliche. Followers don't mind these pictures every once in awhile, but give your fans something new to keep them coming back for more.
We Don't Want To See That
Some pictures are <a href="http://instagr.am/legal/terms/" target="_hplink">best left unposted</a>. You would think this would go without saying, but unfortunately it must be mentioned. Drugs, porn, pictures of you on the toilet, pictures of your "friends" on the toilet, a broken toenail: These are all perfect examples of what followers just don't want to see. (If we can't see it, then it's not real. So please don't let us see it.)
Beware The Rapid Fire
It's totally fine to take several photos and upload them to Instagram the same day. You're crossing a line, however, when you don't use Instagram for a week and suddenly spam your followers with 14 uploads in a matter of six minutes.
Hashtags help Instagramers categorize pictures, or are used ironically much like on Twitter. For example, if you take a picture of the Statue of Liberty, a proper hashtag might be #nyc. But drowning a photo in irrelevant hashtags will only frustrate viewers. There is such a thing as #toomuch.
Show A Little 'Selfie' Control
Pictures you take of yourself might be fine, but too many "selfie" shots annoy followers. Who wants to see three or four Instagrams of a face in different positions? Refrain from taking MySpace pictures and flip that camera around on someone else occasionally.
Be My Friend
It's okay to want more followers on your social media sites, but isn't it a little desperate to type "please follow me!" in the comments box of pictures and throughout your "About Me" section? Create great content, regularly participate with other users, and you are guaranteed to earn followers without begging for them.
Your children are adorable, and who wouldn't love that dog always featured on your Instagram? But similar to selfie shots, these objects of your affection may begin to grow old for your friends... particularly if you upload 16 photos of little Sue daily. Sometimes one picture says it all.
Like, Like, Follow, Unfollow
If you "like" a photo, then it's assumed you found that picture to be aesthetically pleasing. What is not assumed is that you expected a "like" or a "follow" in return. And don't even think about unfollowing someone because they didn't follow you back. This sort of middle school behavior is not appreciated. "Like" worthy pictures for the sake of liking them.
Don't Draw Something
Your followers want to see your beautiful or surprising photos. What they don't want to see is something that won't make sense to them, like an inside joke that you drew about a donkey and a pancake. In this case, it's best to just keep your doodles to yourself.
The Catch-All Rule
Here are Instagram words to live by: Document life, show off your quirky moments, and tell a vibrant, filter-filled story. Post those pics you're proud of, and your followers will probably "like" them, too.