Is the McDonald's Taiwan Facebook Ad a Mainland China Scam or an Official Promotional Offer?

Facebook has recently been flooded with advertisements for McDonald’s Taiwan. Clicking on them reveals yet another old scam tactic: using a fabricated fake McDonald’s fan page to collect personal data through questionnaires and then resell it.

The fake McDonald’s ads target two major groups: “users aged 20 to 45” and “users whose primary location is on the island of Taiwan.”

After a quick check of public records, I found that the domain server hosting the scam redirect appears to be located in Singapore, using an ordinary Google Blogger space, which performs a page redirect for first-time visitors. I suspect this may be a way to build up site rankings while running ads—though I can’t rule out that the blog was hacked and hijacked.

Figure 1: A fake McDonald’s Taiwan advertisement on Facebook.

Please refer to the web address shown at the bottom of Figure 1 above: “MCDONALDS.tw.” Although the URL looks like a McDonald’s domain[2], the actual registrant information (see Figure 2 below) shows it belongs to “ZuoChun DUAN,” a mainland Chinese person from Zhuhai City, Guangdong Province, who may currently be living in the United States.

What’s more, this person has previously been involved in domain name disputes at the Arbitration and Mediation Center of the World Intellectual Property Organization (WIPO) (Case No. D2013-0617[1]), and manufacturers from the UK, France, and other countries have sued him.

We generally call such people “cybersquatters.” Selling just one domain name can set them up for life, and they can even use the money earned to snap up more valuable domain names. This was once a big business twenty years ago. It wasn’t until the United Nations established WIPO and began arbitrating disputes over malicious registration of well-known trademark domains that many manufacturers breathed a sigh of relief.

Figure 2: Publicly available registrant information for MCDONALDS.tw.

In short, MCDONALDS.tw may have been cybersquatted by a mainland Chinese person, which suggests this fake McDonald’s advertisement may be the work of mainland Chinese individuals.

In addition, the international dialing prefix of the phone number the registrant applied with starts with +93, which upon investigation is the international telephone code for Afghanistan. Therefore, how much of the above registered information is true or false is unknown. At least in the aforementioned domain dispute, ZuoChun DUAN did not respond at all to the complainant’s arguments, and was thus found by WIPO to have maliciously registered the disputed domain name. This shows that if the real McDonald’s Taiwan also filed a complaint, it might well be able to get the domain name back.

Let’s return to the original topic. At the bottom of the fake lottery page opened via the Facebook ad’s external link, there is a statement explaining what kind of website this is: “…will contact winners based on the personal information provided by participants… The information you fill in above will be provided to… partner manufacturers… and, within the scope permitted by law and for marketing purposes, your personal information will be collected, processed, and used domestically and internationally.”

Figure 3: The external fake website.

From the above statement, it’s clear that this website and the Facebook ad marketing tactic can’t really be considered a scam, nor are there signs of computer intrusion. At most, it’s a kind of enticement—luring you into participating in a statistical survey questionnaire, and after you fill in your personal information, your data is sold to other commercial marketing activities, while those who placed the ads earn a commission.

Simply put, it’s using the cost of Facebook ads to exchange for survey prize money.

Figure 4: The questionnaire survey used in the scam advertisement.

However, I only said it “can’t really be considered a scam.” In fact, the website makes extensive use of McDonald’s Taiwan’s commercial intellectual property identifying elements to lure unsuspecting members of the public into believing its deception and entering personal information. This should already violate Article 5 of the Personal Data Protection Act of the Republic of China: “The collection, processing, or use of personal data shall respect the rights and interests of the data subject, be conducted in an honest and creditworthy manner, and shall not exceed the necessary scope of the specific purpose, and shall have a legitimate and reasonable association with the purpose of collection.”

But as I said, the person who set up this fake McDonald’s scam website appears to be a mainland Chinese individual. Given the current frozen state of cross-strait relations, there’s probably no way to hold them accountable.

References

1. WIPO Arbitration and Mediation Center: ADMINISTRATIVE PANEL DECISION, The Net-A-Porter Group Limited v. Duan Zuochun/ Simon David, Case No. D2