Hacker News new | ask | show | jobs
by lifeisstillgood 410 days ago
So, I craft a search where the search query is “call 1 800 scam”, then I buy a google ad with key word of “ticketmaster help”, the ad links to real ticketmaster with my query, and google shows that ad to someone having trouble and hey presto they call my scam line at 4 quid a minute from their mobile?

Yuck all round. I mean ticketmaster is just a sin eater for greedy popstars but yuck ..

5 comments

> Yuck all round.

Yes, but also it's an impressive digital Jedi mind trick on a website.

signs a question mark with hand

"This is the support number you're looking for."

And the victim is extra primed here because so many companies make it nearly impossible to talk to a human. Yikes!

Almost seems like there's room here for a grey hat to come in and use this trick to do a good faith job trying to help the customer through their problem. Then tell them at the end that a recent anti-trust suit requires them to tell the customer about alternate independent venues in their area where they can support live music.

> Then tell them at the end that a recent anti-trust suit requires them to...

Bonus points if you point to the actual anti-trust suit!

https://www.justice.gov/archives/opa/pr/justice-department-s...

> Almost seems like there's room here for a grey hat to come in and ...

... call the scam numbers to tie up their staff and prevent them from talking to potential victims. Someone like Kitboga could do this at scale. Where there's a phone number, there's a way.

Exactly. And when you try and help these people and explain that you didn't actually call Ticketmaster support they will tell you that they found the phone number on the official Ticketmaster website and Google said it was a verified link.

Here's a real example from the same thing happening on FB (don't call that number) https://i.redd.it/w9htjqflgjle1.jpeg

Completely unrelated tangent: Jesus Christ Reddit is such a cesspit.

Tried tapping that link on mobile, got a screen to view the corresponding post. Tapped it, and I got taken to the App Store. No thanks, force quit the App Store and go back.

Now I get a full screen notice on the original Reddit tab saying “didn’t go where you expected? Next time try the long press!” With instructions to not use private browsing and to long press any link and open in safari. (Wha? You, Reddit, are what are trying to force me to use your app!)

So I long press like they say, open in new tab, and what do I see? A large blank page that just says “REDDIT” in all caps, with the button “Get the app” on the bottom. The link was just to “reddit.app.link” the whole time.

Can’t a company who has a website, just … let me use the website? At every possible turn, Reddit HATES anyone using Reddit from a browser. They will ruin every single aspect of the website they possibly can to try to push you to the app. The entirety of reddit.com seems to be just a broken honeypot to get you to use the app instead. I just can’t fathom how a company can be that broken.

Just delete the Reddit website, it would make more sense.

> The entirety of redit.com seems to be just a broken honeypot to get you to use the app instead. I just can’t fathom how a company can be that broken.

It's their intention to have the website be a funnel so that they can get more mobile users.

I sometimes use https://old.reddit.com, though it doesn't look that great on mobile, maybe there are some other alternatives.

I still don't understand why mobile users are so much more valuable to them, is it just the inability to block ads?
Your phone has sensors and superior data they can track/sell
I know reddit will connect accounts together based on device ID, i wonder if their data becomes more valuable if you can tie multiple independent accounts together in to one profile?

Its a site where users will often have multiple login for different subjects of discussion.

>is it just the inability to block ads?

Of course it is.

> Tried tapping that link on mobile, got a screen to view the corresponding post. Tapped it, and I got taken to the App Store.

It's obnoxious, but if you really want to view the post you can switch the screenshot page to desktop mode, and the "View post" button shouldn't redirect to the App Store. The result isn't pretty but it's readable in a pinch.

(They're still not desperate enough to track the UA and detect the switch.)

Using Reddit on the laptop seems ok if you set it to the old version.

All websites seem to freak out over you not getting their damn app if you visit on a phone. I just don't use the phone for browsing if I can help it.

Hah. I'd make tbe text:

    search all of your friends and connections". You may have lost access to your friends and family. To fix this you need to call ....
I used to rely on google filtering when searching for sites. Then on the google search page I fell for an add.

I caught it right after I tried to log in (one of the few sites I remember the password and didn’t have it in a manager). Reset password.

Man did I feel dumb.

I searched the financial institution a few times and the fake ad came up a bunch. I reported but the trust has been broken.

But why does google allow unverified owners of a domain to buy ads for it? Surely only ticketmaster or agencies approved by ticket master should be allowed to do this?
Because most of the ads are created by external ad agencies, and the people involved are not competent enough to do any verification.

Source: I've also thought this was ridiculous and asked someone working on the adsense team. Apparently tried enforcing some domain verification mechanism in an experiment, but most companies and agencies struggled to get the verification done and of course the $ metrics on this launch dropped, causing execs to force them to stop.

Maybe a partial solution here would be to offer some kind of "domain locking" option?

Allow sites that are heavy targets of this kind of scam - like ticketmaster - to add a "AdSense: locked" line to their robots.txt (or similar) - if that line is present then advertisers have to go through an additional domain verification step in order to place an ad.

I like this idea. I would love to hear from Google why they would not do this. Anyone know why Google / Facebook et al would not want to do this?
Money
Money. And no one died because of this behaviour. So why change a running cash-machine...
Not necessarily, if you have an affiliate program or something like that you could buy ads for, say, eBay using your affiliate link in the hopes of you generating more profit than the ads cost.
There are also still plenty of businesses with a Facebook page as their homepage
There was a time when you search for WhatsApp in Google the first sponsored result is a scam site
If you search for "HP Support" or "Dell Phone Number" you will get a scam site 50% of the time now.
One time an article about Facebook logins got to #1 and its comments were full of people mad that Facebook changed their website yet again, how can they login to Facebook, waah, waah!
On top of that, you receive private information about people from Google, because if someone calls your number, then you know that they were on ticketmaster. Replace ticketmaster by e.g. a swingers club, and now Google's ad businessmodel is in real trouble because it leaks sensitive information.
> ticketmaster is just a sin eater for greedy popstars

Apparently Live Nation owns many performance venues and leverages their power in that market to gain an advantage in the ticket sales market. “Sell through us or you won’t be allowed to play at any famous venue in this city” kind of deal.

Don’t have any sources beyond “heard it on a podcast” though ¯\_(ツ)_/¯