I asked a review seller for 10,000 reviews

Mike Wright · 2026-11-09

In October a Facebook profile messaged a throwaway research page I'd spun up, offering to sell it reviews on Google, Facebook, Trustpilot, Yelp and the BBB, plus likes and follows. Most people block these. I said yes.

Chat: the vendor's opening menu of reviews, likes and follows across platforms. We reply 'Yes we do'.
Every chat image here is re-typeset from my screenshots. The words are his; the black bars are mine.

The bait was labelled

That page was never meant to win anyone over. It was a single-use honeypot: a disposable research account with a handful of followers, built to be found by exactly this kind of message. And it says what it is, right there in the bio:

Hi! We're a group of Canadians who investigate deceptive media and inauthentic behavior. We ask questions when something seems a bit off.

If you're here because we commented on something of yours, it's already been screenshotted.

A page that announces it investigates inauthentic behaviour is the last place you'd sell inauthentic behaviour. He did anyway. Keep that in mind for later.

For two weeks I was a honeypot buyer. My rules: I typed every message myself, no money moved, the only delivery target was my own page, and I'd never hand over an account. This is the short version. The full write-up, with method, TTPs mapped to DISARM, the psychology and the ethics, is the paper: Honeypot Buyer: an inside look at the CIB economy.

The trial

I asked for a trial and pointed him at my own page. He asked how many reviews and which keywords, wrote one for me to approve, and a day later sent proof.

Chat: the vendor's screenshot of my page's Reviews tab, one review from a redacted account.
The delivery: a review on my page from an account I'd never heard of.

The account that posted it says it's from London. It has recommended six other UK small businesses, from roofing to removals. Its only two reactions came from two other accounts, one in Bangladesh. That's coordinated inauthentic behaviour at retail scale: a persona, a seeded reaction, a paying customer.

Anchor high, then make him wait

Chat: I mention needing 10k; he quotes $3 a review; I refuse to pay 3k and 30k; he drops to $600 per 1k and $5000 per 10k.
Ten thousand reviews. I had no intention of buying one.

The big number did two things: it made him patient, and it made him eager. Then I did the thing pressure-sellers hate. I slowed down.

Chat: I say I'll talk to my manager on Monday; he lists his payment rails and starts chasing with 'Sir', '?' and 'Tell me please'.
The absent manager: delay without saying no.

Pressure tactics run on urgency. I flipped it. He'd already sunk a free review into me and had a five-figure order dangling, so waiting cost him, not me. By the end he'd sent at least 25 unanswered nudges.

Never ask for the account number

I didn't ask how to pay him. I told him what my side would need and to "have things ready". He filled the gap himself.

Chat: I say payment goes out same day once approved; he sends a Bitcoin address and 'I am ready to post review'.
Elicitation by implied requirement. No question asked.

That address had two years of payments on the public ledger, all swept into a bigger wallet. One line later ("he can't get btc to work") he sent a UK bank account.

The form

Bank details tell you where money goes, not whose account it is. Every real transfer asks for the holder's name, so I built a generic online-banking transfer form: his details prefilled, one field blank and red, Submit greyed out. I sent a screenshot with one line.

Chat: I send a screenshot of the transfer form flagging the account name and say 'He says it needs a name'; he answers with a company name ending in Llc, redacted.
Fourteen minutes.

It's not a trick so much as the bank's own form refusing to proceed. He was finishing a transaction he believed in.

I've turned it into a tool: pretext-form. Pick a preset (UK, EU, US, Canada), flag whichever field you want filled, hit capture mode and screenshot it. It's offline with no back end, and the repo carries the rules of use: authorized work, screenshots only, and only ask for what a real payment would ask for.

pretext-form with its control panel open: UK preset, account name flagged, placeholder values.

The twist

First, the comedy. When his reviews stopped going through, he went into troubleshooting mode and started sending me screenshots of my own page, more than once, to show me where the problem was.

Chat: he sends a screenshot of our page, whose bio begins 'Hi! We're a group of Canadians who investigate deceptive media and inauthentic be...', and says the review option is disabled.
He had our bio on his screen. He never read it.

Then, when the review setting stayed off, he didn't walk away from the order. He asked for an account.

Chat: he reports the review option disabled, then asks me to create a new Facebook page, then a new account to send him.
The customer as supply.

This is the part I want small businesses to hear. The engagement economy doesn't only sell fake reviews to you. When it can, it harvests you for the accounts it uses to sell to the next person. I stopped replying.

What to take from it

Everything went to Meta, the payment issuer, the RCMP and the Competition Bureau. The public record of the account is on Trust Report Canada, and its plain-language explainer is here.

cd ..