Este artículo está disponible en español.
“On the occasion of its 30th anniversary, Metro de Barcelona is gifting transport cards for a year.” This message has appeared thousands of times in Facebook and Instagram ads inviting Barcelona residents to “register online” to win this card. But it’s all a lie: not only because Metro de Barcelona is over 100 years old, but because the public company that runs it, Transportes Metropolitanos de Barcelona (TMB), assures Maldita.es that it has no connection with these posts, which they have repeatedly warned users about. It’s a phishing attack through which scammers aim to obtain the personal and bank card details of everyone who clicks on the link.
Barcelona is the most affected city, but not the only one. Between January 1st and May 31st, we have identified the transport card scam in 47 Spanish cities and islands: Facebook pages impersonating each local municipal transport company to promote a low-cost card that grants free travel for an entire year.
This scam has been promoted in more than half of all provincial capitals, but also in other non-provincial cities such as Vigo, Alcalá de Henares, Avilés, Benidorm, and Motril. Between January and May, we only did not detect this scam in two autonomous communities: Cantabria and La Rioja, but in early June, we confirmed that the fraud had also reached them.
This article is the first delivery of a Maldita.es investigation that analyzes profiles and posts of Facebook pages impersonating public transportation services in different Spanish cities. The scammers' goal is to obtain citizens' personal and bank card details, which they target through paid ads on Facebook and Instagram.
How the ‘transports card scam’ works
The 59 fraudulent pages we analyzed copied the name and even the logo of the municipalities' real transport companies. Other times, they opted for generic names like "[the city in question] public transport" and even made mistakes, such as confusing one city with another.
From these fraudulent pages, scammers published 116 posts offering the supposed transport cards. In most cases, they used images of the city's buses or subway cars to make the scam more realistic. These posts were promoted through Meta ads to reach their audience.
The ads aim to lead users to an external website with the goal of obtaining their personal and bank card information. A few victims have previously reported to Maldita.es that, after entering their information, they did not receive a transport card but instead discovered suspicious charges on their bank account. "I've already been charged twice, one for €2.35 and another for €49.99," one reader shared via an email to [email protected]. Scammers use the information provided by users to sign them up for an online payment service they are unaware of, for which they will be charged periodically.
Who is behind? Hidden or foreign admins
A page claiming to be from the Málaga municipal transport company is managed from India, according to Meta's transparency data. Another page for a public transport profile of Sanlúcar de Barrameda (Cádiz) is managed from Bangladesh and Ukraine.
In total, we found administrators located in 10 foreign countries, although all admins’ data is not available —who are the ones behind the fraudulent posts and ads—. In any case, none of the administrators whose locations are known are even in Spain.
Not only are Facebook pages managed externally, but the ads that promote those pages' posts are sometimes paid by the same actors. For example, an actor that identifies itself as "Panda 01" appears as the "payer" for ads on up to five different pages (representing the transport companies of Avilés, Alcalá de Henares, Pamplona, Valladolid, and Vigo). In the following graph, we can see how each actor purchased Meta ads to promote their content in one or more cities:
Furthermore, all signs point that the creation of these types of fake pages is an international business for certain actors. A page identifying itself as "Transporte público en Valencia" was previously called "Manchester Public Transport" and the one promoting the scam in Jaén was previously located in the Slovenian city of Koper. For example, another page that now appears to be associated with the Tarragona public transport system is managed by an account still called "Ghana Public Transport."
Fraud powered by Facebook and Instagram’s advertising
The 59 fraudulent pages generated more than 900,000 views between January and May thanks to the ads they posted on Facebook and Instagram. These are very large numbers considering that none of them have more than 200 followers and only five have more than 100, and that they only published an average of 1.9 posts per page.
Between January and May, the administrators of these pages paid for more than 570 ads to promote their posts. "Transporte Público en Valencia" is a striking example: in the last five days of May, the page administrator hired 88 ads that appeared more than 11,500 times. With this help, the post containing the scam has accumulated 132,000 impressions, a considerable figure considering that the ad was segmented to appear only to Facebook users in Valencia, a city of just over 800,000 inhabitants.
The posts analyzed have accumulated nearly 4,000 interactions, including more than 700 comments, but it is hard not to question the authenticity of many of them. "Thank you for this promotion! Our family is struggling financially, and you're helping us spend less!" This comment has been posted on six different posts by the profile Thibaud Roux, who has also commented on 11 pages of supposed transport companies. This is not the only case. Emily Coleman has also commented on 13 posts, sometimes using the same message as Roux.
Lucía Rodríguez, Esther Rojas, and Leo Hernández are the most active profiles, with 54, 49, and 48 comments each. In total, there are 21 profiles that repeat comments on different posts and even interact with each other.
Furthermore, the ad campaigns promoting the scam on Facebook and Instagram are characterized by their brevity. We don't have duration data for all of them, but not a single one was active for more than 24 hours, and 47% lasted four hours or less. Overall, everything suggests that the pages' activity is designed to act quickly. Their posts also prove this: 105 of 116 (over 90%) were published on the same day the page was created or on the day it changed its name to target a new city.
In Linares, for example, the page pretending to be the municipality's bus concessionaire has only published one post, and that was on the day it was created, February 13. A few days later, it promoted it through a Facebook ad that was only active for five hours. Still, according to Meta, it managed to reach more than 1,900 people in a city of just over 50,000 inhabitants.
When retrieving many of these ads from Meta's ad Library, a warning appears stating: "This ad was posted by an account or page that we subsequently disabled for violating our advertising standards." In any case, it couldn't have been a very long ban, because all of the pages involved remain accessible as of this writing.
A coordinated campaign to steal user data
The scammers' ultimate goal, as we mentioned, is to get users to click on a link that leads them to a website where they are asked for their personal and bank card information. The 116 Facebook posts analyzed redirect to just 38 different domains.
The most frequently used domain, to which 25% of the posts directed, is clickmall.top, a website registered in August 2024. A domain search using the instrument Whois DomainTools shows no information about who is behind this website. The website is currently disabled and has been identified as phishing by the Google Chrome browser.
The use of the same domains to carry out phishing attacks in different cities reflects the existence of a coordinated campaign. “The way they operate, the fact that the same user pays for the ads, the bots [users who comment on posts] magically go city by city taking advantage of the offers… It's undoubtedly an organized campaign,” says Jorge Louzao, a cybersecurity expert and maldito who has lent us his superpowers.
Paula González, head of cybersecurity at GMV, explains that these types of scams usually come from "organized networks". "How they operate depends mostly on the type of actor behind them. When it comes to scammer networks, it's something completely industrialized and they operate like a company", she says. According to the expert, these types of networks are usually located in foreign countries (such as India, Russia, or Brazil) and employ people who speak the target country's language.
TRANSPARENCY: Maldita.es is, from 2019, part of Meta’s Third Party Fact-Checking Program.
Cybersecurity experts Jorge Louzao and Paula González collaborated on this article with his superpowers.
Thanks to your superpowers, knowledge, and experience, we can fight lies more effectively. The Maldita.es community is essential to stopping misinformation. Help us in this battle: send us the hoaxes you receive to our WhatsApp service, lend us your superpowers, spread our fact-checking’s, and become an Ambassador.
Primera fecha de publicación de este artículo: 12/06/2025
