Bear 1, vehicle 0? No, story of bear locked in car just step one in Facebook scammers’ new trick

In just a few weeks starting mid-October 2022, “officers” in small towns across the USA were “dispatched to a vehicle unlock”, always in the morning. In every town, the officers found a bear inside – and the car’s interior ripped apart.

That’s according to near identical messages posted on local Facebook community pages all over the USA. 

This sudden rash of bear attacks on the inside of cars sounds unbelievable – and is. The messages are just the first step in a now common scam.

The scam messages differ only in the name of the town – changed to suit the community page – and the names of the users posting the message.

The template is: “Officers were dispatched to a vehicle unlock this morning in [place name]. Once they arrived they found the vehicle locked with a bear inside. Needless to say Bear -1 Vehicle -0. This is a reminder to keep your vehicle doors locked even if you will be out of it for only a few minutes.”

Almost all of the messages include a photo of a bear next to a house, and three photos of the wrecked inside of a car. (One has only a photo of a scared-looking dog with a bandaged paw, but described as a bear. The scammers probably forgot which photo to use.)

The bear story has been posted on legitimate and well-established US-based Facebook community pages with thousands of members. Some of the pages are 10 or more years old.

We’ve found it on pages based in the US states of Illinois (here and here), Louisiana (here and here), Michigan (here), New Jersey (here and here), North Carolina (here, here and here), Pennsylvania (here) and West Virginia (here).

It’s been shared thousands of times. And once it’s been shared enough, it’s been edited and replaced with a scam message.

Why is Africa Check investigating a scam in the USA?

Africa Check has been exposing what we’ve called the Facebook post editing scam for months. Read our reports – so far – here, here, here, here, here and here.

The scam does seem to hit community pages in the USA. But it’s also been found in Canada, the USA’s northern neighbour, and in the United Kingdom.

It came to our attention because many of the users posting the scam messages had their locations set to South Africa and Zimbabwe. The surnames were common in Africa’s south.

We suspect that these users’ accounts were hacked. But as the scam has evolved, we’ve seen names from elsewhere in the world. We’ve also seen Facebook accounts set up simply to spread the scam.

How it works

This is what we’ve found – so far – about how the editing scam works.

1. An innocent but attention-grabbing message is posted on a community Facebook group page.
2. It may be about a missing child, a missing dog or a missing elderly person. It could be a warning of a serial killer on the loose, or a plea to identify an injured person in a coma. Or it’s about a bear in a car.
3. The message has no links or contact details. 
4. It includes one or more photos. But the photos are unrelated to the message, because the message is false.
5. The message doesn’t seem to be a scam, so it’s passed by moderators. It is published on the page.
6. The message is interesting – it appeals to the heart, or evokes fear – so it’s shared by others. Many versions encourage sharing by asking users to “please help” or “please bump this post”.
7. Once the scammers have bypassed the page moderators and got users to share, they edit the message. The photos are removed and the text replaced.
8. The resulting scam message is also false. It could offer free money from a banking service, free dental care, or an offer to buy a house.
9. But the scam messages will always include a link to a website, with an encouragement to click something.

Here the actual scam begins. 

Sometimes users are told to download an app, and sometimes to just click to “continue”. This is dodgy.

Whatever happens after the tap or click (we haven’t tested it) may steal peoples’ valuable personal information or install malware on their devices.

The motives for some online scams remain murky. But a lot of effort has been put into this scam. 

The best advice is to beware.

Go2Bank and house for rent-to-buy

We’ve found – so far – that the bear story has been edited and replaced with two different scam messages.

The first is the Go2Bank scam, which offers thousands of US dollars for free. We exposed the scam back in August.

The second is new to us. It’s an ad for an attractively priced house for rent, with the option to buy.

It includes a shortened link to a generic website, created with the free option on the GoDaddy site builder. 

The dodgy website’s home page asks: “Why Rent When You Can Own? For the best rent to own homes in your area, CLICK the button below.”

We haven’t tested what happens when the button is clicked. But we’re pretty sure it won’t be anything good.

The real bear story

Unlike other false messages used in the scam, the story of the bear in the car is true. But it’s only true for the rural neighbourhood of Hilltop in Sapphire, North Carolina. It was a black bear, the most common bear in the US.

The story was copied word for word from a July 2022 post on the official Facebook page of Blue Ridge Public Safety, a private policing and security company that works in Sapphire and North Carolina’s wider Transylvania county.

The incident was reported in the Charlotte Observer, a newspaper based in the state’s biggest city. 

According to North Carolina’s wildlife agency, there was a spike in black bear sightings in the state this year.

But, to summarise, we’ll misquote Blue Ridge Public Safety. This is a reminder to keep yourself safe online, even if you think a quick tap on a link won’t cause you harm.