NB: This is the second in a series of guest articles by Robert Cole, founder of hospitality and travel marketing strategy and technology consulting company RockCheetah. He also blogs at Views from a Corner Suite.
The first installment, Social media and SEO created a mutant in travel - Introducing Fake Review Optimization, covered the fusion of social media and search engine optimization, creating an environment that rewards hotels with high customer ratings.
Unfortunately, it was soon discovered by an unsavory group of reprobates that unsubstantiated reviews capitalizing on truthiness and trustularity carry as much weight as legitimate hotel reviews.
Fake hotel reviews represent a real problem for the hotel industry and travelers that rely on websites that aggregate guest ratings. Travelers often rate user generated review sites comparably with professional reviews published by travel writers in terms of trust.
This point did not elude the search engines determined to provide more relevant search results. Algorithms changed and user generated content such as reviews became more prominent signals factored into the search results.
A higher ratio of positive reviews always produced higher listings in TripAdvisor, but now the same goes for search engines.
Online Reputation Management (ORM) is currently a hot topic within the online world. The wave of individuals and companies entering the market purporting to be experts in reputation management is like the flood of search engine optimization (SEO) or social media "experts" when those disciplines were first introduced.
As a point of reference, Google ranks the competitiveness of the "Online Reputation Management" keyword phrase as high. Adwords Pay Per Click (PPC) advertising bids for the phrase are averaging $23.00.
Similarly competitive terms like "Social Media Marketing" or "Manhattan Luxury Hotel" only get $12.00 and $5.50 respectively per click. Using PPC as a proxy for value, it appears there is ample money to be made from managing reputations online.
The main problem is that ORM is a digital wild west, comprised of good guys and bad guys; it’s sometimes hard to tell the difference since the rules are still being drawn up. Even where the rules are explicit, the sheriffs responsible for keeping the peace may be understaffed, outgunned or outsmarted.
With lots of money at stake, and new territories to claim, innovative individuals unencumbered by ethical mores may be inclined to stretch existing boundaries, venture into uncharted territories, or simply choose to avoid detection.
Joining the cottage industry of churning out fake hotel reviews presents very low barrier to entry for aspiring entrepreneurs. One could hypothetically work from anywhere with only a computer and internet connection serving as prerequisites.
As with most emerging criminal activities born from technological innovation, the stupid and naive players quickly get caught, whereas the smart and proficient may flourish undetected.
Of course, many of the miscreants work for the hotels themselves. Posting anonymous positive reviews for their property and negative ones about the competition might help make them feel clever and/or subversive.
Too ignorant, lazy or naive to cover their tracks, these ne' er-do-wells are the ones most easily identified by TripAdvisor or a new crop of firms creating their own cottage industry of protecting websites from libelous negative reviews.
It is the smart ones however that deserve the attention. Like their brethren – the black-hat SEOs – FROs are well paid for their expertise at managing fake review programs and producing measurable results. No, the expert FROs are not a bunch of punks. These professionals rely on laser focused strategy and flawless execution to accomplish client objectives while exhibiting sufficient restraint to remain undetected.
As a matter of fact, some of the more brazen promoters of fake review optimization are SEO firms that understand the impact of social media on search engine rankings, and by extension, how manipulating reviews can boost search result placement and positively impact algorithmic sentiment analysis.
Black hat basics for fun and profit
The following points are made not to serve as a tutorial, but to create awareness of the challenges facing organizations attempting to curtail Fake Review Optimization. The vitriolic derision of TripAdvisor for failing to identify bogus hotel reviews is misguided. TripAdvisor, perhaps more than any other group, benefits from the practice being eradicated.
The problem for TripAdvisor is fundamentally the vast expanse of the Internet community and the hundreds of thousands of travel providers. Finding a needle in a haystack the size of a sports arena would be a more simplistic task than detecting an adept FRO practitioner.
The most powerful tool for the FRO is a large diffusion field; or simply put, more places to hide. Black-hat SEOs and email spammers have long subscribed to hosting services that not only provide large arrays of IP addresses, but offer them across multiple C-blocks. Without getting too technical, using multiple C-Blocks makes it look as though the traffic is originating from a broad range of neighborhoods.
The aspiring black-hat FRO rookies using single IP addresses are easily detected, where the more astute players turn detection into a highly scalable virtual game of Whack-a-Mole.
Ready for the bad news? The introduction of IPv6 dramatically expands the number of IP addresses available to the Internet, replacing the IPv4 network addressing architecture that has been around since the dawn of the Web.
While iPv6 enables personal IP addresses that can enhance security and support functionality such as authenticated voting, it also supports random addressing for enhanced privacy. For anonymous reviews, the diffusion field will be growing exponentially as IPv6 is adopted.
The one authentication method used by virtually all review sites is to require an e-mail address. Unfortunately, the SEOs have a decade of experience with blog comment spam that utilized free access to webmail accounts to create phony personas capable of including website links in blog comments.
Sadly, review spam is easier to execute and harder to track than comment spam. With links in blog comments, there is a structural trail to the website on the receiving end of the link. This allows groups to create web services similar to email spam filters that evaluate a comment’s IP address, website, and/or email address based on signals aggregated across millions of websites.
Additionally, Google implemented the rel="nofollow" tag on hyperlinks to minimize the impact of links included in blog comment spam.
Review sites lack the benefit of a website link and generally rely on a valid email address and perhaps an ip address to identify potential review abuse. Advantage FROs.
Social Engineering Platforms are another important weapon in the FRO arsenal. Social engineering was born in politics, specifically to communicate political positions and gain wide-spread public support. The social engineering platform represents the nerve center for organizing either legitimate grass-roots advocacy programs, or its inverse, creation of a false perception that an issue is widely supported, a technique known as astroturfing.
A good example of a basic social engineering application would be to have a process where a specific webmail account is associated with a review site profile and one or more IP addresses. Once the relationships are defined, review site profile registration, confirmation of validation email links may be automated to reflect natural actions of a human.
If a Captcha or other bot-prevention technology is utilized by the website, it simply adds an additional manual step to the process adding a marginal time and cost investment for the FRO, but not representing a significant deterrent. Once the social engineering platform possesses a validated identity, it’s game on. Automated posts based on defined campaign objectives are simple. Look at it as sales force automation turning to the dark side…
Sockpuppet profiles
Like any marketing or distribution challenge, technology alone does not provide a turnkey solution – sound strategy and tactical execution make the difference between success and failure. In this way, black-hat reputation managers and FROs are no different than other businesses.
One interesting dynamic of the online review space is how credibility is gained for anonymous reviews. Most review sites have a registration process to highlight the number of reviews and number of times the reviewer had their reviews flagged as helpful to promote credibility.
A phony online profile is frequently called a “sockpuppet.” As a result, astroturfing may be accomplished both anonymously or by sockpuppeting.
Establishing review posting consistency and continuity, essentially mimicking the behavior of a real hotel guest, is easily managed – especially using a social engineering application. By ensuring that reviews generated under a sockpuppeted profile possess an appropriate frequency, distribution and tone, a designated persona may be designed that is relevant to a particular target segment of consumers.
Posting reviews for a variety of clients, other properties selected to be either positively associated for a client property, or to be contrasted against negative reviews for competitive properties help make the sockpuppet profile and affiliated reviews more authoritative. These fictional profiles may also be used to “like” reviews generated by other sockpuppet profiles to create an even more believable distortion of reality.
By moderating the density and nature of the reviews posted, fake reviews not only resonate better with readers, but are further camouflaged from detection.
Associating profiles across websites or social networks provides another method to appear as though reviews are authored by an actual traveler. Social engineering platforms will frequently associate sockpuppet profiles from review sites with fictional profiles of various social media properties. These sockpuppet social media profiles have the unique capacity to attract and communicate with followers, thereby presenting an even more realistic façade.
While communicating from a single IP address or utilizing a single profile greatly increases a FRO’s chance of being discovered, the most surefire method is to produce a large number of extreme reviews.
To avoid detection, expert FROs do not purely post highly polarized ratings and sensational reviews. By exhibiting restraint and patiently spreading ratings across a broad spectrum at regular intervals, the behavior more closely resembles the actions of a human traveler. Additionally, periodically rating a target property as a 4 instead of a 5 also enhances the hotel’s reputation while limiting suspicion. In some cases, the written review may offer glowing accolades, with the lower rating appearing to portray a tough grader.
Similarly, negative reviews may avoid sensationalism by giving the hotel a low, but not the lowest rating, with the review including a couple disturbing qualities such as a lack of cleanliness or poor service.
The FRO boosts sentiment for clients and denigrates competitors using a wide variety of profiles posting reviews over an extended period of time, even incorporating properties that are neither client nor competitor to round out an illusory persona.
Blending in with the crowd
So once the fundamentals of the review manipulation platform are covered, the FRO can employ additional camouflaging techniques to make their presence even less conspicuous.
Many years ago, search engines tracked the IP addresses of websites, but with the advent of virtual hosting, the website URL reigns supreme. Most anyone loving the low cost of their hosting provider is almost certainly sharing their IP address with other websites.
By utilizing IP addresses hosted across shared servers and mixed with a wide variety of other internet traffic, for large hotel review sites, it becomes virtually impossible to flag an IP address for suspicious activity. Again, adopting practices from black-hat aficionados from other disciplines, this time spam e-mailers, the expert FRO creates another layer of complexity for those attempting to track their activities.
While the cross-referencing of spurious profiles covered earlier increases complexity while reinforcing relevance, advanced FROs are careful to configure their social engineering applications to avoid cross-contamination among these fictional personas by having them post from different IP addresses and on different networks. As with most criminal activity, avoiding detectable patterns is an essential defensive strategy.
Perhaps the most sophisticated technique to replicate human-like activity within the review ecosystem is to build software generated histories. Understanding that trust is more readily gained by those that have exhibited an extended history of participation, not only do profiles appear more realistic, but based on the content of past postings, fictitious profiles may be constructed to be perceived as a kindred spirit for those in the target market.
Using technologies similar to those responsible for auto-responding to tweets, populating RSS feeds or scheduling wall posts, FROs are able to create an extended history for social profiles, potentially predating the Fake Review campaign by months or even years.
Just because FROs successfully blend into their surroundings does not mean their actions go unnoticed. Protected by a cloak of invisibility, FRO clients see rankings rise, while traffic and conversion increase. Contrary to complaints that social media-related ROI is difficult to measure, FRO performance is tracked by hard metrics.
Ethical ambiguities don’t bother grey hat tacticians
Covert black-hat tools are not the only weapons at the disposal of the FRO. Many hoteliers and cottage businesses engage in practices that tread on the line of propriety. These grey-hat practices are paired with a naïve perspective “others do it,” “we don’t do it often” or that “tweaking” results fall below any threshold where punishment would be justified.
It all comes down to the ethical standards of the hotelier and presumably the price elasticity of those ethics based on the magnitude of the potential return...
Baiting the guests is a time tested method to garner a higher ratio of positive reviews. For example, a lobby “review station” may be provided to simplify the process of submitting a review. To make it even easier for the guest, the hotel might innocently ask “What was the highlight of your stay?” followed by a prompt to auto-post or pre-populate the review on TripAdvisor (which now allows easy sign-in via Facebook Connect.)
Perhaps another question could be “How could we improve your guest experience? That question however, might trigger an e-mail directly to the General Manager under the auspices of providing instant communication.
That may all seem innocent enough, but structurally, the TripAdvisor review is presented in a positive context that will generally inhibit the amount of negative criticism received. Similarly, the question regarding improvement is structurally isolated from being passed on to TripAdvisor.
Would desk clerks faced with irate guests be inclined to remind them to use the "review station?". Doubtful.
Hotels with integrated guest history systems could easily create rules to suppress opportunities for disgruntled guests to be reminded to enter reviews – for example, on e-mails containing paid guest folio receipts.
One might argue that most hotel managers would not go to such an extent to manipulate results. That response might not be so adamant if guest comments materially impacted performance-based incentives, management contract performance guarantees or search engine rankings. When real money is at stake, temptation to “massage” the rules increases.
Another technique is to provide an incentive for submitting a review. Perhaps, innocently offering a coupon for a discount on a future stay? A room upgrade? A snack or drink? Old school hoteliers can remember when these techniques were used to capture a greater number of comment cards for internal use by the hotel or chain.
TripAdvisor is clear on this topic – any incentives, discounts or upgrades are expressly prohibited – even if a positive review is not required, or if the review is subject to editorial review prior to granting the reward. No, guest comment cards cannot be submitted as reviews…
Less clear is the status of indirect compensation, for example, a prize drawing based on review submissions, not their content. This is a common practice for brands soliciting reviews for their own sites (for example Macy’ or DSW,) but a practice that is frowned upon for submissions on third party review sites.
As one hotel marketing executive told me, “with the stakes raised when managing guest reviews, what was once black and white, gets rationalized into shades of grey.”
Can positive reviews or validating negative reviews be evil?
While some organizations like Kwikchex have grabbed headlines by threatening litigation against TripAdvisor in an effort to remove allegedly fictional negative reviews, it can be argued that a more popular and effective technique is to suppress the impact of legitimate negative reviews by burying them under a mountain of positive reviews.
Where a bogus negative review is likely to attract the attention of the subject hotel, there is little third party scrutiny of phony positive reviews about a property – especially when any fingerprints identifying the source have been wiped clean. As a result, it is much easier to astroturf with positive reviews than targeting a competitor with negative reviews.
FROs are also able to hide behind various consumer protections that ensure privacy to slow third party investigations. Law enforcement and courts normally need damning evidence or a clear indication of damages to pursue astroturfing accusations. As damages are indirect and more difficult to measure, it is comparatively harder to convict a party of submitting positive reviews.
Another popular technique for skewing reviews toward the positive is to establish policies that flag negative reviews for moderation, ideally resolving the issue before the review is published. Algorithmic rules may also be established to hold any reviews expressing negative sentiment while automatically allowing those with positive ratings.
A leading ORM firm openly promotes its technology that authenticates, validates and moderates reviews to “spot and resolve issues before the reviews go live.” The ancillary benefit for suppliers is that this process can structurally delay the publishing date for negative reviews.
One school may contend that eliminating the complaint by satisfying the customer is a good thing, however, another could make the case that if the actual stay warranted a negative review, it should be published, with the hotelier having the opportunity to publicly respond to the allegations.
This moderation process becomes logistically complex for third party websites that are not the accommodation provider, perhaps giving consumers yet another reason not to blindly trust reviews on brand or property websites.
Consumer advocates may ask, what is the ethical difference between providing compensation for removal of a negative review and providing compensation to write reviews?
Conspiracy theorists may also worry that if shady consumers discover a new policy that rewards frivolous negative reviews with some form of compensation, hotels may unintentionally exacerbate the problem.
If the ethical challenges encircling the above techniques give one pause, they may elect to fall back on one of the best time tested methods: intimidation. Threatening legal action to remove negative reviews - even for those legitimate ones lacking definitive evidence or having minor factual inaccuracies – may be more palatable.
Legal threats work well enough for debt collectors, overbearing neighborhood associations and personal injury lawyers, so why not hoteliers? Many Online Reputation Managers like to show some muscle in their pitch to protect the sanctity of their clients’ brand identities.
It is relatively simple to advise a review author that the hotel did not employ a desk clerk named “Michelle” over the dates of their stay and that this fact undermines the veracity of their claims. There is no need to advise the guest that there was a clerk named “Michele.”
With no judge, no jury or neutral arbitrator, the guest may be faced with the proposition to remove the review or risk a protracted and expensive legal process. With little to gain and potentially a lot to lose, most guests will choose the path of least resistance and pull the review.
Why playing dirty doesn't pay* [* unless you don’t get caught…]
Obviously, publishing a blatant lie like "I witnessed the hotel manager clubbing baby seals in the lobby and robbing guests at gunpoint" about a competitor is easily identified as libelous and would be immediately purged from most review sites.
But what if comments accompanying two-star grades are more along the lines of ”The quality of the furnishings and level of service were disappointing considering the price” or “The celebrated staff ‘friendliness’ came off as overly rehearsed and insincere - every conversation started by a hotel employee sounded scripted and robotic. It was creepy.”
Hoteliers lack specific grounds to have anonymous negative comments pulled if they are phrased as personal opinions or cite undocumented facts that cannot be recreated or proven inaccurate.
One or two comments like those above could certainly be discounted as frivolous for a renown five-star hotel, but what if a disproportionate number of reviews highlight perceived quality, service or value issues? And if a competitive hotel is simultaneously receiving reviews that cite great value and expectations being exceeded?
The problem is if FRO activity grows unabated, it undermines the credibility of the user generated review platforms themselves. Sadly, a remarkably beneficial tool becomes a morass of worthless dreck.
Fortunately, there are some weapons that serve as a deterrent to unbridled FRO propagation.
The US Federal Trade Commission, European Union and UK Advertising Standards Association, among others, all have strict rules that prohibit the publication of non-authentic, paid and misleading information being presented as User Generated Content.
In 2009, the US Federal Trade Commission published its Guides Concerning the Use of Endorsements and Testimonials in Advertising. The fundamental requirement of the law is that any material connection between a reviewer and the seller of any product or service must be disclosed. Material connections include employees, relatives and those compensated both financially or for benefits in kind.
FTC penalties range from cease & desist orders to fines of $16,000 per day per violation (each individual review is a unique violation) if an organization continues to defy the law.
Additionally, if convicted, hotels may be subject to civil penalties or other monetary remedies, including providing full or partial refunds to customers. Corrective advertising may also be ordered, with disclosures required in future promotional communications.
Earlier this year, Legacy Learning Systems was fined $250,000 for having affiliates post phony reviews to promote DVD sales.
Despite the strong penalties against those responsible for authoring fake reviews, threatening TripAdvisor and other sites that publish user generated content with lawsuits is a futile pursuit in the US.
Section 230 of the Communications Decency Act of 1996 clearly states:
"No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider."
That description leaves scant room for interpretation – review sites have no legal liability for the words created by third party users of their services. The Act even explicitly protects websites that do not take action after being alerted of the presence of harmful content.
As a result, the focus of FTC investigations is always authors, not the communications medium used to transmit their message. The only exception would possibly be if the review sites themselves make slanderous remarks that are authored by their own editorial teams. It would not appear factually reporting on statistics derived from member ratings or quoting third party reviews would put a review website at risk.
In Europe, creators of faux reviews are equally identified as lawbreakers. The European Union’s Unfair Commercial Practices Directive explicitly prohibits two things:
"Using editorial content in the media to promote a product where a trader has paid for the promotion without making that clear"
...and:
"falsely representing oneself as a consumer".
European Union laws regarding misleading advertising fundamentally parallel those in the US. The EU Directive on Misleading and Comparative Advertising (MCAD) similarly covers the unfair trading practices, as well as denigrating competitors or creating confusion in the mind of consumers. Enforcement is left up to the authorities in the respective EU countries.
Perhaps most importantly, the MCAD is currently scheduled to be updated in 2012. The European Commission is formally requesting public input through December 16, 2011 on the topic. It is a safe guess that the rules will become more stringent and include more precise language pertaining to unfair business practices with an online context.
The UK Government’s Office of Fair Trading enforces The Business Protection from Misleading Marketing Regulations (BPR’s) as well as The Consumer Protection from Unfair Trading Regulations (CPRs) Updates over the years have more closely aligned UK rules with EU rules.
Violating the UK BPR’s or CPR’s can result in fines of £5,000 and land violators in jail for up to two years.
Additionally, the UK Advertising Standards Association’s Committee of Advertising Practice, enforces what is commonly referred to as The CAP Code. Potential punishments may involve sanctions ranging from having media withhold access to advertising space, withdraw trading privileges, require marketing materials to be vetted prior to publication or asking internet search providers to suppress pay-per-click ads leading to infringing pages.
These rules are not solely limited to Western countries. Taiwan’s Fair Trade Commission is planning to fine bloggers and reviewers 10 times the amount received in compensation for posting false advertising.
Fame versus Fortune?
While FROs may get well compensated for their efforts, there are not many opportunities to brag about their accomplishments. Like successful black-hat SEO practitioners, they are loath to reveal clients, methods or successes. Operating in a discipline that demands discretion and attention to detail, they understand the game can end with the smallest mistake.
Being exposed as a FRO, or the client of a FRO can be a career limiting move. Executives associated with unfair commercial practices quickly notice a scarcity of supporters coming to their defense as they are swiftly branded a commercial and political liability. Let’s just say getting caught generating fake reviews begets instant expendability.
Claiming ignorance or that an agency/representative was acting independently has not proven to be a viable defense. By the time judgments are made, charges of impropriety may have been circulating for an extended period of time. Once compromised, returning to the FRO business is highly unlikely.
Call it FRO, astroturfing or aggressive online reputation management, involving anonymous reviews or sockpuppets, creating fake reviews is clearly illegal. It’s also indefensibly unethical.
The next entry in the series will discuss methods to combat Fake Review Optimization and help customers benefit from accurate and unbiased contributions from other travelers.
As it is much easier to get a positive review from a happy guest, reallocating funding from black-hat FRO and grey-hat ORM efforts to guest experience enhancements and white-hat tactics may be the best investment a hotel can make.
NB: This is the secon in a series of guest articles by Robert Cole, founder of hospitality and travel marketing strategy and technology consulting company RockCheetah. He also blogs at Views from a Corner Suite.