Bitdefender Labs Warns of Fake Donation Scams on Meta

A heartbreaking story about a seriously ill child can make people rush to help. But emotional fundraising appeals can also be used to pressure people into donating before they have had time to ask basic questions.

Bitdefender Labs researcher Ionut Baltariu has identified two active donation scam campaigns running on Meta platforms since at least Aug. 31. The campaigns use emotional posts, photos and videos of young children said to be suffering from leukemia and in urgent need of costly treatment abroad.

Key takeaways

• Two similar donation campaigns have used emotional child medical appeals to solicit donations through Meta ads.
• One campaign’s Romanian-language ads reached an estimated 108,189 Meta accounts in the EU, while its German-language ads reached more than 5,000 accounts in the Berlin region.
• A second campaign is running 32 active ads aimed at Romania and has an estimated reach of more than 500,000 people.
• Researchers found Romanian, German and Lithuanian versions, suggesting that the operators can localize the same template for different European audiences.
• Both donation websites list the same US-based phone number and address.
• The sites display apparent donor activity and familiar payment branding, which may make the appeals seem more credible.
• One campaign’s own wording says funds may support the organization’s broader charitable activities, rather than guaranteeing that donations go exclusively to the child featured in the appeal.

The first campaign: Emotional appeal, limited details

The first campaign directs users to a recently created donation website featuring a two-year-old girl said to be suffering from leukemia and in need of advanced treatment abroad.

When we reviewed the page, it showed €3,397 in donations from 140 donors, toward a goal of €426,893. In a 15-minute period, the total rose from €3,327 and 137 donors to €3,397 and 140 donors.

Visitors are invited to make quick donations of €30, €50, €100, €180 or €350, with the option to enter another amount. Other donation options reach up to €3,000. The page also displays PayPal, Apple Pay and Google Pay branding, which can make the appeal look trustworthy at first glance.

However, the organization supposedly behind the fundraiser has a very limited online footprint. Its social-media profile has only a handful of likes, its website provides little concrete information about the foundation or its work, and it appears to focus on a single case. The site lists a US-based phone number despite the campaign targeting European audiences.

One Romanian-language ad reached an estimated 108,189 Meta accounts in the EU. Researchers also found German-language ads that collectively reached more than 5,000 accounts. All of those ads targeted people in the Berlin region, aged 25 to 65+.

We also found the same banner photo of the little girl on a separate Spanish-language GoFundMe page. That alone does not establish that either fundraiser is illegitimate, but it raises important questions about who is using the image and whether donors can independently verify where their money will go.

The page appears to be attracting real engagement. Some donor comments suggest that people may genuinely believe they are helping. This is precisely what makes campaigns like this dangerous: genuine donations and shares can make an unverified appeal appear convincing to the next person who encounters it.

Localized ads can make a campaign feel familiar

The first campaign appears designed to be easily adapted for different audiences. The ads shown to people in Berlin used German-language messaging and a German page name in the preview, but the page serving those ads was in Lithuanian. Researchers also identified a Lithuanian-language version of the ad that became active on Sept. 14.

This suggests the operators may be adapting the same fundraising template for audiences in different European countries. Consumers should expect further language variations and localized versions rather than assuming an appeal is legitimate because it appears in their own language or seems tailored to their region.

A second campaign reached more than half a million people in Romania

Bitdefender researchers also identified a second, very similar campaign targeting Romanian users. At the time of analysis (Sept. 15) it was running 32 active ads aimed at Romania, most of which began running on Aug. 31.

The Facebook page behind the ads was created on July 26 and began posting on Aug. 2. Meta’s transparency information indicates that the page is operated from the United States.

The campaign’s estimated reach in Romania exceeds 500,000 people. Researchers also found one Romanian-language ad that reached a smaller audience across several EU countries, including France, Spain, Greece, Austria and Lithuania.

Its donation website uses a similar medical appeal and lists the same US-based phone number and address as the first campaign. The page claims it has raised more than US$519,000 from nearly 12,000 donors.

Unlike the first campaign, this website has an extensive donor section. Some displayed names and comments. When analyzing the names and linked social-media accounts, it seems that they belong to real people, and researchers found Facebook users who had shared the story. These observations do not verify the fundraiser itself or prove that the money reaches the child described in the appeal. They do show how quickly an emotional appeal can attract genuine support and gain credibility through social proof.

The site says the names of the child and relatives have been replaced to protect the family’s privacy, while maintaining that the story and medical details are accurate. It also states that money raised will support the organization’s charitable activities, including help for children in need and related humanitarian initiatives, according to its own mission and priorities.

That wording does not guarantee that donations will go directly, or exclusively, to the treatment and care of the sick child featured in the campaign. A legitimate charity may support several causes, but donors should be able to clearly understand where their money goes before contributing.

Why these scams can be dangerous

A donation scam does more than exploit kindness. People who donate may lose money that never reaches the child or cause described. Depending on the payment method and information requested, they may also expose card details, billing information, email addresses or phone numbers to fraudsters.

Emotional pressure is part of the tactic. The story is written to create a sense of urgency and guilt, encouraging people to act quickly, share the fundraiser widely and feel that even a small donation could make an immediate difference. That makes it easier for a campaign to spread before potential donors stop to verify it.

It can also harm genuine families and charities. Every fake fundraiser makes people more cautious about legitimate appeals from people who truly need help.

How to stay safe from fake donation scams

Before donating or sharing a fundraising post:

• Search for the charity independently instead of relying on the link in an ad or post
• Check whether the organization is registered with the relevant charity regulator
• Look for a real history of work, public updates, independent coverage and clear contact information
• Be cautious of recently created websites, sparse social-media profiles and fundraisers with few verifiable details
• Use free tools such as Bitdefender Scamio or Bitdefender Link Checker to check suspicious messages and links before clicking or donating
• Stop and think before sharing a fundraising post with friends, family or your wider community—a share could help a fraudulent appeal reach people who may be especially compelled to help, including older relatives
• Whenever possible, donate through a well-known charity or an official fundraiser shared by a verified hospital, family member or community organization
• Report suspicious ads and fundraising pages to the social-media platform

Disclaimer: This article is published for informational and educational purposes only. The information presented is based on technical research conducted by Bitdefender Labs and publicly available sources. Bitdefender does not make any legal determination regarding the activities described herein. The mention of any company, brand, domain, or individual does not constitute an accusation of illegal activity. The technical indicators and behavioral patterns described reflect observations made at the time of research and may change over time. Readers should exercise their own judgment and consult appropriate authorities or legal counsel if they believe they have been affected by any of the activities described. Domain names and URLs listed in this article are provided solely to help consumers and security professionals identify potentially harmful infrastructure. Bitdefender disclaims any liability for actions taken based on the information in this article.