The real Jessica Rychly is a teenager with a broad smile and wavy hair. She likes reading and the rapper Post Malone. When she goes on Facebook or Twitter, she sometimes muses about being bored or trades jokes with friends. Occasionally, like many teenagers, she posts a duck-face selfie.
But on Twitter, there is a version of Jessica that none of her friends or family would recognize.
While the two Jessicas share a name, photograph and whimsical bio – “I have issues” – the other Jessica promoted accounts hawking Canadian real estate investments, cryptocurrency and a radio station in Ghana. The fake Jessica followed or retweeted accounts using Arabic and Indonesian, languages the real Jessica from Minnesota does not speak. While she was a 17-year-old high school senior, her fake counterpart frequently promoted graphic pornography, retweeting accounts called Squirtamania and Porno Dan.
All these accounts belong to customers of an obscure US company named Devumi that has collected millions of dollars in a shadowy global marketplace for social media fraud. Devumi sells Twitter followers and retweets to celebrities, businesses and anyone who wants to appear more popular or exert influence online. Drawing on an estimated stock of at least 3.5 million automated accounts, each sold many times over, the company has provided customers with more than 200 million Twitter followers, a New York Times investigation found.
The accounts that most resemble real people, like Rychly, reveal a kind of large-scale social identity theft. At least 55,000 of the accounts use the names, profile pictures, hometowns and other personal details of real Twitter users, including minors, according to data analysis.
I can't believe that someone would even pay for it
“I don’t want my picture connected to the account, nor my name,” Rychly, now 19, said. “I can’t believe that someone would even pay for it. It is just horrible.”
These accounts are counterfeit coins in the booming economy of online influence, reaching into virtually any industry where a mass audience – or the illusion of it – can be monetized. Fake accounts, deployed by governments, criminals and entrepreneurs, now infest social media networks. By some calculations, as many as 48 million of Twitter’s reported active users – nearly 15 percent – are automated accounts designed to simulate real people, though the company claims that number is far lower.
In November, Facebook disclosed to investors that it had at least twice as many fake users as it previously estimated, indicating that up to 60 million automated accounts may roam the world’s largest social media platform. These fake accounts, known as bots, can help sway advertising audiences and reshape political debates. They can defraud businesses and ruin reputations. Yet, their creation and sale fall into a legal gray zone.
Despite rising criticism of social media companies, the trade in fake followers has remained largely opaque. While Twitter and other platforms prohibit buying followers, Devumi and dozens of other sites openly sell them. And social media companies, whose market value is closely tied to the number of people using their services, make their own rules about detecting and eliminating fake accounts.
Devumi’s founder, German Calas, denied that his company sold fake followers and said he knew nothing about social identities stolen from real users. “The allegations are false, and we do not have knowledge of any such activity,” Calas said in an email exchange in November.
The Times reviewed business and court records showing that Devumi has more than 200,000 customers, including reality television stars, professional athletes, comedians, TED speakers, pastors and models. In most cases, the records show, they purchased their own followers. In others, their employees, agents, public relations companies, family members or friends did the buying. For just pennies each – sometimes even less – Devumi offers Twitter followers views on YouTube; plays on SoundCloud, the music-hosting site; and endorsements on LinkedIn, the professional-networking site.
The actor John Leguizamo has Devumi followers. So do Michael Dell, the computer billionaire, and Ray Lewis, the football commentator and former Ravens linebacker. Kathy Ireland, the onetime swimsuit model who today presides over a half-billion-dollar licensing empire, has hundreds of thousands of fake Devumi followers, as does Akbar Gbajabiamila, the host of the show “American Ninja Warrior”.
Even a Twitter board member, Martha Lane Fox, has some.
At a time when Facebook, Twitter and Google are grappling with an epidemic of political manipulation and fake news, Devumi’s fake followers also serve as phantom foot soldiers in political battles online. Devumi’s customers include both avid supporters and fervent critics of President Donald Trump, and both liberal cable pundits and a reporter at the “alt-right” bastion Breitbart.
An editor at China’s state-run news agency, Xinhua, paid Devumi for hundreds of thousands of followers and retweets on Twitter, which the country’s government has banned but sees as a forum for issuing propaganda abroad. An adviser to Ecuador’s president, Lenín Moreno, bought tens of thousands of followers and retweets for Moreno’s campaign accounts during last year’s elections.
Kristin Binns, a Twitter spokeswoman, said the company did not typically suspend users suspected of buying bots, in part because it is difficult for the business to know who is responsible for any given purchase. Twitter would not say whether a sample of fake accounts provided by the New York Times – each based on a real user – violated the company's policies against impersonation."We continue to fight hard to tackle any malicious automation on our platform as well as false or spam accounts," Binns said.
Unlike some social media companies, Twitter does not require accounts to be associated with a real person. It also permits more automated access to its platform than other companies, making it easier to set up and control large numbers of accounts.
You can't take any tweet at face value
“Social media is a virtual world that is filled with half bots, half real people,” said Rami Essaid, founder of Distil Networks, a cybersecurity company that specializes in eradicating bot networks. “You can’t take any tweet at face value. And not everything is what it seems.”
Last year, 3 billion people logged on to social media networks such as Facebook, WhatsApp and China’s Sina Weibo. The world’s collective yearning for connection has not only reshaped the Fortune 500 and upended the advertising industry but also created a new status marker: the number of people who follow, like or “friend” you. For some entertainers and entrepreneurs, this virtual status is a real-world currency. Follower counts on social networks help determine who will hire them, how much they are paid for bookings or endorsements, even how potential customers evaluate their businesses or products.
High follower counts are also critical for influencers, a budding market of amateur tastemakers and YouTube stars where advertisers now lavish billions of dollars a year on sponsorship deals. The more people influencers reach, the more money they make.
According to data collected by Captiv8, a company that connects influencers to brands, an influencer with 100,000 followers might earn an average of €1,600 for a promotional tweet, while an influencer with 1 million followers might earn €16,000.
Genuine fame often translates into genuine social media influence, as fans follow and like their favorite movie stars, celebrity chefs and models. But shortcuts are also available: On sites like Social Envy and DIYLikes.com, it takes little more than a credit-card number to buy a huge following on almost any social media platform. Most of these sites offer what they describe as “active” or “organic” followers, never quite stating whether real people are behind them. Once purchased, the followers can be a powerful tool.
“You see a higher follower count, or a higher retweet count, and you assume this person is important, or this tweet was well received,” said Rand Fishkin, founder of Moz, a company that makes search engine optimization software. “As a result, you might be more likely to amplify it, to share it or to follow that person.”
Twitter and Facebook can be similarly influenced. “Social platforms are trying to recommend stuff – and they say, ‘Is the stuff we are recommending popular?’” said Julian Tempelsman, the co-founder of Smyte, a security firm that helps companies combat online abuse, bots and fraud. “Follower counts are one of the factors social media platforms use.”
Search on Google for how to buy more followers, and Devumi often turns up among the first results. Visitors are greeted by a polished website listing a Manhattan address, displaying testimonials from customers and a money-back guarantee. Best of all, Devumi claims, the company’s products are blessed by the platform for which they are selling followers. “We only use promotion techniques that are Twitter approved so your account is never at risk of getting suspended or penalized,” Devumi’s website promises.
To better understand Devumi's business, the New York Times became a customer. In April, it set up a test account on Twitter and paid Devumi €180 for 25,000 followers. As advertised, the first 10,000 or so looked like real people. They had pictures and full names, hometowns and often authentic-seeming biographies. One account looked like that of Rychly, the young Minnesota woman.
But, on closer inspection, some of the details seemed off. The account names had extra letters or underscores, or easy-to-miss substitutions, like a lowercase “L” in place of an uppercase “I.”
The next 15,000 followers from Devumi were more obviously suspect: no profile pictures, and jumbles of letters, numbers and word fragments instead of names.
In August, a New York Times reporter emailed Calas, asking if he would answer questions about Devumi. Calas did not respond.
The only way anyone will know is if you tell them
Twitter forbids selling or buying followers or retweets, and Devumi promises customers absolute discretion. “Your info is always kept confidential,” the company’s website reads. “Our followers look like any other followers and are always delivered naturally. The only way anyone will know is if you tell them.”
But company records reviewed by the New York Times revealed much of what Devumi and its customers prefer to conceal.
Most of Devumi’s best-known buyers are selling products, services or themselves on social media. In interviews, their explanations varied. They bought followers because they were curious about how it worked, or felt pressure to generate high follower counts for themselves or their customers. “Everyone does it,” said actress Deirdre Lovejoy, a Devumi customer.
While some said they believed Devumi was supplying real potential fans or customers, others acknowledged that they knew or suspected they were getting fake accounts. Several said they regretted their purchases.
“It’s fraud,” said James Cracknell, a British rower and Olympic gold medalist who bought 50,000 followers from Devumi. “People who judge by how many likes or how many followers, it’s not a healthy thing.”
Ireland has more than 1 million followers on Twitter, which she often uses to promote companies with whom she has endorsement deals. Wisconsin-based American Family Insurance, for example, said the former model was one of its most influential Twitter “brand ambassadors,” celebrities who are paid to help promote products.
But last January, Ireland had only about 160,000 followers. The next month, an employee at the branding agency she owns, Sterling/Winters, spent about €1,600 for 300,000 more followers, according to Devumi records. The employee later made more purchases, he acknowledged in an interview. Much of Ireland’s Twitter following appears to consist of bots, an analysis found.
A spokeswoman said that the employee had acted without Ireland's authorization and had been suspended after the New York Times asked about the purchases. "I'm sure he thought he was fulfilling his duties, but it's not something he should have done," said the spokeswoman, Rona Menashe.
Similarly, Lane Fox, a British e-commerce pioneer, member of Parliament and Twitter board member, blamed a “rogue employee” for a series of follower purchases spanning more than a year. She declined to name the person.
Several Devumi customers or their representatives contacted declined to comment, among them Leguizamo, whose followers were bought by an associate. Many more did not respond to repeated efforts to contact them.
A few denied making Devumi purchases. They include Ashley Knight, Lewis’ personal assistant, whose email address was listed on an order for 250,000 followers, and Eric Kaplan, a friend to Trump and motivational speaker whose personal email address was associated with eight orders. A Twitter account belonging to Paul Hollywood, the celebrity baker, was deleted after he was emailed him with questions.
Hollywood then sent a reply: “Account does not exist.”
Over two years, the Democratic public relations consultant and CNN contributor Hilary Rosen bought more than a half-million fake followers from Devumi. Rosen previously spent more than a decade as head of the Recording Industry Association of America. In an interview, she described the purchases as “an experiment I did several years ago to see how it worked”.
She made more than a dozen purchases of followers from 2015 to 2017, according to company records.
Other buyers said they had faced pressure from employers to generate social media followers. Marcus Holmlund, a young freelance writer, was at first thrilled when Wilhelmina, the international modeling agency, hired him to manage its social media efforts. But when Wilhelmina’s Twitter following didn’t grow fast enough, Holmlund said, a supervisor told him to buy followers or find another job. In 2015, despite misgivings, he began making monthly Devumi purchases out of his own pocket.
“I felt stuck with the threat of being fired, or worse, never working in fashion again,” said Holmlund, who left in late 2015. “Since then, I tell anyone and everyone who ever asks that it’s a total scam – it won’t boost their engagement.” (A Wilhelmina spokeswoman declined to comment.)
Several Devumi customers acknowledged that they bought bots because their careers had come to depend, in part, on the appearance of social media influence. “No one will take you seriously if you don’t have a noteworthy presence,” said Jason Schenker, an economist who specializes in economic forecasting and has purchased at least 260,000 followers.
Not surprisingly, Devumi has sold millions of followers and retweets to entertainers on the lower and middle rungs of Hollywood, such as actor Ryan Hurst, a star of the television series, Sons of Anarchy. In 2016 and 2017, he bought 750,000 followers, about three-quarters of his current count. It cost less than €3,200, according to company records. Hurst did not respond to multiple requests for comment.
Devumi also sells bots to reality television stars, who can parlay fame into endorsement and appearance fees. Sonja Morgan, a cast member on the Bravo show, The Real Housewives of New York City, uses her Devumi-boosted Twitter feed to promote her fashion line, a shopping app and a website that sells personalized "video shout-outs."
One former American Idol contestant, Clay Aiken, even paid Devumi to spread a grievance: his customer service complaint against Volvo. Devumi bots retweeted his complaint 5,000 times.
Aiken and Morgan did not respond to requests for comment.
More than a hundred self-described influencers – whose market value is even more directly linked to their follower counts on social media – have purchased Twitter followers from Devumi. Justin Blau, a popular Las Vegas-based DJ who performs as 3LAU, acquired 50,000 followers and thousands of retweets. In an email, Blau said a former member of his management team bought them without his approval.
At least five Devumi influencer customers are also contractors for HelloSociety, an influencer agency owned by the New York Times Co. (A Times spokeswoman said the company sought to verify that the audience of each contractor was legitimate and would not do business with anyone who violated that standard.)
Influencers need not be well known to rake in endorsement money. According to a recent profile in the Sun, two young siblings, Arabella and Jaadin Daho, earn a combined €80,000 a year as influencers, working with brands such as Amazon, Disney, Louis Vuitton and Nintendo. Arabella, who is 14, tweets under the name Amazing Arabella.
But her Twitter account – and her brother’s – are boosted by thousands of retweets purchased by their mother and manager, Shadia Daho, according to Devumi records. Daho did not respond to repeated attempts to reach her by email and through a public relations firm.
While Devumi sells millions of followers directly to celebrities and influencers, its customers also include marketing and public relations agencies, which buy followers for their customers. Phil Pallen, a brand strategist based in Los Angeles, offers customers "growth & ad campaigns" on social media. At least a dozen times, company records show, Pallen has paid Devumi to deliver those results. Beginning in 2014, for example, he purchased tens of thousands of followers for Lori Greiner, the inventor and Shark Tank co-host.
Pallen at first denied buying those followers. After Greiner was contacted, Pallen said he had “experimented” with the company, but “stopped using it long ago.” A lawyer for Greiner said she had asked him to stop after learning of the first purchases.
Still, records show, Pallen bought Greiner more Devumi followers in 2016.
Marketing consultants sometimes buy followers for themselves, too, in effect purchasing the evidence of their supposed expertise. In 2015, Jeetendr Sehdev, a former adjunct professor at the University of Southern California who calls himself “the world’s leading celebrity branding authority,” began buying hundreds of thousands of fake followers from Devumi.
My social media following exploded
He did not respond to requests for comment. But in his recent best-selling book, The Kim Kardashian Principle: Why Shameless Sells, he had a different explanation for his rising follower count. "My social media following exploded," Sehdev claimed, because he had discovered the true secret to celebrity influence: "Authenticity is the key."
Among the followers delivered to Sehdev was Rychly – or at least, a copy of her. The fake Rychly account, created in 2014, was included in the purchase orders of hundreds of Devumi customers. It was retweeted by Schenker, the economist, and Arabella Daho, the teenage influencer. Clive Standen, star of the show Taken, ended up with Rychly's stolen social identity. So did television baker Hollywood, French entertainer DJ Snake and Ireland. (DJ Snake's followers were purchased by a former manager, and Standen did not respond to requests for comment.)
The fake Rychly also retweeted at least five accounts linked to a prolific American pornographer named Dan Leal, who is based in Hungary and tweets as @PornoDan. Leal, who has bought at least 150,000 followers from Devumi in recent years, is one of at least dozens of customers who work in the adult film industry or as escorts, according to a review of Devumi records.
In an email, Leal said buying followers for his business generated more than enough new revenue to pay for the expense. He was not worried about being penalized by Twitter, Leal said. “Countless public figures, companies, music acts, etc. purchase followers,” he wrote. “If Twitter was to purge everyone who did so, there would be hardly any of them on it.”
Devumi has sold at least tens of thousands of similar high-quality bots, an analysis found. In some cases, a single real Twitter user was transformed into hundreds of different bots, each a minute variation on the original.
These fake accounts borrowed social identities from Twitter users in dozens of countries, from adults and minors alike, from highly active users and those who hadn’t logged in to their accounts for months or years.
Sam Dodd, a college student and aspiring filmmaker, set up his Twitter account as a high school sophomore in Maryland. Before he even graduated, his Twitter details were copied on to a bot account.
The fake account remained dormant until last year, when it suddenly began retweeting Devumi customers continuously. This summer, the fake Dodd promoted various pornographic accounts, including Leal’s Immoral Productions, as well as a link to a gambling website.
“I don’t know why they’d take my identity – I’m a 20-year-old college student,” Dodd said. “I’m not well known.” But even unknown, Dodd’s social identity has value in the influence economy. At prices posted in December, Devumi was selling high-quality followers for under 2 cents each. Sold to about 2,000 customers – the rough number that many Devumi bot accounts follow – his social identity could bring Devumi around $30.
The stolen social identities of Twitter users like Dodd are critical to Devumi’s brand. The high-quality bots are usually delivered to customers first, followed by millions of cheaper, low-quality bots, like sawdust mixed in with grated Parmesan.
Some of Devumi’s high-quality bots, in effect, replace an idle Twitter account – belonging to someone who stopped using the service – with a fake one. Whitney Wolfe, an executive assistant who lives in Florida, opened a Twitter account in 2008, when she was a wedding planner. By the time she stopped using it regularly in 2014, a fake account copying her personal information had been created. In recent months, it has retweeted adult film actresses, several influencers and an escort turned memoirist.
“The content – pictures of women in thongs, pictures of women’s chests – it’s not anything I want to be represented with my faith, my name, where I live,” said Wolfe, who is active in her local Southern Baptist congregation.
Other victims were still active on Twitter when Devumi-sold bots began impersonating them. Salle Ingle, a 40-year-old engineer who lives in Colorado, said she worried that a potential employer would come across the fake version of her while vetting her social media accounts.
“I’ve been applying for new jobs, and I’m really grateful that no one saw this account and thought it was me,” Ingle said. Once contacted, Ingle reported the account to Twitter, which deactivated it.
After emailing Calas last year, a New York Times reporter visited Devumi's Manhattan address, listed on its website. The building has dozens of tenants, including a medical clinic and a labor union. But Devumi and its parent company, Bytion, do not appear to be among them. A spokesman for the building's owner said neither Devumi nor Bytion had ever rented space there.
Like the followers Devumi sold, the office was an illusion.
In real life, Devumi is based in a small office suite above a Mexican restaurant in West Palm Beach, Florida, overlooking an alley crowded with dumpsters and parked cars. Calas lives a short commute away, in a penthouse apartment.
On his LinkedIn profile, Calas is described as a “serial entrepreneur,” with a long record in the tech business and an advanced degree from the Massachusetts Institute of Technology. But Calas’ persona, too, is a mixture of fact and fantasy.
Calas, (27), grew up in South Florida, where as a teenager he learned web design and built sites for local businesses, according to earlier versions of his personal webpage available on the Internet Archive.
Eventually, he taught himself techniques for search engine optimization – the art of pushing a webpage higher in search results. While in high school, he began taking classes at Palm Beach State College, where he earned an associate degree in 2012, according to a school spokeswoman. Within a few years, Calas was claiming to have built dozens of online businesses serving 10 million customers, now under the Bytion umbrella.
“I started this company with a thousand dollars in the bank, without investors, and only the burning passion for success,” Calas wrote last year on the job-listing site Glassdoor.
As Calas’ ambitions grew, so did his embroidery. A copy of his résumé posted online in 2014 claimed that he earned a physics degree from Princeton University in 2000, when he would have been about 10 years old, and a PhD in computer science from the Massachusetts Institute of Technology. Representatives for both schools said they had no record of Calas’ attending their institution. His current LinkedIn page says he has a master’s degree in “international business” from MIT, a degree it does not offer.
According to former employees, turnover was high at Devumi, and Calas kept his operation tightly compartmentalized. Employees sometimes had little idea what their colleagues were doing, even if they were working on the same project.
The ex-employees asked for anonymity for fear of lawsuits or because they were subject to nondisclosure agreements with Calas’ companies. But their comments are echoed in reviews on Glassdoor, where some former employees said Calas was uncommunicative and demanded that they install monitoring software on their personal devices.
Dozens of Devumi’s customer service and order fulfillment personnel are based in the Philippines, according to a company records. Employing overseas contractors may have helped Calas hold down costs. But it also appears to have left him vulnerable to a kind of social identity theft himself.
In August, Calas sued Ronwaldo Boado, a Filipino contractor who previously worked for Devumi as an assistant customer support manager. After being fired for squabbling with other members of his team, Boado took control of a Devumi email account listing more than 170,000 customer orders, Calas alleged in court papers. Then Boado created a fake Devumi.
His copycat company used a similar name – DevumiBoost – and copied the design of Devumi’s website, Calas alleged. (Boado did not respond to emails seeking a response to Calas’ claims.) The fake Devumi even listed the same phantom Manhattan address. Over a stretch of days in July, Boado, posing as a Devumi employee, emailed hundreds of Devumi customers to inform them that their orders needed to be reprocessed on DevumiBoost. Then he impersonated the customers, too, emailing Devumi under different aliases to ask that Devumi cancel the original orders. Boado, according to Calas, was trying to steal his customers.
Calas’ lawsuit also revealed something else: Devumi doesn’t appear to make its own bots. Instead, the company buys them wholesale – from a thriving global market of fake social media accounts.
Scattered around the web is an array of obscure websites where anonymous bot-makers around the world connect with retailers like Devumi. While individual customers can buy from some of these bare-boned sites – Peakerr, CheapPanel and YTbot, among others – they are less user-friendly. Some, for example, do not accept credit cards, only encrypted currencies like bitcoin.
But each site sells followers, likes and shares in bulk, for a variety of social media platforms and in different languages. The accounts they sell may change hands repeatedly. The same account may even be available from more than one seller.
Devumi, according to one former employee, sourced bots from different bot-makers depending on price, quality and reliability. On Peakerr, for example, 1,000 high-quality, English-language bots with photos costs a little more than a dollar. Devumi charges $17 for the same quantity.
The price difference has allowed Calas to build a small fortune, according to company records. In just a few years, Devumi sold about 200 million Twitter followers to at least 39,000 customers, accounting for a third of more than €4.8 million in sales during that period.
Last month, Calas asked for examples of bots the New York Times found that copied real users. After receiving the names of 10 accounts, Calas, who had agreed to an interview, asked for more time to analyze them. Then he stopped responding to emails.
Binns, the Twitter spokeswoman, said the company did not proactively review accounts to see if they were impersonating other users. Instead, the company’s efforts are focused on identifying and suspending accounts that violate Twitter’s spam policies. In December, for example, the company identified an average of 6.4 million suspicious accounts each week, she said.
We take the action of suspending an account from the platform very seriously
All of the sample accounts provided violated Twitter’s anti-spam policies and were shut down, Binns said. “We take the action of suspending an account from the platform very seriously,” she said. “At the same time, we want to aggressively fight spam on the platform.”
The company also suspended Devumi's account Saturday after the New York Times article was published online.
Yet, Twitter has not imposed seemingly simple safeguards that would help throttle bot manufacturers, such as requiring anyone signing up for a new account to pass an anti-spam test, as many commercial sites do. As a result, Twitter now hosts vast swaths of unused accounts, including what are probably dormant accounts controlled by bot-makers.
Former employees said the company’s security team for many years was more focused on abuse by real users, including racist and sexist content and orchestrated harassment campaigns. Only recently, they said, after revelations that Russia-aligned hackers had deployed networks of Twitter bots to spread divisive content and junk news, has Twitter turned more attention to weeding out fake accounts.
Leslie Miley, an engineer who worked on security and user safety at Twitter before leaving in late 2015, said, “Twitter as a social network was designed with almost no accountability.”
Some critics believe Twitter has a business incentive against weeding out bots too aggressively. Over the past two years, the company has struggled to generate the user growth seen by rivals like Facebook and Snapchat. And outside researchers have disputed the company’s estimates for how many of its active users are actually bots.
“We’re working with completely unregulated, closed ecosystems that aren’t reporting on these things. They have a perverse incentive to let it happen,” said Essaid, a cybersecurity expert. “They want to police it to the extent it doesn’t seem obvious, but they make money off it.”
In January, after almost two years of promoting hundreds of Devumi customers, the fake Jessica Rychly account was finally flagged by Twitter’s security algorithms. It was recently suspended.
But the real Rychly may soon leave Twitter for good.
“I am probably just going to delete my Twitter account,” she said.
– New York Times
