I’ve written annually about financial scams. And the key messaging has always been: If it’s too good to be true, it probably is.

So much for taking my own advice.

I recently fell for fraud on Facebook. A so-called, legitimate ‘Ad’ showed up in my feed of messages, proclaiming an end of season sale for paddle-boards — 70 per cent off. Clicking on a link to e-commerce site, I provided my address and credit card information to a company in China. Only once I received a confirmation email sent a short time after — replete with mangled English — that I made the realization: I’d fallen for a scam.

It may be small consolation, but I’m hardly alone.

The ‘paddleboard scam’ — you can search those terms with Google, and I wish I had beforehand — has been popping up on Facebook for more than a year.

It’s one of thousands infesting social media platforms.

Although fraud has likely been a problem ever since people started walking the Earth, social media has exponentially increased the ability of its perpetrators to reach people.

And it’s exceedingly difficult to fight, cybersecurity experts say.

“You plug one hole and they find another way to come in — that’s typical,” Jeff Thomson, senior RCMP intelligence analyst at Canadian Anti-Fraud Centre.

He adds social media-based fraud is the fastest growing form.

Last year, the centre had 162 reports resulting in $37,000 in losses, he says. As of Aug. 31 this year, it received 217 reports accounting for $48,000.

While not significant, Thomson says the statistics do not reflect the scope of the problem because fraud is under-reported.

One reason is people are reluctant to do so because they feel foolish. Another problem is investigators, like Thomson, are overwhelmed. They get more reports than they can investigate and verify. Long story short: official numbers are artificially low.

Yet unquestionably, social media is fertile ground for fraud, says BMO Financial Group’s top cyber-sleuth Larry Zelvin.

“Wherever criminal actors can get money, that’s where they go, and social media has just provided an extraordinary venue that gives them extraordinary access and more information than they could ever have hoped for,” says the head of the bank’s financial crimes unit, and a former director of cybersecurity at the U.S. Department of Homeland Security.

Indeed social media platforms can potentially provide plenty of data on their users to wrongdoers. That’s because many big tech companies are engaged in surveillance capitalism. In exchange for their so-called free services, we give them access to a lot of our online information.

They then use that data to sell ad space to companies — seemingly fraudsters included — who can tailor messages that appeal to our interests. In my case, Facebook discovered I might be in the market for a paddleboard after searching on its marketplace section. My wife had been hunting for a paddleboard for months, but she couldn’t find one for less than $350. Then came along the ad in my Facebook feed.

Our anniversary was coming up, and I thought I could score a big win with a paddleboard at the fraction of the typical price. (So romantic, right?)

Upon realizing my mistake, I tried to report the fraud to Facebook, which proved difficult. Eventually I contacted Facebook’s media relations. David Troya-Alvarez with Facebook’s corporate communications in Canada responded quickly, asking for the link to the ad.

“We looked into the page running the ad and removed it for violating our Community Standards,” he later wrote in an email.

He also provided two links aimed at addressing the problem, although neither seemed to provide a direct way to report fraud.

What’s more, the ad is still showing up in my Facebook message feed several weeks after the company told me it had been removed.

Manitoba Securities Commission senior investigator Jason Roy isn’t surprised.

As the chair of the Canadian Securities Administrators Investment Fraud Task Force, Roy has been investigating social media investment fraud on Facebook, Kijiji and other platforms for the better part of the last decade.

“It never stops,” he says. “But our hope is to shut down as much as we can to try to contain it as much as we can, and to keep the public informed as much as we can to limit the overall damage.”

In a nutshell, that’s the strategy of most of cyber-crime investigators. They try to disrupt — meaning having social media platforms remove fraudulent ads and pages — while raising public awareness. Investigating and prosecuting the perpetrators, however, is difficult because fraudsters often reside in nations with little interest in assisting with extradition (ahem, China). Nor do authorities there care much for prosecuting these individuals in their own courts as long as no crimes are committed against their citizens.

Instead, the CSA task force, the big banks and law enforcement look to Silicon Valley for help. That’s involved meeting with the big social media players, convincing them to remove fraudulent ads.

“Those meetings have also given us an in where we can now follow up with a contact person” to disrupt new fraud, Roy adds.

Still the fact remains that policing online scams is tough. When one ad is removed, more pop up somewhere else.

“A lot of this is whack-a-mole,” Zelvin explains.

And here’s more food for thought: Consider social media platforms have long struggled to remove misinformation campaigns (Q-Anon, for example) spawned by authoritarian regimes, and other shady entities, seeking to disrupt elections in the U.S. and elsewhere.

So if big tech is hard-pressed to manage that much more sinister problem, imagine how good their efforts are with financial fraud?

Given the challenges, experts argue the best weapon is raising awareness. “The biggest thing I recommend is that people slow down,” Zelvin says. “We’re generally too quick to click.” Do the extra research, he urges, with a Google search.

Doing that would have probably saved me $100.

On the upside, though, I did receive in the mail a pair of counterfeit Ray-Ban sunglasses — ‘Made in Italy’ — from Guangdong province in China three weeks later.

“At least you’ve got some ‘nice’ fraudsters,” Zelvin says jokingly.

“In most cases you get nothing.”