A network of Facebook groups impersonating South African celebrities has been used by a scammer to dupe its 575 000 members into visiting his websites.
News24 can reveal that Kutlono Gift Rantsane, 25, a student from Port Elizabeth, is the creator of at least 16 websites and four Facebook groups impersonating local celebrities such as Bonang Matheba, Minnie Dlamini-Jones and Kiernan Jarryd Forbes, also known as AKA.
Rantsane uses these "celebrity" pages to post old and expired job adverts in order to lure hopeful jobseekers to his websites. Once there, the prospective jobseekers are duped into clicking on adverts disguised as application forms, scoring the website owner a quick buck while the jobseeker wastes their time and data.
Rantsane's websites exploit South Africa's raging unemployment crisis by promising employment opportunities. In the second quarter of this year, unemployment rates in South Africa soared to 27.2% of the working population. About 6.1 million people are unemployed, with about 2.9 million discouraged jobseekers not even trying to find work anymore.
These millions of jobseekers are Rantsane's target market, but instead of posting fabricated news articles, Rantsane publishes old or expired job listings in order to attract visitors to his websites.
The investigation into Rantsane was prompted by several Facebook posts about matric-related work that began trending on Facebook in late November.
Dubious job adverts
These posts advertised work for matriculants that required no experience and no formal education. The job postings were posted on several Facebook pages that impersonated local celebrities, apparently with the aim of gaining credibility.
Each post contained a link to one of Rantsane's websites, along with a claim that application forms and details to apply can be found on the site. Users are also encouraged to share the post and comment with their phone numbers, another way of tricking Facebook's algorithms into ranking posts higher on other users' news feeds.
Upon closer inspection, many of these job postings appeared dubious.
For example, one post claimed retailer Pick n Pay was looking to employ more than 500 workers at one go. Another claimed the Department of Transport was looking for young people to be trained as traffic officers for up to R28 000 per month, with only Grade 10 required.
Once on the site, the user is met with intrusive adverts, some even disguised as "apply now" or "submit CV" buttons. Between the adverts, the details of the job itself can be found, minus one small detail: the closing date of the application.
This is because the job listings posted by Rantsane's websites are expired, some even as far back as 2014.
Several examples of old or expired job adverts could be found on the site:
Hopeful jobseekers visiting the site have no hope of getting any position they apply for on the site.
The investigation
Rantsane was identified after he was traced through several social media accounts, website registration records, company returns and credit traces.
Because his modus operandi is similar to that of "traditional" fake news websites, the same principles used to identify those behind fake news websites could also be applied to investigate his identity even though instead of fake news, Rantsane serves fake or expired job opportunities.
The investigation kicked off on a page impersonating local rapper and songwriter AKA. This page itself contained little clues as to who is behind it – it has no administrator listed, and contains no contact details or names in its "about" section.
The adverts directed users to a website, www.jobwinners.co.za. This site is littered with Google Ads, some of which resemble "apply now" or "submit CV" buttons in the hopes a user might click on them.
The adverts also provided us with the owner's Google AdSense ID. An AdSense ID is a unique fingerprint attached to an advert displayed on a website. The ID allowed News24 to identify other websites using the same AdSense ID to make money from its traffic.
The website also provided another clue – the right sidebar contained a reference to another Facebook group, Mzansijobs, which also shared several links to other websites with a similar design. These websites, in turn, used different Google AdSense IDs which could again be used to identify more websites. By iterating this process, a total of 22 websites using seven Google AdSense IDs were discovered.
Using website registration records, we could identify nine of these websites had been registered by an individual with the name "Gift KG Mokwena" or an individual using the email address giftrantsane@gmail.com .
Using an app called Crowdtangle, News24 traced the originating links to several of Rantsane's websites that are still active. This allowed News24 to identify the social media posts that contain a link to that specific web page, and allowed us to identify several groups used by Rantsane to distribute the links to his websites.
The combined membership of these three pages is 575 000 people.
These groups themselves provided additional clues. The information tab on the "Minenhle Minnie Dlamini" (Dlamini-Jones) page contained a link to the Facebook profile of "Gift Rantsane".
Dlamini-Jones' manager, Maphe Dlamini, said his client had no involvement with the page.
"This scam has been going on for years and affected many innocent people and celebrities alike. We have tried our best to communicate over the years [with people] not to believe these scammers, we even went as far as deactivating Mrs Jones' FB pages for a few years.
Similarly, the Puma Kimi2 page also contained a link, and short bio, for a Gift Rantsane.
It also displayed the same email address used to register several of these websites.
The pages claiming to be those of Mzansijobs, Matheba page and Dlamini-Jones also showed they were administered by a person called Muhlle Mncube. Mncube shared a friendship with both Rantsane and his cousin, whose account Rantsane later confirmed he used to make some of the posts.
Gift KG Mokoena's Facebook page identified him as Gift Rantsane, and also revealed he was the administrator of at least two pages that frequently posted fake job adverts linking to his websites. A credit trace and company deeds records confirmed that Rantsane was located in Port Elizabeth, which corroborates the information contained in website registry records and on the Puma Kimi2 Facebook page.
Questions sent to Rantsane via WhatsApp were responded to earlier on Tuesday. Rantsane confirmed that he was the owner of these websites, but denied being the owner of the Facebook groups. According to Rantsane, he "borrowed" the pages from others.
He also denied purposefully posting expired job adverts.
"I wasn't aware if they're that old but I always try to copy at least fresh post."
Rantsane's claims that he was unaware do not explain how he managed to include a post from as far back as 2014 as a new listing. He also seems to have missed several posts made on both the Facebook pages and in the comments of individual posts, labelling his job adverts as fake.
Rantsane told News24 that he supports his family and pays his school fees with the money he makes from the adverts on the page.
"I'm doing google AdSense as you have stated on one of your articles on News24. I do this AdSense as a source of income so I can be able to go to school and support my family. I wasn't aware this is wrong otherwise I'm willing to walk away from it, but the problem is I won't be able to support myself and my family. Even now I was working so I can have cash for varsity registration fee for next year as this is the only source of income for me and my family (sic)."
Dlamini-Jones urged caution on the part of internet users.
"I hope people will be more cautious online and I'm deeply sorry to everyone that has been affected by the scam."