Reader scammed by fake Guardian webpage

It looks virtually identical to a conventional online page of the Guardian – the same layout, typography, links to other sections, and comments below the line. The story, with Money reporter Miles Brignall's byline, gives a glowing account of a company called Business Grants & Loans. But the page is entirely fake, hosted on a copycat website and apparently designed by fraudsters to give the impression that the company has won independent endorsement from the Guardian – and to lure victims into handing over hundreds of pounds each.


Until now, fake websites have tended to be clones of bank websites or institutions such as HM Revenue & Customs. Conmen send out "phishing" emails which convince people to click through to the bank, but, in reality, they are taken through to the copycat website designed to illegally capture log-ins and password details.


But the fake Guardian pages are, thankfully, a rare example of an attempt to give the impression that a trusted news organisation has endorsed a company. The fake website page uses the address "theguardian.com.uk" – rather than our real web address, which is theguardian.com. The Guardian immediately asked the internet service provider that hosts the page to take it down.


We were alerted to the scam by a victim who paid £175 to Business Grants & Loans by bank transfer, but then failed to receive the loan of £15,000 that she had been promised. She had been sent an email from the company (see composite above) which read: "To back things up, in 2013 we were mentioned in the Guardian.


"We would strongly suggest you read the article below, this should give you the confidence you need in our company …"


In the fake article, readers are told that Business Grants & Loans is an "expanding company" which is "helping 76% of applicants achieve the funding they desire". It tells readers to head to the company's website, and goes to extraordinary lengths to make the article appear genuine – even creating fake below-the-line comments from regular readers of Guardian Money, such as "Halo572" and "oommph".


One fake entry reads: "I myself have dealt with them and they found me a loan option that was very suitable within just a few days." To add greater authenticity, it includes our reporter's email address – with a small change, so anyone trying to email him is directed away from his regular address. At this stage we should make clear to readers that the Guardian's website has not, in any way, been hacked or hijacked, with genuine pages replaced with fake ones.


The idea is that pages are created that appear to be from the Guardian, then are put up on a URL (uniform resource locator) that is similar to the Guardian (ie, ".com.uk" rather than just ".com"). They are then embedded in web links that are sent via emails to the company's clients. We are keen to hear from anybody else who has been duped.


Another example we found of fraudsters imitating a trusted news organisation was last June, when a faked BBC website news page appeared to be endorsing some dodgy diet pills.


Entitled "Special Report: We expose how to lose 23lbs of Belly Fat", and posted on fake BBC Health pages, it was a crude reconstruction of a BBC web story, but it may have been enough to give it credence in some readers' minds – which was the obvious intention. The URL was "World-BBC.co.uk" rather than the conventional "bbc.co.uk".


We asked the Guardian's IT department to find out as much as possible about the fake web page. Very quickly, we learned that it appeared to have been produced, relatively recently, by a "Kieren Daniel Farrer-Thornton".


After an extensive investigation, we were able to trace Thornton to Thailand. He had previously run a web design business, called KK Web Design, which promised to "offer a very unique concept to web design" but which has been inactive in recent years. In January 2012 he began a Facebook page from Thailand, claiming to be in Bangkok.


By November 2012 he is boasting that he is "a money-making machine" and a few days later posts "guna have a fukin expensive weekend after our best week at work yet … just over £13k hitting the bank, were guna be rich fukers after xmas" – which links to an Ashton Saunders. He also boasts of "rooftop parties, champagne and enough hot girls that ill need to rent the whole hotel".


He even shares a link to a BBC story about two men fined £440,000 for sending millions of spam text messages, and writes next to it: "AND WE THOUGHT WE WERE BAD.... GARY U NAUGHTY BOY!!!!" The Facebook postings stop at the beginning of 2013, just after Thornton says he has had a meeting with a software company.


But what about the company itself, Business Grants & Loans? In the UK, calls are met with an automated message which says it is so busy handling "thousands of applications" that correspondence must be done entirely via email, although all our emails went unanswered. Its website is ukgrants.org.uk, and claims to be based in Amersham, Bucks.


At Companies House, Business Grants & Loans is a trading name of Business Grant Finder Ltd, whose company director is listed as 27-year-old Ashton Saunders – who also pops up regularly on Kieren Thornton's Facebook postings. We located Saunders in Pattaya, Thailand – where he claimed to have no knowledge of the fake Guardian pages. He said he had sold the company a year ago to his cousin – who he named as Kieren Thornton. At Companies House there is no indication that the Business Grant Finder Ltd has been sold or dissolved.


We asked Saunders about fraud. Did he have any knowledge of fees taken when there was no chance of the person obtaining a loan? He said that, when he ran the company, it was a legitimate business that took fees but did arrange loans. Just before Money went to press, the plot thickened. In a statement attributed to Kieren Thornton, but sent by Saunders, Thornton confirmed he had bought the company – but claimed he was the victim of a scam.


He said that eight months ago he was contacted by a customer, who provided a link to an article about his company. "I just saved the link but also got my web designer to store it for myself on a hosting account that I owned, in case it disappeared from your site.


"Clearly, for some reason, they have made this, and now I understand it is a false document. I do not understand the intentions behind this customer and the reasons they would do this.


"However, this has now been removed as you have gladly brought it to my attention."


Thornton was also quoted as saying the company "unfortunately has been slandered online as being a scam". He added: "I have always cooperated with any customer who has complained … I will not be charging any customers a fee until I, myself, source grants that are available for our clients."


Meanwhile, the person who alerted us to the fake page says: "You don't take out a loan if you don't need the money. We had a call from someone and it all sounded very convincing – helped by the Guardian article, or so we thought.


"We paid the admin fee by transfer, but now, every time we call, we are told the offices are closed for training purposes. We have been scammed, and it doesn't feel very nice." The money was paid into a NatWest account. She has since taken up the matter with her bank, and has been told investigations are ongoing.


Meanwhile, the Guardian has passed details of its investigation to Action Fraud, the fraud and internet crime reporting centre run by the City of London Police.


Spot the clues


It is not always easy to spot a copycat website, but here are some clues that all is not as it seems, writes Hilary Osborne.


Search for the real thing Put the name of the website you think you have been looking at into a search engine and see what comes up. In many cases the genuine article will appear at or near the top. Do not assume that is the case unless it's a site you know well – and certainly be careful if appears at the top and is marked up as an advert (look out for "Ad" next to it) - but if something does appear that looks different to the site you were looking at, that should ring alarm bells.


Look at the URL Really closely. Now look again. The copycat site will probably have a URL that looks very similar to the real thing, but there will be subtle differences. In the case of the fake Guardian page, the URL is theguardian.com.uk – visit the Guardian site from the UK and the real address is theguardian.com/uk. That dot gives the game away. For government sites it's worth remembering that.


Chop the URL down If you find yourself on what looks to be a sub-page of a website cut back the URL to see if the homepage actually exists. The fake Guardian page has an address starting "http://theguardian.com.uk-news-article-database-business-grants-loans-review-listed ..." – cut it back to end after ".uk" and you end up on a page telling you the server has not been found.