Influencer Dads Are The New Pageant Moms

I’m a developer at a marketing agency. Our biggest client is [Bank]. Apparently, banks in our area have a huge thing for raffles, giveaways, and similar marketing tricks to get new accounts opened. Better yet, they are constantly trying to one-up each other, which is great for marketing/developer agencies like ours.

We present them with an idea for their next big thing.

• We get twenty young influencers to take photos of themselves with some bank cards and stuff. All of them will be some small-scale school-age influencers paid a symbolic amount of money.
• I create an Instagram clone where people vote for their favorite photo. Each week, a new set of photos opens up, and voting starts again, for a total of eight weeks.
• Everyone who participates in voting enters a raffle, and the influencer with the most votes gets a reward: a top-of-the-line newest smartphone. That’s a lot for a kid their age, so we expect them to go rabid and get as many people as possible to vote for them and possibly open up a bank account to get those extra raffle tickets.

I am the sole developer for this job, which means I have the opportunity to take out the fanciest tools in my toolbox. I am quite proud of the end product. It is done on time and on budget, it’s well tested, and it can handle tons of traffic.

Then, the campaign goes live. Voting starts, traffic exceeds our expectations, and everything on my side is working great.

On the second day of the campaign, an eighteen-year-old Influencer Girl gets a massive spike in vote count during a one-hour period. Immediately after, we get our mail flooded with cheating accusations from another participant’s dad. This kid is a fourteen-year-old boy with a Very Important Dad who’s somehow involved in politics and completely obsessed with his son’s social media career.

The Very Important Dad starts threatening us in every possible way he can, including negative social media posts, complaining to [Bank], boycotting the campaign by getting other participants on board, and somehow threatening legal action. In the same email, he mentions at least three times how his son is a huge social media personality, how we should be lucky to even have him in the game, how he didn’t even want to participate in such a small-scale event, and just how impossible it is for him to receive fewer votes than Influencer Girl.

At [Agency] and [Bank] marketing department, it’s all hands on deck. While the rest are figuring out if there’s any exposure and how to deal with Very Important Dad, it’s my job to find out if Influencer Girl cheated and to get proof.

While the security was done right, auditing and logs are inadequate for this investigation. Server access logs contain IP addresses and such but contain no information that would allow me to connect HTTP requests to actual users and who they voted for. Authentication is done either via Google SSO, Facebook SSO, or SMS code verification. Database records are consistent, so I end up browsing through the SSO data, trying to spot any sign of multiple dummy Google or Facebook accounts being created just to vote for Influencer Girl.

The best proof I can come up with is the ratio between different authentication methods. If Influencer Girl cheated, the makeup of the accounts that voted for her would be different from the rest of the accounts. In layman’s terms, if the app had 40% of users registered via Google, 35% via Facebook, and 25% via SMS, and the accounts that voted for her had the same ratio — or at least, not different enough for any statistical significance — it would 99% prove that she did not cheat. If she cheated, she would have to know the ratio to fake it.

Although, she could devise an elaborate plan to get the data from another website with a similar target audience, buy hundreds of burner phones, and create thousands of Google and FB accounts, all to get that main reward — a phone. That’s “a most likely explanation” according to Very Important Dad.

The people at [Bank] do not quite understand the mathematics, so my investigation fails to reach any conclusions. So, they do the obvious. A lawyer from [Bank] calls Influencer Girl to ask her how she got those votes. It turns out she is an animator and went to a college party where she picked up the mic and told everyone to vote for her. She then signs a statement that this is true.

For the remaining weeks, we stall Very Important Dad, telling him that the investigation is in progress and that we cannot give him more information without violating our privacy policy. Meanwhile, he has his friends post conspiracy theories on social media and other weird comments on [Bank] and [Agency] pages.

In the end, the campaign exceeds all KPIs, some by a factor of ten, and would be considered a massive success were it not for the accusations of cheating. It puts a strain on our relationship with [Bank] and we receive no future projects like this from them. Eventually, they pull all their work.