Business Due Diligence: Understanding the Fake Agency Fraud Behind Madbird.

In 2020, the world went into lockdown. During this time, many people lost their jobs and many others began to work from home full-time. During this time, Madbird, a London-based digital design agency, hired roughly 50 remote employees worldwide for management, sales, and design positions. Job ads were posted internationally, promising sponsorship to move to the UK on a work visa following the successful completion of six months probation. At Madbird, as with most companies at the time, all communication took place virtually, with colleagues corresponding via email and Zoom meetings. 

Last week, the BBC published an investigation into Madbird Inc, revealing it as a fake design agency that scammed people desperate for work during the lockdown of 2020. Founded by ‘influencer’ Ali Ayad, Madbird claimed to have worked with Nike, Tate, and Toni & Guy, a claim that has now been disproven.

The Madbird sales team pitched to over a hundred thousand prospective business clients, attempting to win deals to redesign websites or build applications. No contracts or deals were ever finalized by Madbird's team, meaning none of the prospective clients lost any money. However, building a team of unwitting sales agents to scam prospective clients to hire the agency based on fraudulent claims, Ayad created a modern-day version of a boiler room scam.

In the published investigation, there is no clear profit for Ayad. With roughly 50 employees hired and deceived, Ayad never brought in any income through the business. Ayad presumably intended for the contracts to eventually be signed and begin legitimate activity based upon the falsehoods, creating a profitable company on the back of his deceived employees working on commission-only contracts. 

In the UK, commission-paid workers, those whose salary is calculated based on sales or deals completed, are entitled to be paid at least the national minimum wage for a pay reference period even if no sales are completed. However, exploiting inexperienced young hires desperate for work, Madbird’s contract required new employees to work on a commission-only basis for the first six months before being entitled to a salaried position.

With no deals ever finalized, none of Madbird’s commission-based employees were ever paid for their work. The right to national minimum wage cannot be signed away through a contract, however, affected employees attempting to claim this money would have to pursue action against a company that never received any money.

Madbird stands as an example to prospective hires and to companies hiring new agencies that conducting business due diligence is vital to minimizing the risk of fraud. When engaging with a company whose name you have never previously heard of, some basic checks can help identify the legitimacy of the company and its work history.

The deception at Madbird was discovered by an employee looking into the head office location to determine her commute to work when the lockdown ended. Companies House and OpenCorporates records for MADBIRD&CO. LTD, the registered company behind Madbird, showed a block of residential flats at the registered business address.

The BBC spoke with residents of the building who stated that they had never seen Ali Ayad. Ayad could easily have no association with the property because Companies House does not require any verification that a business is actually based at the registered address, enabling fraudsters to freely set up fraudulent businesses anywhere in the UK.

Companies House shows Ayad is linked to 4 other registered companies CATCHYDESIGN LTD (11900705), YOURREALTOR LIMITED (12490160), DEEPSLEEP LTD (12371812), and BODYBOX LIMITED (11353601), the first two of which are still listed as Active.

Madbird’s now-deleted LinkedIn page, https://www.linkedin.com/company/madbirdinc/, and website, www.madbird.co, stated that they have over 10 years of experience. Companies House records show the business was founded in August 2020, an immediate red flag for prospective clients and employees. Investigators looking to investigate a story when subjects are starting to cover their tracks can use web archives to view deleted web pages, like Madbird’s website. Skopenow automatically gathers archived copies of web pages relevant to an investigation to enable investigators to see a web page throughout time.

Utilizing Google Search Operators, filetype:pdf "madbird.co", to locate files relating to Madbird, an employment tribunal file can be found, identifying three previous employees who sought to recover wages from Ayad. This search can be used during an investigation to highlight contracts and legal documents that are publicly available. 

Research into Madbird revealed that a portfolio of work on their website was stolen from other companies’ web pages and social media. Madbird had copied phrases word-for-word from the Hatched company website and had copied one of their design pitches. When looking at the website and portfolio of a potential employer, agency, or consultancy, reverse image searching and keyword searching phrases in speech marks can quickly identify if examples have been stolen from established brands.

Reverse image searching isn’t only useful for identifying stolen content, it can also be used to identify people. In the case of Madbird, many of the senior employees were fake, presumably email accounts controlled by Ayad to give the appearance of a larger organization than just himself. Madbird's co-founder, Dave Stanfield, had a LinkedIn profile, company bio, and was constantly discussed on calls by Ali. However, Stanfield never spoke directly with employees because he was one of at least six fictional employees. Ayad constructed the identities of these fictional employees using photos stolen from the internet.

With the investigation starting in 2020, the now paid-for reverse facial recognition searching tool Pimeyes would still have been freely available to the BBC to identify the real people behind the images. Without paying for Pimeyes, reverse image searching for people can still be conducted on sites like Yandex, Google, Bing, and Tineye.

Business due diligence should also involve identifying other websites linked to key players. It is common for fraudsters to fail to cover all their tracks when concealing digital evidence. To this day, Ayad’s personal website is still live. Whilst his personal social media pages have now been deleted, this page still links to those deleted social media accounts.

Business due diligence can also rely on free services like Apollo and RocketReach to research companies. Even in the case of dissolved companies, these sources still contain information that they scraped from deleted LinkedIn pages.

On April 13th, Skopenow will be providing a free training webinar that outlines free tools and techniques, like those outlined above, that investigators can follow when conducting OSINT investigations into businesses.

Skopenow is an analytical search engine that uses social media, open web, deep web, and dark web data to generate actionable intelligence. Investigators and journalists utilize Skopenow to investigate businesses worldwide. Sign up for a 7-day free trial of Skopenow at: https://www.skopenow.com/try.