Leaving Online Reviews Could Make You A Bigger Target For Phishing Scams

Why That Restaurant Review Might Make You Easier to Scam

Posting an honest product review seems harmless enough. New research suggests it can help reveal someone’s social connections to cybercriminals.

A study published in the journal Information Systems Research found that ordinary behavioral data, like how long a review runs, can reconstruct hidden social networks with startling accuracy. Researchers built a model that inferred social ties from patterns in review activity, including how long users’ reviews were, then showed that an attacker armed with those connections could turn spear-phishing, a scam where a hacker impersonates a trusted contact, into a far more lucrative enterprise.

Yan Leng of the University of Texas at Austin led the team, alongside Yijun Chen of the University of Melbourne and collaborators from Oxford, the Chinese University of Hong Kong, and the University of Sydney. Their work didn’t stop at identifying the danger. They also built and tested two methods platforms could use to make this kind of snooping much harder, without destroying much of the data’s usefulness.

Online Reviews Helped the Algorithm Recover More Than 60% of Yelp Social Ties

An economic idea underpins the approach: people’s choices are shaped by their peers. Someone who sees friends write long, detailed reviews might feel compelled to write a longer one themselves, or might feel there’s less left to say. Either way, that peer influence leaves fingerprints in the data.

Building on that logic, the team designed an algorithm called Homophilous Network Learning, or HNL. Rather than looking at who follows whom, HNL works from patterns in users’ review activity, including which businesses they reviewed and how long those reviews were. It then works backward, asking a simple question repeatedly: given how everyone behaved, what hidden web of social connections would best explain these patterns? Researchers needed a real platform to test against, one with public reviews and a known friend network to check their guesses, and Yelp fit that bill.

Researchers used a public Yelp dataset covering reviews in two U.S. metro areas, New Orleans and Pittsburgh. The Louisiana sample included 2,065 reviewers and 6,094 businesses, while the Pennsylvania sample covered 2,234 reviewers and nearly 16,000 businesses. Yelp publishes an actual “friends” network for its users, giving the team a rare chance to check guesses against ground truth.

Results held up well. At a setting where 10% of nonexistent connections were mistakenly flagged as links, the model still recovered about half of the actual Yelp connections in both cities. Allowing more false alarms, up to 20%, pushed that figure above 60%. Older approaches, including simple correlation analysis and a few competing computer models, all lagged behind at recovering real ties.

Findings like these fed into an economic model of cybercrime. Drawing on loss figures from the FBI’s Internet Crime Complaint Center, researchers modeled how much money a phishing campaign might net an attacker who correctly guesses a victim’s social circle. As impersonation accuracy rises, so does what the paper calls “attack precision,” and payoff scales up fast. In the Pennsylvania sample, modeled return on attack rose from 109% for 500 impersonation attempts to 1,098% for 10,000. In the model, even modest attack precision could make large-scale phishing highly profitable.

Adding Data Noise Could Make Smaller Phishing Campaigns Unprofitable

Diagnosing the risk was only half the job. Researchers then designed two competing methods to protect users while preserving most of the data’s value.

Both approaches rely on differential privacy, a technique that injects a calibrated amount of random statistical noise into data before release. Done right, this noise throws off pattern-matching algorithms while leaving broader trends, like average review lengths, mostly intact.

One method, the direct mechanism, adds Gaussian noise (random variation shaped like a bell curve) straight onto review-length data before publication. A second approach, the indirect mechanism, works one step further removed: it perturbs the hidden network the algorithm has already inferred, then uses that scrambled version to regenerate a protected set of review-length data using Laplace noise, a distribution with a sharp peak and long tails.

Tested against the same Yelp data, both methods reduced the algorithm’s ability to guess real social ties while preserving most of the usefulness of the review-length data. Under one setting, about three-quarters of the review-length values were unchanged, and 95% of all entries differed by roughly 15 words or less. Even that modest scrambling flipped the economics of an attack: for smaller campaigns, estimated returns dropped into negative territory, a losing proposition. Larger campaigns still saw profits fall sharply compared to unprotected data, even where they didn’t vanish completely.

Between the two, the indirect mechanism generally confused attackers more effectively, though the direct mechanism was simpler to deploy.

Could Amazon and YouTube Face the Same Social Data Leak? Researchers Say It Is Possible

Authors frame the work as a wake-up call for an entire category of platforms. Groupon, Amazon, YouTube, and any service where users publicly rate or comment could, in theory, be leaking the same hidden social information. Review length was simply the easiest signal to test on Yelp’s public data; ratings, purchases, comments, or likes could potentially carry similar signals elsewhere, though this study did not test them.

---

Disclaimer: This article summarizes findings from a peer-reviewed study and is intended for general informational purposes. It does not constitute cybersecurity advice for any specific platform, account, or individual, and readers concerned about their own online privacy should consult a qualified security professional.

---