Tricked by Followers and Badges with Tim O’Hearn

What if your social media success was built on deception, and it was working? In today’s episode, we hear from someone who knows exactly how that happens. Tim O’Hearn is a former software engineer and the author of Framed: A Villain’s Perspective on Social Media, a book that pulls back the curtain on how follower factories, automation, and persuasive technologies have shaped the online world we now take for granted. Tim doesn’t just theorize, he built these systems himself.

Tim walks us through how his small side gig growing Instagram accounts evolved into a lucrative business, one that constantly navigated the blurry line between innovation and breaking platform rules. He opens up about the clever strategies he used to avoid detection and psychological hooks that made these methods so effective, as we explore the deeper consequences of social media’s addictive nature. 

We’ll also explore the hidden risks businesses and individuals face when they obsess over metrics and follower counts instead of genuine connections, and why most people don’t even realize they're caught up in this trap.  Whether you're running a business, casually browsing, or just trying to figure out the complicated world of online attention, this conversation will give you a rare peek behind the curtain. And as you’ll find out, stepping away from it all might not be as straightforward as you'd think.

Show Notes:

• [01:12] Tim recently published Framed: A Villain's Perspective on Social Media, a book that shares his journey from breaking the rules on social media to getting millions of followers for his clients.
• [02:15] We learn a little bit more about the beginnings of spamming the Internet and increasing online presence, including MySpace and Instagram, which evolved into getting more followers.
• [04:14] This created social proof and the possibility of higher conversion rates.
• [05:09] Increasing followers using botnets or fake followers. Organic growth and interacting with accounts that might follow or like. 
• [08:35] Tim's business was Shark Social, where he bent the rules to get followers for clients. 
• [09:53] The technical side of his operation. Proxies were used to mask their tracks. 
• [12:30] Social media services have taken efforts to stop things like follower growth services.
• [14:54] Risks for businesses using social media growth platform services. It's against TOS, and your account can get banned.
• [18:36] Systems Tim built to target consumers using social media. The goal was to get users to spend more time on the app.
• [20:50] Thresholds for annoying users. It was shocking how many people allowed push notifications and other annoying things.
• [22:54] How social media affects Tim. 
• [26:11] We learn how he feels about the influencer culture and promoting his book on TikTok. 
• [27:14] Advice for business owners, including these services, may not get you more business. Pause before doing too much.
• [28:48] Individuals should focus on conversions.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review. 

Links and Resources:

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Tim O’Hearn
• Tim O’Hearn – LinkedIn
• Tim O’Hearn – Beehiiv
• Framed: A Villain's Perspective on Social Media
• Spam Kings

Transcript:

Tim, thank you so much for coming on the podcast today.

Hey, Chris. Thanks for having me.

Can you give myself and the audience a little bit of background about who you are and what you do?

My name’s Tim O’Hearn, and recently, I published Framed: A Villain's Perspective on Social Media. It’s a book that addresses, really, the travails and the trials of someone who grew up with the internet, became a programmer, and then broke the rules on Instagram while getting customers millions of followers. I made money from the Internet, but I also feel that socially I was affected by it as well.

During my 20s, I was a software engineer. I worked in quantitative trading, and a lot of the things I did on social media were my side hustle. But I decided to write this book because people are interested in it. I felt that for the early internet and the internet we know today, things have changed quite a lot, and a lot of this information just hasn’t been addressed in the same way.

With the book, you talk about building followings for people. Can you give an overview of what the history is of increasing social media account profiles, presences of them?

A lot of it relates to internet spam. We have a wonderful book published many years ago called Spam Kings, which really addresses internet spam and the idea that it’s so cheap to send electronic messages as opposed to junk mail. Someone or some percentage of people will reliably buy those products, even though those products were often scam products themselves.

We saw these practices evolve with early social media sites, specifically on MySpace. A lot of the automation systems that were being used by spammers to collect and then shoot emails off to large bunches of email addresses were then applied to MySpace and MySpace profiles, where you had a messaging function there just the same, and you also had this new concept, which was friendship or mutual friendship on MySpace.

We saw different bots towards the end of MySpace’s reign pop up. Then once Instagram became more popular 5–10 years later, we saw this massive proliferation where followers became front and center. It was no longer a direct sales pitch. Rather, it was this race for more followers, growing those digital metrics, and also purchasing digital insignia such as the famous blue checkmark.

What was the concept of growing followers? Is it that certain metrics were proof of “I’ve arrived,” or was it actually…did result in those influencers or those individuals or businesses being able to actually conduct more business?

If you were to look at the websites of any of my contemporaries or any of the businesses that came right before Shark Social—the business that I was involved with—it was both social proof in the general sense, which is that if you arrive at a profile and they have 20,000 followers, especially in 2018, you’re thinking that that’s a pretty legitimate business or that’s an influencer-type type of person.

The other aspect is that if you own the account and you have 20,000 followers and you expect them to be real, if you are actually selling them something, some of those people will convert to customers.

Even when we had the early businesses that were doing much spammier things or much more disruptive things, there was this two-pronged belief: other people will be more likely to follow you because you’ve been proven socially, but also the existing followers you have might be more apt to purchase your products.

How did you go about using systems to increase people’s followers?

There were several eras that I’ve identified in my book Framed. I break it down to five eras, but it really comes down to two primary approaches. The first one is the spammier one, which involves botnets or fake followers.

The idea would be if me or you, if we knew how to industrially create hundreds of thousands of fake accounts, then we could put a price on sending some of those accounts toward customers to get them more followers or comments or likes or whatever. That’s one aspect of it.

Although I had the systems that could do that, by the time I became involved, it was very, very difficult to create fake accounts. There was a price on fake accounts that was probably, depending who you’re buying them from, was like $0.50 to a dollar per fake account, so it actually could get pretty expensive.

What we focused on at Shark Social was what was called organic growth. Rather than someone paying for 1,000 followers for $20 or $30, they would instead give us $20 or $30 per month. We would log into their account, we would target accounts that we thought would be likely interested in their niche or their subject matter, and we would then interact with those accounts, trying to get reciprocal actions, specifically followers, but also likes. Followers are easier to track at that time.

What’s been proven both by what I found, what my peers found, and even what researchers from Meta and UC San Diego found, is that even if you have a mediocre quality account, the reciprocation rate was about 8%–10%. If you were able to dispatch about 300 actions per day, you could maybe get 30 followers back. Then 30 times 30, that’s a solid amount of followers per month. Most people were more than happy to pay $30 or $40 or $50 even per month for that type of growth.

And you were doing that through the platform’s APIs. Was that, at the time, permissible?

No. There was a lot of, I would say, double-speak as far as what the platforms—meaning the growth platforms—were saying and what the terms of use actually said. When services like mine proliferated, it was well-known that we were breaking the terms of service.

However, the big difference between 2017 and 2018 was that in our branding, we did not say this is a Software-as-a-Service business, or we are using bots to grow it. We use generic terms, such as humans or no bots, which are fake, false and other types of terms.

The reason was that one of the precursor services, Instagram, which was a dashboard that allowed people to scale their accounts for $10 a month, was shut down by Instagram for several reasons. There was already a precedent that this was not compliant with the terms of service. But we told ourselves, as long as we don’t use “Insta” or “Gram” in our branding, we might be safe. As long as we don’t run ads directly on Instagram, we might be safe. And as long as we don’t admit to using a bot, we might be safe.

At Shark Social, while some of our competitors did receive cease-and-desist letters, we were able to operate freely in that there were no legal threats. But also in terms of profit, we weren’t the number one, we weren’t the number-five service. We were probably at best on number 15 or number 18.

It kind of flies below the radar.

Yeah. There’s nothing wrong with it. In retrospect, I would’ve loved to be number one because even in the cases that we did see settlements, the damages that Meta came after basically resulted in a lifetime ban. If I could have traded lifetime use on any Meta services for what was claimed to be $9.8 million in profit, I probably would’ve taken that trade.

Not a bad trade that you could make.

Not a bad trade.

We didn’t talk about this beforehand, but if we can get a little bit into the weeds on the technical side—just because I do have a little bit of a technical audience—did you end up using a proxy server? Because if it all came from your corporate IP space, that would be pretty easy for Meta or any platform of a similar product to track down.

Were you using VPNs, proxy services, and IP addresses at data centers and stuff like that? Or what were you doing to hide where this traffic was coming from?

That’s a really important point. Whether we’re talking web scrapers or normal services or any type of malfeasance on the internet, proxies have become front and center as far as how you are masking your tracks, or in at least diverting interest in what you’re doing. Nobody can identify that you have 1,000 accounts running from somebody’s basement in New Jersey.

Early on, we experimented with using residential IPs. We had a remote post, like at my parents’ house, at somebody else’s parents’ house, and we were doing some rotations there. That scaled very poorly because you more or less needed the VPN, you actually needed decent compute, and the computer needed to be turned on at all times. But it was OK because residential IPs, as you know, are very, very high quality.

We eventually had to move to using proxies, and we tried everything. Towards the end, I actually designed a system in AWS that was more or less like spinning up EC2 instances on demand as proxies.

Also, as some of the listeners might realize, AWS publishes their IP ranges. Anybody looking to determine how trustworthy these IPs are, these data center IPs, it’s actually quite low. But because we only tended to put one or two accounts on these proxies, it worked decently. Where we had less luck was then using some of these new, at the time, rotating residential proxies, which are mobile proxies, but they’re often in foreign countries and they’re much less reliable.

To have to deal with failure there and the cost, which is at least five times as much as we were doing for data center proxies, it was a challenge. I would say that was the main separation that we saw in the space, especially in 2019, where some people just didn’t understand how proxies should work. We at least had some expertise to continue building and continue experimenting with them.

Do you think now that you’re out of that space, it is probably harder or easier for these platforms to run?

I think it’s been a lot harder. I think a lot of the social media platforms themselves have taken an interest in limiting this behavior. Ultimately, a follower growth service is just a disruption. Of all the bad things that could happen on social media, it’s a very, very low priority.

As long as you’ve ensured that it’s not growing or scaling to this crazy extent, we can probably tolerate a little spam, or like we say, positive spam when you get these generic positive comments.

We’re seeing, for example, on TikTok, there’s a lot less of this spam that we more or less just accepted on Instagram during Instagram’s golden age. Elsewhere on the Internet, we still see a lot of businesses that are built on the backs of these platforms that are violating terms of use.

Of course, Shark Social violated terms of use, but there have been dozens, if not hundreds, of similar companies, such as in my book I address hiQ Labs. hiQ is one of these companies that said, “Hey, we’ll monitor your employee’s LinkedIn activity, and we’ll determine if they might be on the verge of quitting.”

You can think that if you scrape someone’s LinkedIn every day, and even if they don’t publish the changes to their network if they’re actually there, that’s a service that also violated Instagram’s terms.

As this data becomes more valuable, we’ve seen more and more services that specifically are only pitched toward people who want or who need rotating residential proxies. We’ve seen a huge increase. Also the costs have come down quite a lot. But overall, I would say it has become much harder.

I think there was a news story out in the last week or two that one or two of the leading residential proxy services got shut down because they were effectively running botnets. Not that they were compromised. It was not that they had paid people to, “Hey, run a residential proxy on your server,” but they’d actually gone out and compromised people’s machines. That’s where the proxies for their system came from, was people’s compromised boxes as opposed to willing participants.

That’s really interesting, but that is the nature of a botnet. In my book, in one of the later chapters, which is split into two parts called Safeguarding and Shadow Bans, I do reduce it to the same thing. I say, “Hey, you have these bot farms. Really, we’re talking about a botnet in the same sense of those like […] botnets that were used for the original wave of DDoS attacks.”

It’s really not that different. Whether you’re saying, “Hey, we control all these phones with accounts, or we’ve basically rooted PCs and we’re able to have this control,” it’s not much different. I will say it’s crazy how valuable it is when it’s used for social media. That’s the irony. First, it was used for these destructive attacks, then they’re used for scraping. It’s just so funny how the value prop has changed.

I’m sure that is. We’ll pivot here in a minute, but for the social media follower growth platforms, businesses or individuals who are looking at one of these services, what’s the risk to them that they need to watch out for?

As far as most terms are concerned, it is a terms of use violation on every platform. Starting in 2019, Instagram said, “Hey, we’re going to start removing followers that you gained using these services.” Instagram became quite good at identifying how they were gained, but also you’re always eligible for just an outright ban.

The truth is that you don’t have a particularly strong set of rights or recourse if your account is banned on a social media site. I address this in the later parts of the Safeguard and Shadow Ban chapters, which is that if you look online and you say, “Hey, what to do if my account is banned, what to do if I’m shadow-banned,” there’s now an entire shadow industry of account recovery scams, ways to get your account back and to do this and that.

The only thing I identified and confirmed in my book was that in certain states, there are business and other types of essentially legal services that people have successfully used to lobby corporations based in California to reinstate their accounts, which I find very, very interesting.

Ultimately, whether you feel that it was an arbitrary decision or not, it’s really not worth pushing it if you have an account that is verified, that is popular, that has the post history, that has tens of thousands of followers. Just to try to get a couple of more, most people would say it’s not a great idea.

When you’re building your business based on suspicious activities, the likelihood of that being able to be sustainable becomes in question.

Right, and you could be banned in ways that you and I would understand, but the average person might not understand like, “Oh, I have a MAC address. I have a device ban. Oh, I have an IP ban. Oh, I now have an identity ban because I need to use my face anyway.”

I’ve actually worked with people who, in the TikTok space are saying, “Hey, they banned my first account. They banned my second account, but I didn’t post anything.” I’m like, “Yeah, it’s way more advanced than the most non-technical users could imagine.” Then you get trapped in this recovery scamming realm where everything is over promised and nobody can do anything.

The flip side is the consumer side of social media, and you talk about that and the systems that you built to exploit people may not be the right phrase, but what were some of the systems that you built targeting consumers of social media?

Really interesting part of my life, which began after I started writing Framed, was that I was offered the opportunity to lead a special projects team at a mobile app startup that was a social network. I nicknamed it Cutlet in my book. A lot of it was based around the financial space or the retail trading space, which I have quite a lot of experience in.

Rather than me coming and telling them how to build things in the trading space, they wanted me to work with alternative data and also user data to build persuasive technology systems. It was really unique and I felt that it was at least worth a chapter in the book.

What I built there was a feed. It was a feed largely based around Reddit, but then I started splicing in other types of content from other sources, as well as obviously in internal features. I started to work on push notifications.

When we say either exploiting or addicting users, my only success metrics were the rate of conversion of how many people clicked on a push notification. I had no rules, no guidelines whatsoever. I could wake up in the morning, type something out in one signal, and I could send it right out. There were no gateways. It just was sent to all of our users.

I was able to experiment very freely and very rapidly, but also in a way that had some risk to it. I could have sent anything. That’s a risk that I think a lot of people haven’t addressed because it’s so specific.

But at the end of the day, my performance was based on not necessarily attracting new users, but manipulating our existing users to spend more time on the app and to return to the app. Rather than being a monthly active user, my goal is to try to get them to be more like weekly active users.

Did you ever find balances? Did you ever find thresholds, which is this is way too much interaction with the user that at some point you annoy them and they say, “I’m just going to uninstall the app or stop the notifications”? What do those thresholds look like?

They are much more, I would say, fat-tailed than you would expect. For me, I’m very sensitive. I actually have no push notifications at all on my phone, personally. I was shocked how much or how frequently you could annoy users until they did uninstall.

I think I mentioned it in the book. The chapter’s called The Puppeteer, which I think is quite appropriate. You could blast it, and the amount of actual negative feedback you got was shockingly small.

We’re thinking about thresholds. You could send a message every day, and most people didn’t care. Eventually, you would see, yeah, over week over week, some people would, of course, uninstall the app or turn off notifications.

But I think I mentioned in the chapter, first of all, our user base wasn’t huge. It was in the thousands. There was no statistical significance to app uninstalls or notifications being turned off, which is crazy because I have a mailing list personally, which only has a couple of hundred people, and I can tell you exactly what the unsubscribe rate is week over week. It’s non-zero. That’s the irony in it. Some people are so desensitized to push notifications that they’re like, “Yeah, OK.”

So you’re younger than me. You’ve grown up in the social media age. I way predate social media. I predate Google. I think I predated Google back when I was doing SEO stuff. It was AltaVista, which I don’t think even exists anymore. As a consumer of social media, how have you seen some of the techniques that you’ve actually used affect you personally?

It’s really complicated. I will say, my parents came to New York this weekend. Really, they took me out for dinner to celebrate my book being published.

We had a lot of these conversations of, “Hey, we read your book. We have no idea what you’re talking about, but that makes sense what you’re saying on MySpace, that you were using MySpace to date people when you were in seventh grade. We didn’t do that growing up. It was totally different.”

But I think also, a lot of our conversations end on this much more sour note where I’m like, “This is me, and in a way I’m a survivor, or I’m someone who did things in maybe the right way, so to speak, but I’ve also seen so many people be consumed by social media or who have had really unhealthy, psychological impacts from social media.”

A lot of the book was related to the journey of being born in the 90s, growing up with the internet, and trying to preserve a lot of this early internet history. Maybe not as early as AltaVista, but to say, “Hey, before everyone used Google, we had directory sites.”

Directory sites were really, really important, and we’ve gone full circle. Now, when you search for certain things, you’re brought to essentially a directory site, except everything’s an affiliate link, and we go through that.

I talked about a lot of the impact on me personally and as well as consumer psychology, which is to say, I remember getting a hit of dopamine when I came home from school, booted up the computer, logged into MySpace, and I maybe had one comment or I had one friend request.

Even when Reddit came out a couple of years later, or when I was using it a couple of years later, I remember I would be skateboarding in the afternoon, I would come home, and I remember that I was being trained. It’s almost like Pavlovian conditioning where I came to look for this high-quality type of information and also aggregation on Reddit.

Now, I can say 15 years later, I’m still there and I’m still seeking what I found once upon a time. But you and I could probably agree that the quality is no longer there, and it’s a very far cry from probably what the Internet could have been.

Have you pivoted to, “I avoid social media now,” or are you still, “I use social media here and there”?

It’s ironic because I wrote a book about social media, and in it I poke fun at friends and peers who said, “If you promote this on TikTok the right way, you will be an influencer. You will be the guy, at least the guy of whatever this year or whatever.”

That’s compelling because you write a book and you want more people to read it, and maybe you want to make more money, or for me, I’m really interested in speaking and just getting the word out there.

But also in my book, I’m very, very cynical on the whole thing. I say that even influencer culture is really based in nihilism. I say it’s similar to the writings of Fyodor Dostoevsky, which is really, really deep and beyond the scope of what I want to talk about in a podcast.

I’m thinking these things are really, really bad. For me, even though I ran this business on Instagram, even toward the end, I was only logging into Instagram with my burner accounts, with the accounts I was basically sacrificing or doing analytics using, rather than my personal account.

I say I am so, so impressed, and I’m so, so enthralled with what the internet age has provided for us, but we’re not quite there. I think for me, social media has become a necessity in some sense. Of course I use LinkedIn, I use maybe Facebook to check birthdays, but a lot of these more modern, and you’d say probably more addictive like Instagram, TikTok, even Snapchat to an extent, I don’t use them at all.

As we wrap up here, any advice for businesses wanting to grow their profiles, things that they should avoid, and for consumers, things that they should look out for and question on social media?

As a business owner, people are always going to be trying to sell you something, and now it’s AI. Once upon a time, it was SEO. Then it was content. Then it was just, “Hey, we’ll schedule posts for you.”

There have been all these services and I can’t sit here and say that they’re not useful. Because, of course, if you have a business but you don’t have a Google listing, or your hours are incorrect, yeah, sure, it’s probably worth paying somebody to make sure this is all correct. But to connect a constant or frequent post history with saying, “This is actually going to get me more customers,” in many cases that isn’t true.

People don’t really use social media that way. Or if they do, their feed is so saturated that they’re not going to see your posts anyway. So then you’re thinking, “Oh, well I already spent money here, let’s throw some money on ads.” And before you know it, you don’t—especially if it’s a brick-and-mortar business—necessarily have a connection between one thing and another.

That’s some advice I give to business owners, is that you should probably pause before you do too much under the umbrella of social media, especially if you’re calling it competitive intelligence, which eventually just becomes mindlessly scrolling after five or 10 minutes of actual research.

And for individuals or people who are trying to build themselves up on Instagram, specifically, or TikTok, these were my primary customers. I know what they wanted because I had this very, very long additional details sheet where they could submit what their goals were, what they were trying to do, what they were about. This helped with targeting as well.

But I was interested. When I was writing the book, I still had everything preserved. Looking through these just paragraphs and thousands and thousands of words, I realized that almost nobody was talking about, “I want to make more sales, or I want more conversions.”

In fact, the only times we had the word conversion used was in two cases. We had two different businesses doing van conversions, like van life—people want to live in their van. And the other one was a van that said, “We don’t care about conversions. We just think this is how we are going to get to play larger shows by having a larger following.”

It’s weird now because you see all this talk of sales funnels, AI-assisted this, inbound marketing and whatever. In my book, I say it comes down to what I call getting good, which is that in many cases there always will be somebody better than you. And a lot of talent is not necessarily worthy of being globalized. So do what makes you happy. But scrolling does not bring you, I think, to the promised land that it once did without taking out your wallet and paying for ads.

It’s a very cynical take both for businesses and personal, but I still think that there are some cool opportunities out there by being very minimal, only as needed social media user.

Awesome. If people want to find your book, where can they find it?

It’s currently on Amazon. I basically sell my book at cost. Right now that’s $1.99 for the ebook, and that’s $15 for a 430-page paperback. Currently, I’m also happy to announce that we’re working on the audiobook as well. So hopefully by the end of the summer, there also will be Framed on Audible with my voice. If anyone listening likes my voice and wants to hear it for 18 hours or more, it will be there. Also, last week, Framed was approved for bulk distribution. It’s now available through Barnes & Noble and other major retailers.

That’s awesome. Not that you’re looking for social media followers, but if people want to connect with you online, where can they find you online?

I prefer LinkedIn. I do check it pretty frequently, and I do have some posts there that are for more this balance of professional as well as accomplishment base of what the book has done and where I’ll expect it to go.

I also write a newsletter, which is currently on Beehiiv, so it’s timohearn.beehiiv.com. I have my personal blog as well, which I use for more long-form posts. Anyone interested in really wanting to know who this guy is, what he is talking about, we have posts there going back 10 years. Everything from video games to pop culture to technology. The fan base I built there was really what inspired me to write the book.

All of those things are pretty active, and I’m happy to connect with people who are looking to learn more about me or just looking to talk about Framed.

Awesome. We’ll make sure to include links to all those in the show notes. Thank you so much for coming on the podcast today.

Thanks, Chris.