A weighted highland cow plushie has become the centerpiece of a sophisticated e-commerce fraud operation flooding Instagram and TikTok with stolen creator content. The scam operates through rotating website domains, hijacked influencer videos, and systematic credit card exploitation, generating profits for fraudsters while Meta earns billions from fraudulent advertising.

According to Lars Lofgren, a fractional VP of content who documented his experience purchasing what he believed was a legitimate weighted highland cow, the product that arrived bore no resemblance to the advertised item. "It took me 20 MINUTES to realize this was the highland cow that I ordered," Lofgren wrote on January 22, 2026, in a detailed investigation of the scam mechanics.

The fraudulent operation illustrates a broader pattern affecting social media advertising platforms, where scammers exploit creator content and platform advertising systems with minimal intervention from Meta. Internal documents revealed that Meta's platforms expose users to an estimated 15 billion higher-risk scam advertisements daily, with the company internally projecting approximately 10% of 2024 annual revenue from advertisements promoting scams and banned goods.

The anatomy of a social media product scam

The weighted highland cow operation follows a methodical approach refined through multiple iterations. Scammers identify viral consumer products with substantial margins, typically priced above $50 and demonstrating consistent sell-out patterns. The real weighted highland cow from Uoozii, sold exclusively on Amazon, frequently goes out of stock, creating persistent unfilled demand that scammers exploit.

According to Lofgren's documentation, the scam cycle operates through seven distinct phases. First, fraudsters create fake websites and company profiles on Facebook, Instagram, and TikTok. They steal legitimate creator advertisements from influencers who promote authentic products, repurposing these videos as their own paid advertisements. Traffic flows from these ads to fraudulent websites designed to mimic legitimate e-commerce operations.

Once orders arrive, scammers either ship inferior products that cost almost nothing to produce or fail to ship anything at all. Some operations escalate their fraud by charging customers' credit cards multiple times for single purchases. Multiple victims documented in reviews receiving unexpected additional charges long after their initial transactions, with some forced to cancel credit cards entirely.

The timeline matters. After approximately three months, complaint volume reaches critical mass. Chargebacks escalate. Platform reviews accumulate. At this inflection point, scammers shut down the entire operation, register new domain names with slight variations, and restart the cycle under fresh branding. The only consistent cost is advertising spend, but since fraudsters don't maintain legitimate business operations, they can outbid authentic merchants for ad placements while maintaining substantial profit margins.

Lofgren identified three sequential domains operated by the same fraud ring: highlandplushy.com, highlandcowplushy.com, and highlandcowplushie.com. The continuity becomes evident through identical privacy policies, matched exactly between defunct and active sites. "The same people are behind both sites," Lofgren concluded after comparing policy documents. "All they did was swap out the entity (KairaCo -> Highlandcowplushie)."

Influencer content becomes the perfect bait

Legitimate content creators maintain no involvement in the scam. Influencers like Jessica Ciraulo, Mary Fortune, and Allie Sholtis created authentic promotional content for Uoozii's real weighted highland cow, typically participating in affiliate programs or receiving direct compensation from the legitimate manufacturer. Their videos showcase genuine products available through verified channels.

Scammers appropriate these creator videos wholesale, running them as paid advertisements without permission. The ads direct viewers to fraudulent websites bearing no connection to either the creators or the authentic product manufacturers. Facebook's Ad Library contains dozens of active campaigns using stolen creator content to promote fake highland cow products.

According to Lofgren's analysis, "Jessica regularly posts about the highland cows, whenever they come back in stock. She has people post comments (probably to trigger the Instagram engagement algo), and then sends links via DM." This legitimate influencer marketing practice becomes weaponized when scammers steal the creative assets and redirect the traffic.

The creator economy's rapid expansion creates both opportunity and vulnerability. Research indicates the global creator economy is projected to grow from $191 billion in 2025 to $528.39 billion by 2030, representing a 22.5% compound annual growth rate. This growth generates substantial video content that scammers can exploit.

Industry guidelines emphasize that endorsements must reflect honest opinions or experiences, but enforcement mechanisms struggle when fraudsters steal content entirely. Creators produce videos for legitimate products, scammers repurpose those exact videos for fraudulent operations, and platforms serve the ads to millions of users who cannot distinguish authentic from fraudulent sources.

Platform economics enable systematic fraud

Meta's advertising infrastructure generates revenue from fraudulent campaigns at each iteration of the scam cycle. When one fraudulent website shuts down and another launches with identical mechanics but different branding, Meta collects advertising fees throughout. The platform's approach to scam prevention prioritizes revenue preservation over user protection.

Documents reviewed by Reuters showed that Meta implemented a "penalty bid" program charging suspected fraudsters premium advertising rates rather than blocking them entirely. The company established a 95% certainty threshold before banning advertisers, applying financial penalties below that threshold instead of preventing fraudulent ads from serving.

Nicole Pruess, a freelance presenter and educator for U of Digital with more than 26 years of experience in advertising technology, noted during an appearance on the MadTech podcast that "this is not the sword I'd die on" when discussing Meta's scam advertising practices. The scale of Meta's platforms complicates enforcement - the company serves approximately 15 billion ads daily across Facebook, Instagram, WhatsApp, and its other properties.

The highland cow scam demonstrates how minimal Meta's ad verification requirements remain. Scammers create fresh Facebook profiles, upload stolen creator videos without modification, and direct traffic to newly registered domains. "I'm shocked that it's so easy to rip a legitimate creator video without any edits, post it as an ad, and send people to ANY WEBSITE ON THE INTERNET," Lofgren wrote. "There are always going to be scams out there but this one feels a bit too fucking easy."

Meta detailed the removal of more than 134 million scam advertisements across its platforms throughout 2025, yet the highland cow scam persists through continuous domain rotation. The company's enforcement approach focuses on removing individual campaigns rather than systemic prevention of the underlying fraud mechanics.

The proliferation beyond single operators

Multiple fraud rings now operate variations of the highland cow scam simultaneously. Lofgren's investigation identified numerous active operations running identical playbooks with different websites. PlushJoy advertises weighted highland cows for $9.95, a price point that signals clear fraud. AtGreenic runs similar campaigns with stolen creator videos redirecting to its own fraudulent storefront.

"Go to the Facebook Ad Library, search for Highland Cow, and you'll come across tons of different websites all running the same scam," Lofgren documented. Each operation follows the established pattern: steal creator content, run ads on Facebook and Instagram, direct traffic to fake websites, ship inferior products or nothing at all, and repeat under new brands as complaints accumulate.

The scam's proliferation extends beyond Facebook. TikTok serves as an equally viable platform for fraudsters, though the platform earned TAG certification against ad fraud and for brand safety in May 2022. The certification process evaluates platforms against industry best practices for serving ads in fraud-free environments, yet the highland cow scam demonstrates persistent gaps in practical enforcement.

TikTok's approach to boosting search activity introduces additional complications. According to documentation, TikTok sends notifications prompting users to "type 32 search queries today" in exchange for $3 vouchers with no minimum spend for TikTok Shop purchases. This incentivization strategy raises questions about search signal integrity when users enter low-intent queries simply to unlock credits.

The distributed nature of the fraud creates attribution challenges. Individual creators receive complaints about scams from viewers who cannot distinguish between legitimate creator partnerships and stolen content used in fraudulent campaigns. Comment sections on authentic creator posts fill with frustrated customers who believed they were purchasing from the creators themselves.

Impact on legitimate businesses

SnugglePals, a legitimate company based in Oregon, manufactures and sells real weighted highland cows through verified channels. The company founder produced multiple videos on Instagram addressing the scam's impact. "People are going to SnugglePals and leaving bad reviews about how they got scammed... by a different fucking company," Lofgren documented. "SnugglesPals is losing out on revenue because of this."

The phenomenon extends beyond individual merchants. TrustPilot pages for defunct scam domains contain hundreds of complaints from defrauded customers. Highlandplushy.com's TrustPilot page accumulated extensive documentation of fraudulent transactions before the site shut down. The current operation at highlandcowplushie.com will likely follow the same pattern before transitioning to the next domain variation.

Allie Sholtis, a content creator who produced legitimate highland cow promotional content, exchanged emails with Lofgren confirming she worked directly with Uoozii, the authentic manufacturer. Her Instagram posts now contain comment threads where multiple users claim they were scammed after clicking ads that appeared to feature her content.

The confusion damages legitimate influencer marketing operations. The global creator economy's projected growth to $528.39 billion by 2030 depends on audience trust in creator recommendations. When scammers systematically appropriate creator content for fraudulent campaigns, they undermine the fundamental value proposition that differentiates creator marketing from traditional advertising.

Creators face impossible choices. They can continue producing promotional content for legitimate products, knowing scammers will steal their videos. They can attempt to watermark or technically restrict their content, reducing its effectiveness for legitimate marketing purposes. Or they can cease product promotion entirely, eliminating a primary revenue stream.

Technical mechanics of domain rotation

The privacy policy comparison reveals operational continuity despite apparent business transitions. Lofgren documented that the privacy policy on highlandplushy.com matched word-for-word with the policy on highlandcowplushie.com, with only the entity name changed. The Shopify infrastructure underlying these sites suggests minimal technical sophistication - Lofgren's initial purchase included a blank confirmation email with no customization beyond default Shopify templates.

Domain registration costs remain minimal. The fraudsters' primary expenses are advertising spend and payment processing fees during the brief period before chargebacks force merchant account closures. Shipping inferior products costs nearly nothing compared to potential revenue from each successful transaction, particularly when some operations charge credit cards multiple times per order.

Payment gateway management represents the operational constraint. Legitimate payment processors implement fraud monitoring systems that detect excessive chargeback rates. Once a merchant account accumulates sufficient complaints, payment processors terminate the relationship. This constraint drives the three-month cycle Lofgren identified - scammers must shut down and restart before merchant account termination becomes inevitable.

The rotating domain strategy defeats consumer awareness efforts. Warnings about specific fraudulent websites become obsolete within months as operations migrate to new domains. Search engines index complaint pages for defunct domains while current fraudulent operations run advertisements promoting their fresh websites.

Identifying authentic sources

Two legitimate sources exist for weighted highland cows matching the viral product. Uoozii sells exclusively through Amazon under their verified brand account. The product listing includes Amazon's standard buyer protections and fulfillment guarantees. When the product shows out of stock on Amazon, Lofgren emphasized, "DO NOT buy it from any other website. It is likely a scam."

SnugglePals maintains an active Instagram account and runs legitimate advertisements. The company operates from Oregon with verifiable business registration and consistently restocks products rather than disappearing. Lofgren purchased products from both sources to verify their authenticity, documenting the received items in his investigation.

The Uoozii highland cow, according to Lofgren's comparison, demonstrates superior manufacturing quality. "The fur is softer. The weight distribution in the paws is delightful. If you wiggle the highland cow, you can't help but laugh. I think the design is a bit cuter." Both products received positive assessments, but Lofgren's preference leaned toward Uoozii's execution.

Verification requires deliberate effort. Consumers must resist the impulse to click Instagram or TikTok advertisements, even when featuring familiar creator faces. They must navigate to Amazon directly and search for the Uoozii brand or locate SnugglePals through verified Instagram accounts. The additional friction reduces conversion rates for legitimate merchants while fraudulent operations optimize for impulse purchases through one-click checkout systems.

The regulatory gap in platform accountability

Google announced similar advertiser verification requirements for financial services advertisers in Ireland, New Zealand, South Korea, and Thailand starting November 2024. The company's AI-powered defense systems suspended 39 million advertiser accounts in 2024, representing a 208% increase from 12.7 million suspensions in 2023. This enforcement escalation contrasts with Meta's documented approach to scam advertising.

Google tightened phone number policies to combat fraud in ads, with enforcement beginning December 10, 2025. The company now restricts phone numbers linked to fraudulent activity from call-only ads, call assets, and location assets. The update introduced requirements that phone numbers found to be associated with fraudulent activity or policy violations will be deemed unacceptable for advertising use.

The contrast in platform approaches matters for advertising ecosystem integrity. TAG's comprehensive approach to industry challenges has proven effective in reducing fraud, with collaborative industry efforts saving U.S. advertisers $10.8 billion in 2023 alone through a 92% reduction in losses that would have occurred without established standards.

European enforcement has intensified. Anti-fraud programmes prevented €3.45 billion in potential Invalid Traffic losses during 2023, cutting fraud-related costs by 69% compared to what would have occurred without protective measures. The study revealed that while significant progress has been achieved, European advertisers could save an additional €1.075 billion annually by extending TAG-level anti-fraud standards to the remaining 24% of digital advertising supply chain channels.

Singapore's government joined the Global Signal Exchange on September 3, 2025, becoming the first government entity to participate in the real-time threat intelligence sharing platform alongside over 30 private sector members including Google, Meta, and Microsoft. The platform tracks more than 380 million threat signals, enabling faster detection and disruption of criminal activity.

Meta's participation in these collaborative efforts exists alongside its documented approach to monetizing suspected fraud through penalty bid programs. The company announced comprehensive measures to combat romance scams across its platforms on February 12, 2025, releasing data showing the company took down more than 408,000 accounts engaged in romance scams during 2024. Yet product scams like the highland cow operation continue operating openly through the same advertising infrastructure.

Consumer protection challenges

Lofgren initiated a chargeback with his credit card company after the fraudulent highland cow arrived and the listed refund email address bounced as non-existent. "I gave my credit card company a call, explained the situation, they initiated a chargeback that same day, and I went back to waiting," he documented. Within two days, the scam company approved the refund. "Even heartless highland cow scammers bow to the whims of Visa and Mastercard."

Credit card protections provide individual recourse but fail to address systemic fraud. Each successful chargeback represents one recovered transaction among thousands of fraudulent purchases. The scammers maintain profitability despite chargeback losses because sufficient customers never dispute charges or fail to overcome the friction of initiating disputes.

The complaint infrastructure fragments across platforms. TrustPilot accumulates reviews for specific domains that become obsolete when operations transition to new websites. Better Business Bureau complaints attach to shell companies that dissolve before enforcement actions materialize. Facebook and Instagram user reports disappear into automated support systems that Meta's own employees describe as inadequate.

Documents indicated Facebook and Instagram users filed approximately 100,000 valid reports of fraudsters messaging them each week, yet Meta ignored or incorrectly rejected 96% of them. Larger spenders designated as "High Value Accounts" could accumulate more than 500 strikes without shutdown. Four fraudulent advertising campaigns removed earlier in 2025 had been responsible for $67 million in monthly advertising revenue before termination.

Long-term implications for digital commerce

The highland cow scam illustrates vulnerabilities in social commerce infrastructure that extend beyond individual product categories. Any viral consumer product with adequate margins becomes a potential target. The methodology transfers across product categories - scammers need only identify trending items, appropriate creator content, register new domains, and repeat the established playbook.

Creator economy growth from $191 billion in 2025 to projected $528.39 billion by 2030 generates increasing volumes of promotional content that fraudsters can exploit. As creator marketing becomes more sophisticated, with 41% of U.S. social media users ages 18-65 attending at least one in-person influencer event, the financial incentives for content theft escalate proportionally.

Platform advertising systems optimized for rapid campaign deployment enable scam operations to launch within hours. Shopify's one-click store setup, combined with minimal advertiser verification on Facebook and Instagram, creates an environment where fraudulent operations scale more efficiently than enforcement mechanisms can adapt. The three-month scam cycle outpaces platform review processes designed for legitimate business disputes rather than systematic fraud.

The economic incentives remain misaligned. Meta generates revenue from fraudulent advertisers at each iteration of the scam cycle. Credit card companies collect processing fees from fraudulent transactions regardless of eventual chargebacks. Only consumers and legitimate merchants absorb the full cost of the fraud ecosystem.

Lofgren concluded his investigation with direct attribution: "Facebook made money from duping you. They made money of duping me. Facebook got paid to show that ad to my partner. I never would have paid the scammers if Facebook hadn't allowed that ad to run. That ad is the reason I got burned."

The weighted highland cow scam will continue operating under new domain names with slight variations until either platform enforcement improves substantially or consumer awareness reaches critical mass. Meanwhile, legitimate merchants like Uoozii and SnugglePals compete for customer attention against fraudulent operations that exploit platform advertising infrastructure and stolen creator content with minimal consequences.

Timeline

Summary

Who: Fraudulent e-commerce operations systematically exploit social media advertising infrastructure while legitimate merchants Uoozii and SnugglePals manufacture authentic weighted highland cows. Content creators including Jessica Ciraulo, Mary Fortune, and Allie Sholtis produce promotional videos for legitimate products that scammers appropriate without permission. Meta operates the advertising platforms enabling the fraud cycle.

What: A sophisticated product scam appropriates influencer videos promoting authentic weighted highland cows, redirects traffic through Facebook and Instagram ads to fraudulent websites operating under rotating domain names, ships inferior products or nothing at all, charges credit cards multiple times, and restarts the operation under new branding every three months before complaints accumulate to critical levels.

When: The scam operates continuously through systematic domain rotation, with individual operations typically lasting approximately three months before shutting down and relaunching under new website addresses. Lars Lofgren documented his experience on January 22, 2026, after purchasing from highlandplushy.com months earlier, with the operation subsequently migrating to highlandcowplushy.com and currently operating as highlandcowplushie.com.

Where: The fraud exploits Facebook and Instagram advertising infrastructure primarily, with additional operations on TikTok. Stolen creator content runs as paid advertisements directing traffic to fraudulent Shopify-based websites. Legitimate products are available exclusively through Uoozii on Amazon or SnugglePals through verified Instagram channels.

Why: The scam persists because platform economics prioritize advertising revenue over fraud prevention, with Meta implementing penalty bid programs that charge suspected fraudsters premium rates rather than blocking them entirely. Minimal advertiser verification requirements, combined with the ability to steal creator content without consequence and rapidly deploy new fraudulent websites, create an environment where scam operations scale more efficiently than enforcement mechanisms can adapt. The three-month operational cycle generates substantial profits before chargebacks and complaints force domain transitions, while Meta collects advertising fees throughout each iteration.

Share this article
The link has been copied!