There's a fake Ray-Ban "Official Site" (rbdxxx.com, not the true Ray-Ban site, but a scammer) that used to generate fake recommendation posts from friends, presumably ones with weak permissions and/or passwords.
In the past 2 weeks, I've seen multiple cases of a fake Ray-Ban site now generating fake "1-day sale" ads as photos in somebody's Facebook photo set and then broadcasting ads by "tagging" each of their friends as being in the fake-photo-ad, which then generates an ad in each of their friends of the form "(Your friend name) was tagged in a photo."
The only flagging mechanism I see is to:
- click on the ellipsis
- select "Give feedback on this photo"
- click Spam
- click Send
... but it's built around being disciplinary to the Facebook user, and they lack a means of calling attention to the underlying fraudster.