Running a click farm instead of editing the database would be the sensible thing to do when trying to keep the operation secret. That way, people inside FB would not know about the fraud.