Last weekend, a good friend of mine had her Facebook account cloned. Somebody had created a perfect replica of her Facebook profile and was sending out friend requests to all of her friends (including me) with a message saying “I had to create a new Facebook account, please accept”.
I noticed that a few people accepted these requests, however, knowing what possible dangers lurk out there on social media and the internet, I sent her a Whatsapp message:
“I think someone has cloned your FB account, just got a friend request from “you””.
“OMG! That wasn’t me! What should I do?”
“Go into your privacy settings and set everything visible to friends only. Then delete anyone you don’t know from your friends list. Finally, post an update warning people and tell them not to accept a second friend request from you. I will report this fake profile.”
“Ok, thank you. Why would someone do this?”
That’s a good question – Why would someone do this?
Actually, this approach isn’t a big difference from “Email Spoofing”, read my previous blog about that here.
As I carefully explained to my friend, there are various reasons a scammer would clone your Facebook profile. They can use it for tricking your friends into thinking you are having an emergency and you need money. For example, this person adds as many of your friends as possible and then posts a fake update saying how they’ve broken down in their car and they’re stuck. Once someone comments or sends a message asking if you’re ok, they reply asking for money.
They can also use it to spread hateful messages and thus get you banned from Facebook instead of them. More worryingly, they can recommend bogus internet sites to friends which will deliver Malware or Ransomware when visited.
When she asked me for more information, my friend and I met up for a coffee on Saturday afternoon so that I could explain to her how the last one works.
I’ve seen lots of websites try to fool me into installing an “extension” for my browser in order to “Correctly display the content of the site” to me. 99.9% of the time, this “extension” is some form of virus or Ransomware. Obviously I don’t fall for it and I don’t take chances. I’d prefer to NOT see a funny Cat video than risk infecting my computer. However, that’s all well and good if I’m just browsing the internet. But what if a close, trusted friend of mine messaged me saying “Hey! Check out this link – it’s the best news ever! You have to see this!”. Perhaps, I’d think twice in that case.
So for the sake of argument, let’s say I visit the site. A popup appears saying “You must install this Chrome extension (or a similar message) in order to view the funny cat video”. So I install the file that the site provides, and I’m now infected with Ransomware.
This approach by the scammers has increased in popularity recently because it yields better results than sending thousands of emails to different people. The return on investment (At least, the time invested) is much greater because people tend to trust their friends and follow recommendations.
So, what can be done to avoid being cloned? Actually, it’s very easy to avoid being cloned. You simply need to lock down your Facebook profile a bit and not make all of your information and posts public.
First, go into the Privacy Settings on your Facebook profile. The following image is my own Facebook privacy settings page.
In order for your posts to not be public, you should change the future posts option to “Friends”. You also have the option to look back on your Facebook history (Activity log) and change previous posts to private or friends only. Or if you prefer to just change older posts en masse, click on the “Limit Past Posts” option.
You’ll see that I can receive friend requests from anyone. You can restrict that if you want, however I keep it like this since I have friends from many countries around the world and we don’t always share mutual friends. However, if someone sends me a request and I don’t know them, I will message them privately to ask how I know them. If they can’t convince me that they are a legitimate friend, they’re blocked.
Finally, I don’t mind my friends typing my email address or phone number into Facebook’s search box to find me, if they need to. Most, if not all of them have my email address and phone number anyway. However, I don’t want Google, Bing or other search engines caching my Facebook profile so that people can Google me. Hence the final setting is set to “no”.
Another recommended feature (Which many people don’t know about) is the ability to make your list of friends private. To do this, go to your profile and click on “Friends” and then “Edit Privacy”.
Here I’ve set everything to “Friends only”. Because this isn’t just protecting my privacy, it’s also protecting my friends’ privacy. Some of my friends do not want to be found on Facebook by strangers, and I see no reason why a stranger should have the ability to land on my profile and start looking through my friends list. I wouldn’t let a stranger in a bar look through my phone contact list and personally, I don’t see any difference between that and this.
Finally, once you’ve finished making those quick changes, don’t forget to double check your personal information to see what’s visible and to whom. Here is a small snapshot of my personal Facebook info:
Here, my birthday (Both date and year) and visible to my friends only, the setting of which is visible when you hover your mouse cursor over that field. Also my gender and which languages I speak are visible to friends only. I have never even completed my religious or political view information on Facebook. Other settings in this area include my phone number, address and email address – which are also set to Friends only.
Once you’ve finished making these privacy changes to your Facebook profile there is a way to check what this looks like to people who aren’t your Facebook friend yet, which is a very useful tool for checking to see if you overlooked something.
Go back to your main profile page and in the bottom right corner of your cover photo, click on the box with three dots and then “View as”.
Now you will be looking at your own profile from the viewpoint of a non-friend. I recommend exploring your own profile to see what’s visible to the public and what isn’t.
There are very few legitimate reasons to share your personal information publically on Facebook, but this depends on exactly how you like to use Facebook. For me, it’s a great way to keep up with my friends all over the world and stay in contact with them. For that reason, I don’t see the need to be sharing my address, private photos, friends list or my birthday with strangers. My approach also prevents my Facebook account from being cloned – it’s not possible unless I accept the friend request of a scammer, which I also won’t do. And if a friend of mine sends me a friend request on Facebook (suspicious if we are already friends), then I will contact them via messenger or other medium to verify the request before accepting.
By the looks of things, the cloned account of my friend has been removed from Facebook after having been reported by various people, so she’s safe now. Safer still now that she’s made the changes to her profile that I’ve detailed above.
Her biggest concern over this incident was that it was somebody trying to cause problems in her life and that it was a personal vendetta or something. She was very worried that she’d wronged somebody and that person was trying to exact revenge. However, the truth is much sadder and a little less dramatic – it’s just a scammer sat in their pajamas trying their best to fool people into giving up money. Nothing less than a common crook.
It may seem strange that as the Account Manager of a Managed IT Service company, I’m dedicating an entire blog post to tips about using Facebook safely. However, the dangers of your information being publically available on Facebook are very similar to email spoofing, spam email and other day to day dangers of the internet. In fact, Ransomware and other Malware has recently become so lucrative that scammers are now even battling each other and sabotaging other strains of Ransomware in order to eliminate competition. If that doesn’t drive home the point of just HOW lucrative Ransomware has become, I don’t know what will.
“Don’t make me regret this” – My thoughts when accepting a Facebook friend request.