How it works: If you are on Facebook, you've probably seen it happen - you get a friend request from someone you are already friends with. But maybe you are not 100% sure, so you accept the friend request. Contrary to what many assume, the cause of this is not a hacked account - the scammer doesn't have actual control of your friend's Facebook account. This is a spoof - they have taken your friend's name, friends list, and picture, and created an entirely new account to fool you into thinking it's your friend.

What they are trying to do: The typical goal in this scenario is to enmesh you in an updated classic confidence scam. Your new old "friend" will initiate a Facebook Messenger conversation with you, which you will accept, as it's from a "friend". Once they have you conversing with them, they will tell you about a great site where they were awarded some free money. If you take their bait and follow their link, you will be awarded free money too - you just have to register with a lot of personal information, and pay a "transfer fee" to get the funds. Needless to say, there is no actual money awarded, your "transfer fee" goes in their pocket, and who knows what they will do with your registration information.

What else can happen:  If you have accepted a friend request from a spoofed account, you gave the scammer friend level access to your Facebook information, even if you have your Facebook account locked down to non-friends. They can use that inside knowledge to engage with you and use your trust to coax you into falling for other scams. They can also use your information to spoof YOUR account, and try to scam YOUR friends.

How to avoid the scam: If you get a friend request from someone you don't know, ignore it. If you get a friend request from someone you DO know, check to see if they are already your friend. If they are, you should immediately report the imposter account to Facebook, and also alert your friend, via some other means of communication, that they are being impersonated. The sooner you shut down the impersonator the better, as I have seen Facebook insist fake accounts are legitimate if they have been active for a long enough period of time.

Preventative action - This scam will only work if the imposter can access not only a name, but the associated friends list. By default, Facebook makes friends lists public information, so the best way to keep your own profile safe from impersonation is to make your friends list private. While you are at it, you should review your privacy settings in other areas of Facebook. Also, check your friends list for any duplicates. If you see anything suspicious, check with your real friend and see if perhaps they have created more than one account.

What if you fall for it: If you have accepted a phony friend request, unfriend the fake account as soon as possible, and report the profile to Facebook. If your own account is being spoofed, immediately search for the fake account and report it to Facebook. Change your Facebook profile picture, and post an update on your page alerting your friends not to accept friend requests from you using the old profile picture.

Of course, if you need any help with any of this, feel free to give me a call. Social media is a wonderful way to keep in touch with old friends, but it has its pitfalls as well!