Facebook Account Cloning: A Sneaky Social Engineering Scam

Have you ever received a friend request from someone you think you know, but something just feels off? Or perhaps it is a message from a friend asking for a favor, but their tone seems a bit unusual. You might be encountering a common online threat: Facebook account cloning. Don't panic, this doesn't mean your account has been hacked.

What is Facebook Account Cloning?

Facebook account cloning is a type of social engineering scam where cybercriminals create a fake account that mimics a real person's profile. They use this fake account to trick the person's friends and family into sharing personal information or sending money.

How Does It Work?

1. Account Creation: Cybercriminals gather information about their target, such as profile pictures, posts, and friend lists. They use this information to create a convincing fake account.
2. Friend Requests: The scammer sends friend requests to the target's friends and family, hoping they will accept without question.
3. Social Engineering: Once friend requests are accepted, the scammer may start sending messages asking for favors, such as money transfers or personal information. They may also post misleading or harmful content. One common scam we often see is that cybercriminals will attempt to get you to buy gift cards and then share with them the code on the back. 

How to Protect Yourself:

• Be Vigilant: Always verify friend requests, even if they seem to come from someone you know. Look for inconsistencies in profile information, writing style, or recent activity.
• Enable Two-Factor Authentication: Although this won't protect your information from being harvested by a cybercriminal, it will add an almost undefeatable layer of security to keep them from logging in as you. Just be sure to set more than one method for MFA, and be sure that they don't both rely on your mobile phone; you'll eventually trade-in your phone and forget to backup your authenticator app. Trust me on this!
• Be Cautious of Unusual Requests: If a friend or family member asks for money or personal information through a message, verify the request through another channel, like a phone call.
• Report Suspicious Accounts: If you encounter a fake account, report it to Facebook.
• Educate Your Friends and Family: Share information about this scam with your loved ones to help them stay safe.
• Limit the Visibility of your Friends List: Deep inside Facebook's privacy settings lies a setting that sets who can see your friends list. Configure this setting to only allow friends to see your friends list, then they have no list of friends to target with your cloned account. While mechanic the menus of Facebook is a daunting task, you can find this setting by using the settings search feature.  In your Facebook Mobile App, tap your profile picture in the upper right. Then scroll down and select "Settings and Privacy", next select "Settings". At the top of the page is a search bar, enter the phrase "Who Can See Your Friends List".  See the picture below for my recommended settings.
• Limit the Visibility of your Posts: Set your default post visibility to friends instead of public. The less information a cybercriminal can see the less ability they have to target you and your friends.

What to Do If You've Been Targeted:

• Notify Your Friends and Family: Let them know about the fake account and warn them to be cautious.
• Report the Fake Account: Report the account to Facebook and any other relevant authorities.
• Review Your Privacy Settings: Ensure your privacy settings are configured to limit who can see your information.

By staying informed and taking proactive steps, you can protect yourself and your loved ones from the dangers of Facebook account cloning.