We’ve all seen it – “Please ignore any friend requests from me – I’ve been hacked!!”, then several sad and angry emojis, then friends chiming in over time, commenting “yeah, I got one (a duplicate friend request from ‘you’), too.” It happens to too many people, most of them perceived as senior on social media, but it can be anybody who’s not on the service full-time.

Facebook is the common place to see sketchy people (or bots) spoofing your friends, but it’s on Instagram, Twitter, and just about anywhere else, and happening to anyone. A victim may not even have an original account on the platform where the spoofing takes place.

So, technically, you/they didn’t get hacked, but spoofed. The good news is, it usually can be taken down, with a little help from friends.

First, let’s understand what happened. The offending act follows a simple and nefarious formula:

1. The impostor copied the victim’s public profile picture, public bio information, and sometimes cover picture to a new Facebook profile that the impostor set up under the victim’s name, with a spare character to distinguish the fake account from the true account.

2. The very next step that happens is, commonly, for the impostor to block the victim’s original account from this new profile. This prevents the victim from going out to the original friends list and calling the impostor out (or posting to that effect) to stop the scam, since the victim can’t see it.

3. Once all that’s set up, the offender will look through the victim’s friends list, and start attempting to connect with the friends on that list anew – the victim’s friends will notice this first. If called on it, the offender (impersonating the victim) will protest that (s)he forgot the original password, or was just feeling creative and wanted to do another one. If the friend is showing as sufficiently gullible, the impostor account may then appear in your Messenger chatstream, saying they’re stranded/in trouble somewhere, and, could you be a dear and Paypal/Venmo/Zelle them some money? If they’re nasty, they’ll post a link to malware impersonating you, with a phishing message.

Maybe money, grief, or malware isn’t the end result. But if this is you, you’ll still have wasted time and energy on a random scammer, impersonating your friend.

So, you can grow annoyed at the constant cycles of this on your timeline, like I once did, or you can get to work to make them go away, like a friend would do.

1. When you see this post on your timeline, or you receive the ‘duplicate’ friend request, your first impulse (and your friend’s fervent wish) is to reject or ignore it. So instead of accepting, or leaving it there to scam the next person, enter the name into Facebook search.

2. If you searched, you’ll see two accounts with the same picture, one of which (the original) appears with Friend underneath it as you are already friends. The one with friend request pending, or nothing if you already rejected it, is the one to report.

3. From the ellipse (…) menu, click on Report, then “for Impersonating”, “Someone Else”, and finally type or select the name of your friend.

Getting the account removed sometimes only takes one well-documented report – Facebook admins spend a lot of time ferreting out these types of attacks, and you filling out the ‘paperwork’ is a real help in this regard. It takes at most, two or three reports for a Facebook moderator to pull the plug on a real impostor.

Still, your five minutes of effort, even magnified by millions of real friends doing the right thing for real victims, may not equal the output for even the smallest of bot farms, but it’s the first line of defense for the people who clean this up for a living, and it’s a true good deed in the here and now.

You’ve saved somebody else the aggravation of tracking this down, and you hopefully don’t have to hear (from that friend, anyway) about how they’ve been “hacked.” It’s worth consideration to not always be coming to the rescue, as habitual de-scammers get known, and maybe impersonated (and then auto-blocked) themselves. But your family members and close friends are usually worth looking out for when it happens, every so often.

___

I’ve sent this article out almost six times, revising it half as much. It started out as something I wrote for my mother after she was getting spoofed regularly along with her friends.