Earlier tonight I got a Facebook friend request from a profile that appeared to be a duplicate of my grandmother's Facebook profile, with her name and profile picture, but it was noticeably devoid of any other information to suggest that it really was my grandmother recreating her Facebook account.

That'd be bad enough by itself, but this is at least the fourth time it's happened. She's reported the scam accounts every time, but it doesn't seem to deter the scammers from trying again.

What could be making her Facebook profile particularly impersonation-prone, and how can we stop it?


Attackers are not interested in her, but rather those associated with her. It could be YOU that is the target, and she is solely being used to get to you. This is how impersonation works on the social engineering level. When I perform social engineering during penetration testing, I impersonate someone with the most solid connections to my target. For example, if my goal is to call a help-desk for a password reset, I wouldn't want to call them pretending to be a technical person, I'd pretend to be someone non-tech savvy, so I would choose perhaps a sales person - older - and I would fill the conversation with so much fluff (deflection).

So you now ask: "Why my grandmother?" Why not? Who (outside of people in the security realm) would stop to think twice about grandma, or an older individual linking up, sending a message, etc. Most would just accept, accept, accept. It's what we (most of us) do as humans, sympathize/try to be friendly.

So how do you minimize this? You can continue filing complaints, but there is little you can do to get someone to stop it from happening. Complain on Facebook enough, might minimize that attack surface, until they sprout up on say LinkedIn, or Twitter, or some other form of social media. What you CAN do if you have "the gift of gab" psychologically, is play along with it, and see what the individual wants, and use that as a warning to other family members/friends: "So this scamster pretended to be grandma. I went along with it, and he/she asked for a wire transfer... Or information about my current mortgage." Your grandmother is not the target, someone else is.

  • 5
    If you do accept the friend request, be very very careful to not confuse the two, and ideally immediately put the fake one on the Restricted list so as to not inadvertantly share information. (That doesn't offer 100% protection, but at least it reduces the exposure window.) And note that doing so will increase the scam account's "friends count" which could trick a third person into accepting them as legitimate; "ah, user24601 says this is a legitimate account, and I trust user24601, so it's legitimate". Also please consider those who share with "friends of friends". – user Jun 15 '16 at 13:22
  • @MichaelKjörling Or the OP could make a fake account of their own, befriend their grandmother - and perhaps some others, who are told what's going on. If the scammer won't send a friend request to this new fake account, an request could even be sent to the scammer. – S.L. Barth Jun 15 '16 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.