Skip to content

Your Real Friends May be Phony on Facebook

Facebook Messenger notes tied to coronavirus news — but slightly suspicious — likely come from compromised accounts

Facebook messenger  application on digital screen macro close up view

Dzmitry Kliapitski / Alamy Stock Photo

En español | As you see coronavirus-related messages that falsely promise free test kits, bottles of hand sanitizer, stimulus checks in areas not authorized or fraudulent 2020 federal election info, be on the lookout for a fresh crop of scams related to social media.

Facebook and its sister app, Facebook Messenger, are breeding grounds for cybercrime. Facebook Messenger offers private communication unlike more public Facebook posts, so your keen friends are less likely to be able to warn you of something suspicious.

AARP Membership -Join AARP for just $9 per year when you sign up for a 5-year term

Join today and save 43% off the standard annual rate. Get instant access to discounts, programs, services, and the information you need to benefit every area of your life. 

As of Aug. 30, Americans have lost more than $124 million to fraud related to the pandemic, according to the Federal Trade Commission. Perhaps that's no surprise. Cybercriminals want to exploit what we're all talking about, which adds relevancy and believability to their efforts.

Facebook Messenger malicious link notification

Redacted by AARP

The name on this hijacked Facebook Messenger account has been redacted to protect the victim’s privacy.

For example, you might receive a note from someone over Facebook Messenger, but really it's a scammer who has hacked into your friend's account. The note might contain a link to a legitimate-looking site that asks you to log in to view safety information from United Nations officials or doctors from the Centers for Disease Control and Prevention (CDC).

It's phony. If you type in the personal information requested, your identity could end up stolen. (Note: Links from Facebook's Coronavirus (COVID-19) Information Center, which AARP contributes to, are always free and don't require readers to sign in.)

A similar public health scam isn't a link. Instead, it's an attachment with a note from a friend that suggests you read the item immediately because it has useful information on how to protect yourself from COVID-19. However, clicking the file from this impersonator might install malicious software, also called malware, that lets cybercriminals have access to your data lifted from your keystrokes.

Or the file could unleash coronavirus-related ransomware that locks your computer's files until you pay the thieves to release them.

Never pay money to get money

Because the government has provided financial help to individuals and businesses, be aware that scammers may contact you to pretend they're looking to send you money if you confirm your personal details or make a small up-front payment first to confirm the money is going to the right party.

Ignore both of these come-ons. These scammers often will try to get you out of Facebook Messenger to avoid being tracked and request you take the conversation through email.

Hacking can happen to governments, too. The Canada Revenue Agency was forced to shut down some online services in August, following cyberattacks tied to its stimulus checks program for businesses. At least 5,500 accounts were compromised, and many Canadians received a note about a Canada Emergency Response Benefit deposit to their bank account, yet it wasn't on their bank statements.

As we get closer to Nov. 3, expect to see more social media scams tied to the election, whether a seemingly genuine friend is asking for donations to a political party or giving out details on mail-in ballots. If a message looks enticing, get out of Facebook, search for your county's absentee ballot information or your favorite candidate on the web to find the relevant websites. If the pitch were legitimate, you wouldn't be approached over Facebook.

Free stuff can have a steep price

Not only do the thieves know we're concerned about coronavirus and more likely to click on something tied to it, but they also know we're shopping online more than ever. Beginning in April but still circulating today, one such note over Facebook Messenger and in email messages looks like a pitch from Amazon.

The message gives you a link to what appears to be your Amazon account, asking you to sign in for a free bottle of hand sanitizer with your next purchase over $50. Crooks are pulling out all the stops to defraud you, in many cases adding COVID-19 to their already ample repertoires.

Distress messages, similar to the grandparent scam phone calls, also have made a return this summer. These phony Facebook Messenger notes purport to be from your friends, now traveling, who are asking for money because they're in a jam. It's another instance of someone's account being breached.

These scammers often will say they need to be paid in Google Play gift cards to get them out of the jam, ask that you buy some and tell them the code. Contact your friend or family members by phone, text or email to confirm it's really them, which is unlikely.

Marc Saltzman has been a freelance technology journalist for 25 years. His podcast, Tech It Out, aims to break down geek speak into street speak.

How to avoid a problem

You don't have to delete Facebook and unplug your computer to stay safe.

• Be aware. And know that email, phone calls, robocalls and text messages are other avenues scammers use. Spread the word to loved ones, especially if they're more susceptible to suggestion.

• Block the person contacting you if you receive a suspect message. Tell your friend via phone call or email that the account was compromised and report it to Facebook.

• Never use the same password for all of your online activity. If one provider is hacked, cybercriminals may try it on another account. Reputable password manager apps are a handy way to remember them all.

• Use two-factor authentication to sign in. When this is put in place, not only do you need your password to log in but you'll also need to type in a one-time code sent to your mobile phone or email.

• Install good cybersecurity software on your devices. This software can identify, quarantine, delete and report any suspicious activity.

• Download the latest version of software for your operating system and programs as well as “firmware” updates for your hardware such as internet routers and printers. You often can set this on automatic.

• Back up your files. Do it regularly and you'll minimize the damage if your computer is attacked.

AARP’s Fraud Watch Network can help you spot and avoid scams. Sign up for free Watchdog Alerts, review our scam-tracking map, or call our toll-free fraud helpline at 877-908-3360 if you or a loved one suspect you’ve been a victim.