I got an email related to someone impersonating me on Facebook.
What should I do?
Hi everyone. Leo Notenboom, here for askleo.com.
Here's the question I got the other day.
"I've been having issues with someone impersonating me on Facebook.
Then I got this email asking me to verify my Facebook account.
I clicked the link in the email.
Was that a mistake?"
Was it a mistake?
Probably, yes.
Did it do any harm? Well, probably not.
It really depends on what you did next.
Here's the thing, though.
Those two events, the fact that someone is impersonating you and the fact that you've
got a phishing email, what boils down to a phishing email for your Facebook account?
They're probably unrelated to one another.
So impersonation, to be honest, it's kind of rampant on Facebook.
It depends on who you are and who your friends are and who your enemies are
I guess. What kind of a public profile you have.
But the bottom line is that it's trivial,
actually, to impersonate someone on Facebook.
You don't need any information other than their name, I suppose.
And maybe their existing Facebook account,
the ability to view your existing Facebook account.
Because what they do then is they just go
and create a different Facebook account, a new Facebook account,
and they just use your name and maybe steal your profile picture.
But notice they didn't have to use any
information that you might consider to be sensitive or secure.
They didn't have to provide an email address that had anything to do with you.
The fact is, they probably use their own, probably a throwaway, email address.
The most important thing to realize about
impersonation on Facebook is that it in no way means that you've been hacked.
Hacking has nothing to do with impersonation.
If you've been hacked on Facebook, chances are you won't be able to log in.
That's where we start worrying about that kind of thing.
But if you're just using your Facebook
normally and you get a friend request from yourself, or if people who are your
friends get friend requests from you, they're already your friends, right?
So there's no way to send them another
friend request unless you're an account trying to impersonate you.
Again, that's completely separate.
It does not mean you've been hacked.
It doesn't mean anything is going on other
than somebody set up a fake Facebook account.
What do you do about it?
Well, all you can really do is report it to Facebook.
Now let's talk about that email.
Phishing is also rampant.
It's probably more rampant than a fake account.
But the bottom line for phishing is all it really is, is somebody sending you
an email that is attempting to fool you into thinking it's legitimate.
So it looks like it came from Facebook.
And if you click on the link to verify
your account or whatever it's asked you to do, then it takes you to a page
that looks a lot like Facebook if you check out the actual URL that it takes you
to in your browser, chances are you'll find that it's not Facebook at all.
But the bottom line is it's not Facebook.
Now, I will point you at an article Phishing How to Know It When You See It,
that discusses some more of the things to look at when you encounter an email
that you think might be, quote, unquote, fishy.
In other words, what to do to make sure
that the thing you're about to click on is legitimate.
So what happens if you click on it?
Well, like I said, in most cases,
the only thing that happens, if all you did was click, is you get taken to a web page.
The web page may look legitimate, or you may realize that it's fake.
It doesn't matter.
That's usually okay.
That's usually benign.
What matters most is what you do next.
Most of those pages will say, hey, to verify you, we need you to log in again.
Please enter your username and password.
If you entered your username and password, you just handed that information
to a hacker who now can probably go hack into your account.
They can log in as you, so don't do that.
That's really the bottom line on most phishing links.
If you click on it and the only thing you
did was click on it, you're probably fine if you did more than
how bad it is is dependent on how much more you did.
If you handed over your login credentials,
then yes, you've got a problem, go change your password immediately.
Now, I said usually about clicking
on a link and just clicking on a link is usually okay.
There is the possibility,
a very small possibility, that that link could be used to download malware.
So one of the things I strongly recommend you do, even if you just click a link,
is to go ahead and run an up to date antimalware scan on your machine.
That way, you'll be sure most phishing attempts these days are not interested
in necessarily downloading malware to your machine.
They're more interested into fooling you into handing over your login credentials.
But either way, it's no harm to run an anti malware scan, just in case.
Speaking of which, you know what?
If you're the least bit concerned, change your password anyway?
There's really no harm in changing your password at just about any time.
It's totally benign.
And if something happened to slip through,
then sure, you've got a different password.
Whatever you just gave them,
or whatever they were able to figure out no longer valid.
Finally, one thing you can do to further secure your account.
And I know I've been saying this a lot lately, and it's because it's true.
Add two Factor Authentication. Even if
somebody knows your password, two factor authentication still protects you.
And in fact, we'll give you a little bit
more information if you suddenly get a notice from Facebook that hey somebody
tried to log in as you and they knew your password but we didn't let them in because
they weren't able to complete two factor authentication.
That tells you that somebody knows your password again.
It's always safe to quickly get
into Facebook yourself, securely change your password and get on.
But that's the bottom line here.
Chances are the two things were unrelated.
Chances are the clicking on the link
in that phishing email is totally benign but run a scan anyway and chances are
that fake account it's a fake account and there's really nothing you can do
about it other than report it and ask your friends to report it to Facebook as well.
I hope that's helpful. For updates,
for comments, for links related to this topic and more, visit ask Leo.com 145364
I'm Leo Notenboom and this is askleo.com. Thanks for watching.