Article published in MetaCompliance.com, written by James MacKay
Social media has become the new hunting ground for cyberattacks. Phishing and the platform that attracts the most attention of all is undoubtedly Facebook.
Facebook remains the most popular social media network in the world and with 2.23 billion monthly active users worldwide, Facebook phishing has grown rapidly as criminals take advantage of this massive market.
These criminals will use a variety of different methods to trick us into revealing sensitive information, but the most commonly used method of attack is phishing.
Phishing is one of the oldest tricks and continues to prove one of the most successful ways to deceive people due to its simplicity, effectiveness, and high return on investment.
There has been a 102% increase in social app phishing from 2017 to 2018, and the reason it is proving so successful is because users tend to be less suspicious of links on social media than on other platforms.
Cybercriminals have been quick to exploit this lack of security to launch targeted attacks on social networks like Facebook. They know exactly which buttons to push to get us to take action and which types of scams will elicit the highest response rates.
As these scams become more sophisticated, it is becoming increasingly difficult to distinguish between a credible post in our news feed and a fake phishing post designed to deceive us.
Top Facebook phishing scams
See who has viewed your profile – One of the most common phishing scams on Facebook is clicking on a link to see who has viewed your profile. The reality is that there is no way on Facebook to check who has visited your profile, so this should be avoided at all costs.
Your account has been canceled. – This message will appear to come directly from Facebook and will inform users that their account has been canceled. To reactivate their account, users will be asked to click on a link to verify their username and password. Links in these types of emails should never be trusted and will almost certainly be set up to steal sensitive data or provide malware.
Investment scams – Fraudsters often use the names of high-profile and reputable individuals to convince people to invest in get-rich-quick schemes. Of course, these are nothing more than scams used to scam victims out of their money. In a recent case in the UK, a large number of people lost money when they invested in a scheme they thought was endorsed by money-saving expert Martin Lewis.
Share this post and win the prize – Posts such as 'Like and share to win a weekend away' will appear quite often in our news feeds, but for every legitimate post, there will be a large portion that are fake and created for the sole purpose of collecting data or delivering malware.
Free gifts and gift cards – It can be hard to resist the temptation to apply for a gift card or freebie, but like everything in life, nothing is free. Typically, this scam will invite a user to click on a link and ask them to refer a certain number of friends before they qualify for the gift. This will result in malware being sent, or the victim’s friends being bombarded with spam.
Facebook's new features – This scam encourages users to click on a link to activate a new feature on their account, this could be adding a dislike button or a different colored background. Scammers often place malware or spyware in the plugins, which in turn are used to collect personal data.
Fake news about celebrities – Scammers often use the lure of juicy and juicy gossip to lure people into their online scams. There will always be a percentage of people who want to learn about current celebrity affairs and will click on a link to learn more. In order to view the content, they will often be asked to upgrade their video player, but this is nothing more than a trick to download malware.
Many of these scams will be sold by fake accounts and it is estimated that over 60 million accounts on the social media platform are fake. Despite claims from Facebook that they are investing in software to help identify these suspicious accounts, there is still a noticeable increase in the number of phishing scams taking place.
How to avoid phishing scams on Facebook
To protect yourself from falling victim to a Facebook phishing scam, you should take a number of steps:
- Never accept friend requests from someone you don't know – Social media platforms are all about connecting with people, but with so many fake accounts on the platform, users should always be cautious when accepting a friend request from someone they don't know.
- Never click on links that ask for personal information – Facebook will never ask users to click on a link to update their personal information. These links will almost always be created to steal sensitive information or deliver malware. If you are unsure whether the request is legitimate or not, go directly to Facebook Support via the official URL.
- Use unique Facebook login details – phishing on Facebook is prevalent, so it's always best to use a unique username and password so that in the unfortunate event of fraud, attackers don't have access to your other online accounts.
- Only enter personal information on a secure website – the URL on a secure website will always start with ‘https.’ The “S” stands for secure and ensures that all communication between your browser and the website you are visiting is encrypted.
- Install anti-virus software – Installing anti-virus software will help detect threats on your computer and block unauthorized users from gaining access. A good software program will also prevent you from accessing pages where Facebook is trying to redirect you.
- Keeping operating systems up to date – It is also important to ensure that your software is updated regularly to prevent criminals from gaining access to your computer through vulnerabilities in old and outdated systems.
- Use Facebook's improved privacy settings – Regularly check and adjust your Facebook privacy settings to limit what people can and can't see on your profile.
- Get Phishing Updates from Facebook's Safety Page – The Facebook Safety Page will keep you up to date with any news or updates about the latest phishing attacks. All you have to do is like the page and you will receive regular updates in your news feed.