Facebook is the most popular social network in Vietnam, used by many people to communicate and connect with friends. Therefore, criminals often target this platform to carry out attacks to impersonate identities, thereby serving the purpose of stealing account information, defrauding money...

One of the scams is to send invitations to lure victims into voting for a (fake) award or contest on Facebook. To carry out the plan, the scammer can create a Facebook account using the same name, image and identity as the real account of a specific person, usually a prestigious person, leader or important person of an agency or organization.

Then, they use Messenger (a messaging application using a Facebook account) to send a fake link to a list of "prey" friends of the impersonated character and ask them to click on it to vote.

If an unsuspecting user clicks on the link in response to the solicitation, their account could be compromised by an automated tool or redirected to a fake page that asks for login information to view further content.

According to security experts, in some cases, the impersonated link can automatically activate hidden malware that can execute remote control commands. Once installed on the victim's computer, it will silently steal information without the user knowing.

For those who have accidentally entered information into the fake link, hackers will have important information to log in to the account, from there they will take control. After this step, they will "kick" the real owner out of the account by changing the login information so that they cannot return, then study the Messenger messages, posts to grasp and imitate the style as well as the habits and relationships of the victim.

Next, they impersonate the account owner to text their friends and relatives to ask for money or continue to spread fraudulent links asking for votes. This process continues to repeat, expanding the list of victims and increasing the chances of stealing money and bank accounts of many others.

According to security expert Vu Ngoc Son (NCS Cyber ​​Security Company), Facebook currently allows users to create accounts and post content quite easily, so to fake information about anyone, bad guys only need to create a new account, name it the same and copy the avatar and post content from the "official" Facebook to create credibility.

"Unlike other platforms, the copyright protection factor on Facebook is relatively weak. If on YouTube, you can 'hit' copyright when discovering someone using your content, then with Facebook, reporting impersonators or using your images and content is relatively difficult and almost never handled," Mr. Son commented.

For this reason, even if the user discovers an impersonator, it is not easy to prove that the account being used is the owner's without a... blue tick (Verified - authentication mark issued by Facebook).

In addition, out of habit, some users in Vietnam create additional backup Facebook accounts, and when posting content to the main account, they also push similar information to these nicks. "That directly creates a system of virtual accounts. Sometimes even their friends find it difficult to distinguish which is the main account, the secondary account or the backup. Taking advantage of this, hackers can easily make friends with victims and from there send messages to chat, send links containing malicious code to steal money," expert Vu Ngoc Son emphasized.

In January 2024, the Department of Cyber ​​Security and High-Tech Crime Prevention (Hanoi City Police) recommended that users, when receiving any request from relatives or friends sent via social network accounts, need to verify the information (meet, call with a number saved in the contact list), absolutely do not check via the application to avoid impersonation.

"In particular, do not enter personal information into strange links. If you accidentally enter it and feel something is wrong, users should immediately change their password, lock their account and bank card... Users need to regularly check and update the security and privacy features of their social network accounts when using this service. Personal information should not be shared online," the police agency recommends.