Facebook impostors: How to manage a real but manageable risk

Listen to this article

By Scott Baughman
Dolan Media Newswires

It’s the stuff of science-fiction films: You wake up to find that there’s an impostor on the loose. The impostor looks just like you and is pretending to be you, even managing to fool some of your closest friends.

For Blair Williams, an attorney running for Wake County Clerk of Court in Raleigh, N.C., it really happened — on Facebook at least.

An as-yet-unidentified impostor set up a Facebook account under Williams’ name, using the same profile picture Williams uses on his genuine Facebook account. The impostor then sent friend requests to some or all of Williams’ Facebook friends. At least 59 people were fooled and accepted the request. Those friends then began receiving bizarre messages from the impostor account that segued into requests for money.

Some of Williams’ friends quickly realized what was going on and reported the account, which Facebook has since deleted. But Williams, a relative Facebook novice, said that the impostor still managed to do a lot of reputational damage.

“It doesn’t take very long for someone to damage your reputation if they were to set up an impostor account,” Williams said. “I was amazed at how quickly someone can start spreading untruths or starting asking your friends for things you would have never thought about doing.”

We can work it out

Impostor accounts are not set up by stealing passwords, nor do they commandeer a user’s legitimate account. But as such, they’re very easy to set up — all you need is a person’s name and a decent picture of them downloaded from the internet and you’re good to go — and the target can’t delete the account immediately the way someone can just delete their own account. Facebook has mechanisms for reporting impostor accounts, but they can be nonintuitive, even intimidating, to casual users for whom Facebook is still a novelty.

“The frustrating thing was trying to take down an account that you don’t have any control over,” Williams said. “It’s not as if Facebook has a local office or a live assistant when something like this happens.

“Attorneys should have the procedure already laid out, so that if it does happen they’ll already know how to address an impostor account. Before yesterday, I wasn’t even aware such a thing existed.”

What should attorneys — or anyone else — do if they’ve been impersonated? Matt Steinfeld, a Facebook representative, explained the procedure in an emailed response to the question. The victim must start by going to the impostor’s account. Near the top of the page, there will be an icon that looks like a gear. (This is perhaps the least intuitive part of the process. It gets easier from there.) Clicking that reveals an option to “Report.” From there, users see an option to “Report this account,” and then Facebook will ask why, with one of the options being “This person is pretending to be me.”

Anyone can report fake profiles to Facebook, but the company can act only on reports from the person being impersonated, Steinfeld said. After a report of an impostor, Facebook then asks the account owner to confirm that they are who they say they are, usually by entering a mobile phone number and requesting a code. If Facebook can’t verify an account using a mobile number, it requests a copy of a photo ID. (It permanently deletes the document after resolving the issue.)

Actually catching the bad guys can be difficult, however. Williams said there hadn’t been any progress in figuring out who impersonated him, although he said he didn’t think it was related to his Clerk of Court campaign.

Steinfeld did not directly address the question of what, if anything, Facebook does to try to identify the perpetrators of such schemes and hold them accountable.

With a little help from your friends

Facebook users also can report when they think a friend is being impersonated by using the same procedure described above. That’s how Williams learned about his impostor. That’s one reason why Facebook impostors are easier to spot if you regularly check in your account than if you create an account and then never log in for months.

Kristy LaPlante, a digital strategist for Merkle Inc., also recommended protecting one’s online reputation by taking personal precautions, such as changing one’s password frequently and updating privacy settings to allow “Friends Only” to view your information. Although Facebook makes an effort to eradicate false accounts, with nearly 1.2 billion global users and an estimated 15 million fraudulent accounts, it’s logistically complicated for them to be more proactive about policing the site on users’ behalf, she said.

“The sad news,” LaPlante said, “is that privacy rules and regulations haven’t caught up to the pace of digital innovation, and until they do, we won’t have better answers.”