Hacked Friend Impersonation Scams on Facebook
Fraudsters who take over or clone Facebook accounts use the victim's identity to message their contacts with fake emergency requests for money, gift card codes, or personal information.
Part of: Hacked Friend Impersonation Scams
Last reviewed: 1 June 2026
The hacked friend impersonation scam is one of the most emotionally manipulative fraud types on Facebook. Receiving a distress message from what appears to be a close friend or family member short-circuits the critical thinking that would normally prevent a person from sending money to a stranger.
Attackers either take over the genuine account or create a cloned copy using the victim's profile photo and name, then work through the contact list sending urgent messages crafted to prompt immediate action before the recipient stops to verify.
How this scam works on Facebook
A message arrives from a Facebook friend claiming to be stuck in an unexpected situation — stranded abroad without money, hospitalised, or unable to access their bank account. The message explains why they cannot use normal channels and asks the recipient to send money urgently via a gift card, wire transfer, or peer-to-peer payment app.
Alternatively, the account asks the recipient to help verify a phone number by forwarding an SMS code — this is a classic technique to steal the recipient's WhatsApp or other account access. The code is actually a one-time password for the recipient's own account, not a verification step for the supposed friend.
In some cases the message asks the recipient to click a link to view a 'shared video' or 'news article' — delivering malware or a phishing page that harvests the recipient's own credentials to continue the chain.
Common red flags
- Unexpected message from a Facebook friend describing an emergency requiring immediate financial help
- Friend's writing style, word choices, or spelling noticeably different from normal
- Request for payment via gift card, wire transfer, or peer-to-peer app rather than a traceable bank transfer
- Message asking you to forward an SMS code 'to help them log in'
- Friend account with reduced post history or recently created friend list suggesting a clone account
- Story that changes or becomes vague when you ask specific questions to verify their identity
How to protect yourself
- Call the friend directly on their known phone number before taking any action in response to an emergency message
- Agree on a verbal verification phrase with close contacts so you can confirm identity quickly in suspicious situations
- Never forward SMS verification codes to anyone — these codes grant access to your own accounts
- Set your Facebook friend list to 'Friends only' to make it harder to clone your network
- Report suspected clone accounts to Facebook immediately using 'Report profile > It's pretending to be me or someone I know'
- Enable login alerts on your own account to detect if it is taken over and used to impersonate you
How to report it
- Report the impersonating account to Facebook using the 'Report profile' option
- Alert the genuine friend through an independent contact method so they are aware their account or identity is being misused
- Report to your national fraud authority if you sent money in response to the request
Frequently asked questions
I already sent gift card codes to what I thought was my friend — can this be reversed?
Gift card payments are very difficult to reverse once codes are redeemed, but contact the gift card issuer immediately to report the fraud, as they may be able to freeze the balance if it hasn't been used yet. Also report the incident to your national fraud authority and to the real friend, since their account may still be compromised.
What is a good verification phrase to set up with close family and friends?
Choose a short word or phrase unrelated to any publicly available information about you, avoiding pet names, birthdays, or hometowns, and agree to share it only in person or by phone. This lets you confirm identity in a moment of pressure without relying on a text message that could itself come from the attacker.
Should I still worry about a suspicious Facebook message if it doesn't ask for money directly?
Yes — messages asking you to click a link, forward a code, or view a 'video' are often the first step of an attack, sometimes designed to compromise your own account rather than ask for money outright. Treat any unusual request from a friend's account with the same caution as a direct money ask.
How do I know if a Facebook message from a friend is really from them?
Call or text them on a number you saved before receiving the Facebook message. A genuine friend will be able to answer specific questions about shared experiences that a fraudster impersonating them cannot. Never rely solely on the Facebook message itself to confirm identity.