Your Facebook account has been cloned, not hacked

A Facebook worry has gone viral, with a warning of this sort appearing all over the timeline: "If you receive a friend request from me, my account has been hacked." Some are dismissive of the threat. Here's what's actually going on:

Facebook accounts are being cloned, not hacked. Scammers can do this without needing access to your password.

It hasn't happened much lately, but for a while I would regularly get friend requests from people with whom I was already friends. What happens is a scammer will grab photos and public information from a profile, create a new profile with the same profile photo and name, and send friend requests to people on the original profile's friend list. No hacking required, and changing your password can't stop it.

I found out why this is happening when I thoughtlessly accepted one of these friend requests. The scammer messaged me, starting a casual conversation -- how's it going -- which eventually turned into the scammer talking about some trick for getting money out of the Canadian Social Security system, a path that no doubt would have led to an attempt to get my personal financial details. I asked the scammer some questions which the real friend would have been able to answer, but which were not discoverable on the friend's real profile, and the scammer went away.

My wife dealt with a similar attempt by suggesting that they get together and talk. The scammer scarpered.

If you get a suspicious friend request, search your friends list before accepting it. A cloned account will usually be obvious upon close examination -- the profile and background picture may be the same, but there will be a lower friends count and few if any timeline posts. If the request is from a cloned account, click the ... icon at the top of the page, then select "Report" from the menu, and let your friend know about it as well. But remember: Changing passwords won't fix the problem.