Digital Impersonation Scams: How Hackers Clone Social Media Accounts to Steal Your Data

A troubling trend has emerged in which cybercriminals are creating fraudulent social media accounts that mirror those of your friends and contacts, posing serious risks to your personal information and device security.

The scheme typically unfolds innocuously. You receive a follow notification from someone whose name and profile picture match a genuine contact. Believing it to be a legitimate new account, most users accept without hesitation. However, what follows can be far more sinister. The fraudulent account sends you a private message containing a link, often accompanied by casual language designed to prompt curiosity—phrases like "Check this out" or "Is this you?"—urging you to click.

These links are not benign. They represent carefully engineered digital threats capable of causing substantial harm through multiple attack vectors.

Phishing attacks represent one primary danger. The link may direct you to a counterfeit login page virtually indistinguishable from legitimate Instagram or Facebook interfaces. When you enter your credentials, they are immediately transmitted to the attacker, who then gains full control of your account.

Cookie theft presents another critical vulnerability. Sophisticated malicious links can extract your device's cookies—the digital markers that keep you logged into accounts—granting hackers unauthorized access to your active sessions without requiring passwords or bypassing two-factor authentication systems.

Malware installation constitutes a third threat vector. Clicking these links can trigger covert downloads of spyware files that operate silently within your phone's system, capturing your keystrokes and harvesting sensitive personal information.

An information security expert outlined essential protective measures. If you receive a suspicious follow-up and message from an account bearing your friend's name and image, take these steps immediately:

First, do not engage with the link under any circumstances, regardless of the accompanying message or its apparent urgency or appeal.

Second, report the account directly. Navigate to the fraudulent account's profile, select the three-dot menu, choose Report, then Report Account, and identify it as impersonating someone else.

Third, block the account entirely to prevent any further contact attempts.

Fourth, contact your actual friend through a verified channel—a phone call or message through their established account on WhatsApp or another platform—to inform them that their identity is being misused and that their contact list may be targeted.

The expert emphasized a fundamental principle: authentic friends will not suddenly send links from newly created accounts requesting immediate action. Maintaining vigilance, exercising patience, and approaching unexpected requests with healthy skepticism remain your strongest defenses against these evolving threats.