Someone has created a Facebook profile using your name and photo

One in a series of posts on Facebook Security and Privacy

First off, don’t panic! Unless you have a really poor password, it’s unlikely that you have been hacked. Instead an annoying person has just created a new Facebook account, copied your profile picture and name, and is presumably now going through your friend list asking to become friends, and confusing all your friends who thought you were already their friend.

What can you do?

Use the Facebook “Report” function to ask Facebook to delete the fake account.

1. Open the fake profile page (Just click on the name)
2. Click on the ‘…’ button (to the right of the Message button), then click Report.
3. Select Report this profile and click Continue
4. Select They’re pretending to be me or someone I know and click Continue
5. Select Me and click Continue
6. Select Submit to Facebook for Review
7. Usually within a matter of hours, someone at Facebook will review the details and shut down the offending account.

How can you reduce the risk of this happening?

Review your Facebook privacy and sharing settings to stop non-friends from seeing your friends list and your profile photo.

Enable Two Factor Authentication to reduce the risk of your actual Facebook account being really compromised.

Setting your Facebook privacy and sharing

One in a series of posts on Facebook Security and Privacy

If you use Facebook, you should take the time to review your privacy settings and be deliberate about what details you share with the public (as distinct from just your friends). Setting this appropriately can help prevent annoying people from creating fake Facebook accounts that have the same profile photo and name as you, and that then try to trick all your Facebook contacts into become friends with them.

There’s no one answer to setting privacy settings. Some people might be quite happy to share everything with everyone whereas others will prefer to keep things strictly between friends. The important thing is that you understand and are comfortable with what you’re sharing to whom.

To review your general privacy settings

1. Click on the drop-down menu on the top right in Facebook in your web browser
2. Click Settings
3. On the left, click Privacy
4. Review the settings and change to your preference if necessary.

To restrict who can see your profile picture

1. Go to your Facebook profile (click on your name in the top menu bar in Facebook in your web browser)
2. Click on your profile photo
3. To the right of the photo, click on the icon next to the date
4. Review the current setting and change to your preference if necessary. Choosing a non-public option will reduce the risk of someone copying your profile photo. On the other hand it will make it harder for potential friends to find you.

To restrict who can see your friends

1. Go to your Facebook profile
2. Click on Friends
3. Click on the ‘Pencil’ icon (Manage)
4. Click Edit Privacy
5. Review the current settings. Choosing a non-public option will reduce the risk of someone pretending to be you trying to contact all your friends.

Don’t just accept the defaults, be deliberate and intentional about exactly how much and to who you are sharing your Facebook information with.

Securing your Facebook account with Two Factor authentication

One in a series of posts on Facebook Security and Privacy

You should consider enabling Two Factor Authentication (often shortened to 2FA) for logging in to Facebook. This means in addition to having a unique password for Facebook (that you don’t use for any other online services), you also have to enter a (usually) 6 digit code (or receive a SMS text message) to confirm that it really is you signing in.

The two factors in “two factor” are 1) your password and 2) the 6 digit code.

The clever thing is that the 6 digit code changes every 30 seconds, so it’s no good writing it down as it will be out of date very quickly.

If you have a smart phone or tablet

1. Install an authenticator app on your device. I recommend (and use) the Microsoft Authenticator app (which is available for iOS, Android and Windows Phone), but there’s other options including Google Authenticator and Authy.
2. Open Facebook in your web browser (preferably on a different device to your smartphone)
3. Go to Settings, then Security and then Login Approvals
4. In the Code Generator section, click on third-party app.
5. A QR Code (like a barcode) appears.
6. On your smartphone, open the Microsoft Authenticator app
7. Click on ‘+’ to add a new account
8. Choose Other
9. Hold your smartphone in front of your computer’s web browser so that the phone’s camera can scan the QR Code.
10. It should automatically scan the code and add a new account entry for Facebook. eg.
11. Note the 6 digit number now being displayed on your phone.
12. Also notice there’s a countdown timer displayed next to this number. When this timer reaches zero, the number will expire and a new number will be displayed.
13. Switch back to your web browser and enter this number in the confirmation field and press Confirm
14. Click Enable to allow Login Approvals.
15. Click on Get Codes
16. Enter your password
17. Print out these codes and keep them in a safe place. You can use these codes as a last resort if you lose access to the Authenticator app (eg. your phone drops in the toilet)
18. It is also a good idea to provide your mobile phone number as a fall back in case you lose access to the Authenticator app (eg. you accidentally deleted it).

From now on, each time you log in to Facebook from a new device you will need to provide the current 6 digits from the Authenticator app as additional proof of identity. If you use some devices regularly, you can then choose not to require two factor authentication in the future.

If you use the Facebook App on your device, that can also function as an authenticator app. The downside to using this is that it only works for Facebook, whereas an app like Microsoft Authenticator can work with many online services.

These include Amazon, Dropbox, Facebook, GitHub, Google accounts, Microsoft Accounts, Mailchimp, Twitter and others. Always choose to enable 2FA for any online services you use. Many banks and financial institutions are also using similar systems.

If you have a mobile phone

1. Open Facebook in your web browser (preferably on a different device to your smartphone)
2. Go to Settings, then Security and then Login Approvals
3. In the Text message (SMS) section, if there is no number listed click on Add phone number
4. Follow through confirming the phone number

From now on, when you log in to Facebook you’ll receive a SMS text message with a code. You’ll then need to provide that code in addition to your password. If you use a device regularly, you can tell Facebook not to prompt for 2FA again.

Using 2FA with text messages is much better than not using 2FA at all, but it isn’t quite as secure as using an authenticator app. If you can’t use an app then do enable 2FA using SMS. Some services even support non-mobile numbers by reading out the code instead of as a text message.