This summer, our Consumer Protection Unit answered several calls from residents reporting problems with social media platforms. Two callers said someone had hijacked their accounts leaving them unable to log in or regain control of the account. In those cases, we advised the consumers to work with the social media platform to try to recover their account. If that did not work out, we suggested they file a complaint with the Massachusetts Attorney General’s Office for assistance online at www.mass.gov/how-to/file-a-consumer-complaint.

I spoke with other callers concerned about suspicious messages from someone they thought was a friend. One received a message that purported to be from a high school classmate who had recently friended her through social media. The writer told the consumer that he had applied for a government grant and received $12,000 and also provided the consumer a link to the application and encouraged her to apply. She became suspicious and called our office for advice. I explained that the message was likely from an imposter who was trying to get personal information or a payment from her. We discussed how government grants are given to municipalities and community organizations, not individuals.

By now most of us are familiar with phone scams and phishing scams, but perhaps less so with social media scams. The stark reality is that while Facebook, Instagram, X (formerly Twitter), and other social media platforms do help people connect with family and friends, they can also be used by imposters to reach out to potential targets.

So, how was the imposter able to assume her classmate’s identity? It is possible the imposter hacked into her classmate’s account. But the likely scenario is that the imposter cloned her classmate’s existing account.

Cloning means someone steals photos and personal information shared on an existing account, most likely with public setting, using that data to create a look-alike account. The imposter then reaches out to the victim’s friends or contacts through private messaging using the look-alike account. They may be trying to trick you with an investment scheme, get you to click on a link where you enter your personal or account information, or ask you to send them money.

In cases like this, I advise consumers to first report the cloned profile to the social media platform. The next step is to block the fake account. If you have another way to reach out to the person whose account was cloned such as a phone number or email address that you know is real, contact them and let them know what happened so that they can report it, too.

There are also ways to proactively reduce your risk of account cloning in the first place. Check your account’s security and privacy settings. Determine who can see the posts you make, who can see your friends list, who can send you friend requests, and who can access other personal information on your account. If your account settings are public, anyone can access the photos and information you share on your profile. You can change the security settings to restrict who has access to your posts and personal information as well as who can contact you.

Imposters also use social media or dating sites for longer-term romance scams that are plots to steal money. In these cases, fraudsters create a fake profile and start communicating with someone through these sites. Soon after they make the connection, they will move the conversation off the social media platform to email or a messaging app.

Next, they spend a lot of time communicating with the individual to build trust. They have excuses about why they can’t meet up, because they work far away or are in the military. Eventually, the imposter asks for money to help with a problem or promote an investment opportunity. Losses to romance scams cost American consumers $1.3 billion last year.

I have some tips on avoiding social media fraud and protecting your personal information when using these sites.

■Don’t accept an invitation from someone you don’t recognize or respond to messages from strangers.

■Don’t open links or attachments in direct messages. They could contain malware or viruses.

■Don’t provide personal or financial information through a message, email, or text.

■Be suspicious of messages offering investment opportunities or advice even if it looks like it’s coming from a friend or family member. Call their family member or friend to check if they sent it. If that’s not possible for some reason, do your own research.

■Think before you share personal information to receive a discount or coupon, enter a prize giveaway, and take an online quiz. Ask yourself whether a company really needs your date of birth to give you a discount or whether you should keep that information private.

■Protect your account by changing your password often and using a long strong password. Don’t use the same password on multiple sites.

■Don’t share password or log in information with anyone online, no matter who they say they are.

■If the site offers two-factor authentication for logging into your account, use it. Two-factor authentication simply means you set up another way to verify your identity when you log into your account. You could choose to receive a text message or email with a security code or you could choose to install an authentication app which would generate a security code. You would then type in that code to access your account. That makes it much more difficult for someone to hack into your account, and increases the security of your personal data.

If you feel you have encountered suspicious activity or fraud on any of your social media accounts, you should report it directly to the platform through the settings on your account. Online fraud can also be reported to the FBI’s Internet Consumer Complaint Center at ic3.gov.

Anita Wilson is director of the Northwestern District Attorney’s Office Consumer Protection Unit, which is a Local Consumer Program working in cooperation with the Office of the Massachusetts Attorney General.

]]>