Malicious Tagging, a Growing Facebook Scam. What It Is and How to Stay Safe

Hackers often create fake social media accounts or hijack existing ones, targeting other users in an attempt to take over their profiles. They do this by tagging people in posts containing links and tempting phrases to trick the victim into clicking.

When the victim clicks on the link, they may unknowingly download malware or end up on a malicious website. This can result in further infection or the theft of personal information through phishing. If the cybercriminal gathers enough information, they can even take over the victim's social media account and use it to spread the scam further.

How to Spot Malicious Tagging

You may have already come across examples, anything from a promise of a giveaway, a mention of a breaking news story, or something casual like "You might like this." The URLs are usually long, nonsensical, and don't direct you to a well-known site. These posts might also include fake images, often generated by AI, to make them look more convincing.

It's easier to identify a malicious tag if it comes from an unknown account, but that's not always the case. If you receive such a tag from a friend, it's likely their account has been compromised. This is how the scam spreads—from friend to friend.

Examples:

"I can't believe he's gone. I'll miss him so much."

"I can't believe this happened! Check it out!"

"Is this really you in this video?"

Facebook has made this scam even more common by allowing users to tag entire groups, making it easier for these harmful messages to spread. Sometimes, these messages are added as comments on Facebook under another post, making them even harder to spot.

What to Do If You Get Tagged in a Suspicious Link

Don't click on the link. These links are designed to either download malware onto your device or steal your personal information.
Ignore it. This is the simplest option, but doing so doesn't stop others from falling for it.
Warn others. If you're tagged in a group post, warn others about the dangers. Letting the community know helps prevent others from getting scammed, and it's a helpful, community-minded action.
Report the account. You can also fight back by reporting the fake or hijacked account to the social media platform.

Our tip:

Limit who can contact or tag you on social media platforms. By adjusting your privacy settings, you reduce the risk of being targeted by scams or having your personal information fall into the wrong hands.

If you want to learn more about all privacy settings that can help protect your personal information, check out Bitdefender Digital Identity Protection. This tool shows you your digital footprint and how to reduce it, and informs you about any breaches that have exposed your identity and what actions to take. It also alerts you in case of new exposures of your personal information and suggests immediate actions to protect yourself.

How to Protect Yourself Against Malicious Tagging

While anyone can be tagged, there are steps you can take to protect yourself:

Be cautious of unexpected tags.

Even if the tag comes from someone you know, check the post carefully before interacting with it. Consider sending a screenshot to Scamio, AI-powered scam detector, to uncover any attempts to trick you.

You can send Scamio any texts, messages, links, Q.R. codes, or images, and it will analyze them to determine if they are part of a scam. Scamio is free and available on Facebook Messenger, WhatsApp, and your web browser.

Alert your friends.

If you see a suspicious post from a friend, let them know. This can help stop the spread of the malicious tag before it affects more people.

You can also help others stay safe by sharing Scamio with them in France, Germany, Spain, Italy, Romania, Australia, and the U.K.

Adjust your privacy settings.

Most social media platforms allow you to control who can tag you and who can see posts you're tagged in. Enable settings that require you to review tags before they appear on your profile.

Stay informed about scam trends. The more you know about current scams, the easier it is to spot something suspicious.
Use strong passwords and enable two-factor authentication.

Strengthening your account security makes it harder for scammers to gain access. Consider using a password manager to keep track of your unique passwords.

Protect your devices and information.

Invest in a robust cybersecurity solution to safeguard your personal data.

What to Do If You've Already Clicked on a Malicious Link

If you've accidentally clicked on a malicious link, here's what you should do:

1. Don't provide any personal information.

Never share private data with unfamiliar websites or strangers. Even seemingly harmless information, like your name or date of birth, can be valuable to cybercriminals.

2. Assess what information you've given away.

If you've already shared account details, quickly change your passwords on another device. If financial information is involved, contact your bank immediately.

3. Scan your device.

Use antivirus software to scan your system for any malware. Also, check for any recent downloads, as scammers might have installed malware through the malicious tag.

Q&A

How can I tell if a tag from a friend is malicious?

If a tag from a friend includes a suspicious link or an out-of-character message, it could be a sign their account has been compromised. Verify with your friend directly before clicking on any links.

What should I do if I notice a fake account tagging multiple people in my group?

If you spot a fake account tagging people in a group, report the account to the social media platform immediately. You can also alert other group members about the potential scam to prevent them from clicking on the link.

Can adjusting my privacy settings really prevent malicious tagging?

Yes, adjusting your privacy settings can significantly reduce the risk. Limiting who can tag you or who can see posts you're tagged in minimizes exposure to potential scams.