Phishing scam threatens to delete Facebook accounts in 24 hours

Facebook phishing emails are threatening to delete users’ Facebook accounts unless the victims pass along their account details within 24 hours.

The phishing messages are charging Facebook users with violating policy regulations by annoying or insulting other Facebook users. The messages are then requesting personal and financial information including Facebook login details and part of recipients’ credit card numbers.

The emails are entirely bogus. They are not coming from Facebook. Social media venues would not request financial information, nor would they request login details.

The scams are, in fact, designed to steal credit card numbers and social media accounts, likely in order to further spread scams and bilk victims.

As pointed out by Hoax-Slayer, scammers can use the ill-gotten information to hijack a user’s Facebook account. Then, posing as the account holder, the criminals can send out more scam messages and spam to a victim’s Facebook friends, bolstered by the trust users place in their friends.

Once a criminal has gained access to a victim’s account, they will likely lock out the original account holder by changing account passwords and email addresses. With the credit card information, fraudsters can conduct identity theft and other malicious financial activity.

A typical phishing scam reads like this, according to Hoax-Slayer:

LAST WARNING : Your account is reported to have violated the policies that are considered annoying or insulting Facebook users. Until we system will disable your account within 24 hours if you do not do the reconfirmation.

Please confirm your account below:

[Link Removed]

Thanks.

The Facebook Team

Copyright facebook © 2011 Inc. All rights reserved.

Recipients who click the link will be presented with a fake Facebook “Account Disabled” web form. The form asks for Facebook login details including email, password, Facebook security question, Facebook security answer, the first six digits on the user’s credit card number, and their country of residence.

After completing this first form, the victims are taken to a second form labelled “Confirm to your webmail” that requests webmail program and password.

If that’s not enough, handing over this information will lead victims to yet a third bogus form, labeled “Terms of Service.” This form again asks for user name and the first six digits of the user’s credit card and sternly warns victims that their accounts more or less will be lined up in front of a firing squad and shot at dawn unless they comply.

If you ignore this warning, then our security system will block your account automatically.

A similar recent Facebook scam purporting to be from Facebook Security claimed to be watching out for users’ accounts being accessed by unauthorized parties. Here’s the text, again from Hoax-Slayer:

Subject: Did you log into Facebook from somewhere new?

Dear [Username removed]

Your Facebook account was recently logged into from a computer, mobile device or other location you've never used before. We have reviewed your account activity, and we get information about possible unauthorized access to your Facebook. We have provided a warning to you via email, but you do not respond to our notification.

"Your account was accessed from a new location : Anonymous Proxy."

If you are not signing into your Facebook account from "Anonymous Proxy", your Facebook account may have been compromised. We recommend immediately verify your account by carefully on the link below to protect your Facebook account. It may take a few minutes of your time to complete your data.

Please be sure to visit the Facebook Service Account for further information regarding these security issues.

***********************************

[link to scam page removed]

***********************************

Note : If within 12 hours, you have not verified your account, then you have ignored our notifications. Therefore, your account is permanently suspended, and will not be reactivated for any reason.

Thanks,

Facebook Security Team

New day, new attempt. All these phishing scams boil down to a naked grab for your account details. Remember, neither Facebook nor other reputable social media sites would ask for this information. The mere request is a surefire way to suss out bogosity.

Another bogosity beacon: note the grammatical and spelling errors these messages tend to sport. “Until we system will disable your account,” the current one reads.

That’s just frosting on the bogosity cake.

Stay safe, and don’t click on links from the likes of these scammers. And while you’re at it, if you’re in the US, take some Thanksgiving holiday time to update your parents’ browsers, as The Atlantic suggests and Sophos’s Carole Theriault seconds.