How To Spot 'Look Who Died' Scam On Facebook and Be Safe

Facebook faces a fair share of chain messages and other kinds of spam, which circulate openly on the platform. These fraudulent messages and posts often spread phising links to websites that imitate Facebook itself or other platforms that ask for sensitive user information. One particular scam that is circulating in January 2024, is the “Look Who Died” scam. In the scam fraudster exploit the emotions of users by posting malicious links with titles like “I can't believe he’s gone,” or “Look who died” with crying emojis, pursuing them to click. Further, several people are tagged in the post, to make them wonder if someone really died.

Here's How The “Look Who Died” Facebook Scam Works

Facebook users may either be tagged in such posts or come across them while scrolling their feed. These posts mostly come from users who have been hacked thus making it more personal for the people who follow them.  

Further, the “I can’t believe he’s gone, I’ll miss him so much”, posts are followed by links to another Facebook post. However, when users click on the link, they are taken to the login page of Facebook asking them to enter their username and password again. However, this is a fake page of the platform which steals the user’s password and all the account information about their birthday, where they live, their friends, photos and in some cases financial/card information as well.

A researcher for MalwareBytes, a cybersecurity company that operates antivirus software, found a scam post with a link imitating a BBC news article about a car accident, as per a Verify This report.

The researcher reported that clicking on the URL takes the victim through several redirects, to gather information like, the location of their device, information about their browser and activity. Lastly, the researcher reached the final website which spammed pop-ups that lead to unintentional download of malware.

Here's How to Be Safe From Such Facebook Scam

The best way to stay protected from Facebook’s phising scams is to simply avoid clicking on any external links. However, there’s always a chance to spot a malicious link by looking at the URL. In the Verify This report, the researcher says that the BBC link ended with “.xyz” instead of “.com”, which is a clear red flag.

Further, the Facebook help center advises users to report strange messages or posts to phish@fb.com or through the report links that appear on the post.

For those who have already been a victim of the scam, there are a few steps that can be taken to prevent severe damage. If the users haven’t been locked out of their accounts, they should immediately change their password. They should then go to the password and security settings of their account and look for the button that says "where you're logged in” to see if any other person has logged into their account. They should then delete any devices unknown devices and email addresses which are not associated with them.

Users should also vet the other apps that are connected with Facebook, such as Instagram, and do the same thing. Lastly, they should change their email password as well and scan their device with anti-malware software. They should also turn on the two-factor authentication to make it difficult for hackers to log in.

In case they are locked out, they should immediately report the issue to Facebook. Users should also make sure to use a strong password, and avoid clicking links or fake login prompts, in the future.