Facebook Profile Viewer Scam

Outline

Message being spammed across Facebook claims that users can follow a link to install an app that allows them to check who has been viewing their profile.

Brief Analysis

The message is an attempt to trick Facebook users into relinquishing control of their Facebook accounts to Internet scammers by submitting their Facebook authentication token. The scammers will use the compromised accounts to launch further spam and scam campaigns in the names of their victims. Any message that claims that you can install an app to see who has viewed your profile is likely to be a scam. Do not click on any links in these messages.

Example

Detailed Analysis

This message, which is currently appearing on Facebook, claims that users can check out who has been viewing their Facebook profiles by clicking a link and installing a new app.

However, the message is a scam designed to trick users into temporarily handing control of their Facebook accounts to online scammers. Those who click the link will first be taken to a Facebook page with further “instructions” for procuring the app:

If victims follow the link on the page, they will next be taken to a second page that falsely claims that Facebook is now required to show users who has been viewing their profile:

Next, victims are taken to a “security check” and told that they must generate an “age verification code” before proceeding:

Users will then receive the following instructions:

Folllowed by this:

Alas, by pasting the “age verification” code as instructed, users are in fact giving the scammers access to their Facebook accounts, including their Friends list. The code is the victim’s Facebook authentication token, which can then be used by the criminals to temporarily hijack the Facebook account. The compromised accounts are then used to distribute more of the same scam messages on Facebook.

No matter how many times victims “verify” their age or how many surveys they participate in, they will never get to see who has viewed their profile.

Similar profile viewer scams have targeted Facebook users for several years. Some versions use the promise of a profile viewer to lead victims directly to a scam survey page. Other versions try to trick users into first installing a rogue Facebook application that will send spam and scam messages to all of their friends.

Do not trust any message that claims that you can click a link and install an app to see who has viewed your profile. If you receive such a message, delete it.