In the first [1/3 ] article of this series on the dangers and abuses of social media, we saw that the business of social networks is based on tracking and massive data collection, that leaks and scraping turn “private” into public, and that 2FA and common sense are basic.
In this article 2 of 3: we focus on scams, spear phishing, LinkedIn, doxing, metadata and fake profiles.
Social networks are a real paradise for cybercriminals because of the feeling of anonymity and the ease of creating accounts without real verification.
Common scams include romance scams, fake job offers, phishing, fake influencer sponsorships, non-existent loans and fraudulent investments.
They often rely on social engineering, taking advantage of trust or empathy to obtain money or sensitive data.
The first tip is elementary: don’t add strangers.
Avoid profiles with overly attractive photos, vague biographies and an overly “neat” history. If someone wants to spy on you or break into your circle, they will try to like you before asking for access.
Spear phishing: customizing to get it right
Spear phishing is a targeted attack that starts with information gathering. The easiest source? Your social media.
If the attacker discovers, for example, that you like golf, he can send an email with your full name inviting you to a tournament at a nearby club with “free” registration via a malicious link.
In the right context, the victim lets his or her guard down. That is why it is best not to disclose hobbies, routines or details that facilitate their work.
LinkedIn is especially attractive to attackers: it concentrates name, email, phone, work history and education; often, in addition, it reveals suppliers, technology stack, customers…
In 2021, information from hundreds of millions of profiles obtained by scraping was made available for sale, illustrating the value that third parties attach to such data.
Remember, verify invitations before accepting them: a cloned recruiter, a non-existent company or a suspicious domain should set off alarm bells.
Metadata, geolocation and doxing
Beyond the visible content, there is metadata (date, cell phone model, coordinates) that can give away where you live, where you move around or who you are with.
Posting from the same gym at the same time is giving away patterns.
Disable camera geolocation, clear metadata when sharing and wait until you leave the location before posting.
Combined with a large (and unfiltered) friend list, a stalker can triangulate information and engage in doxing.
If the attacker does not succeed in gaining access to you, he will try family and friends.
When you see that this unknown profile has already been accepted by several of your trusted contacts, your guard goes down. It’s a classic trick: that’s why it’s key to set the visibility so that non-friends see the minimum and educate your circle to be cautious.
Generative AI in the service of deception
We explained in the previous article that with websites like thispersondoesnotexist and fakenamegenerator anyone can create plausible identities with clear photos and consistent data.
Warning signs:
- A single perfect photo or many where the face is never well identified.
- Inhuman schedules of activity and sudden peaks of followers.
- Generic bios, inconsistent localizations or subtle language errors.
- They ask you a lot of questions and their answers are very vague.
** Do not upload documents**. No driver’s license as proof that you finally have it, no bank card, no flight tickets for that trip you already have ready, no transcript with your name on it, nothing.
Any image with a full name, number or QR code is gold for scammers. Don’t post home address or daily routines either. ย
What you can do
- Personal whitelist: follow and be followed less, but better. Prioritize clearly trustworthy identities with transparency in their publications.
- RRSS and mail: go back to buying or getting information from open platforms and newsletters; less addiction, more control.
- Tools: use extensions for link tracing and tracker blocking lists.
- Verify before going viral: invest 60-90 seconds in searching for the first mention and the primary source.
- Report suspicious patterns, not opinions: when reporting a profile, describe suspicious behaviors rather than ideologies.
** In the next article** (3/3) we will address algorithmic manipulation (bots, sock puppets and “synthetic users”), social/psychological impacts, regulation (TikTok, platform responsibility) and we will leave you clues to detect manipulation and lists of actions. This has been article 2 of 3 on RRSS.