Beware of Facebook Voting Invitation Scam: Account Hijacking to Financial Fraud

How This Scam Works

This phishing scam operates in three distinct stages:

Stage 1: Account Hijacking

• Fraudsters create fake voting invitation links and distribute them via Facebook
• When users click the link, they are directed to a convincing fake voting page that mimics the legitimate Facebook design
• Users unknowingly enter personal information: username, phone number, and password
• Once the account is compromised, fraudsters send voting invitations to hundreds of the victim's friends and contacts

Stage 2: Financial Fraud

• Using the hijacked account, scammers impersonate the account owner in Messenger conversations
• They study the victim's message history to mimic their writing style convincingly
• They request money with various pretexts: emergency expenses, urgent loans, or help until payday
• Victims send money to bank accounts provided by the scammers, only to find the promised repayment never occurs

Stage 3: Secondary Scams

• When victims try to recover their account, scammers contact them claiming to help restore access
• They request additional personal information: phone numbers, identification documents, or account recovery codes
• This information is then used for further fraud against the victim or their contacts

Warning Signs

• Unsolicited voting links: Requests from friends may be from compromised accounts, not the friends themselves
• Personal information requests: Legitimate voting platforms rarely ask you to re-enter login credentials
• Sudden money requests: Unexpected financial requests via messenger should be verified by calling the person directly using a known phone number
• Unusual message tone: If a friend's message style suddenly changes or contains grammatical errors atypical for them, it may indicate account compromise
• Account recovery messages from strangers: Be suspicious of unsolicited offers to help recover your account

Prevention Measures

Protect Your Account

• Review and update privacy and security settings on all social media accounts regularly
• Limit personal information visible on your public profile
• Use strong, complex passwords and change them periodically
• Enable two-factor authentication whenever available
• Avoid clicking links from unknown sources or unverified senders

Verify Requests Before Acting

• When receiving a request from someone via social media, verify it through direct phone contact using a number stored in your contacts—never rely on social media to confirm identity
• Do not enter personal information on unfamiliar websites
• If you accidentally enter credentials on a suspicious site, immediately change your password, lock your account, and contact your bank if needed

If Your Account Is Compromised

• Change your password immediately and lock any linked bank accounts
• Notify your contacts that your account may have been hijacked
• Use official Facebook account recovery tools—ignore messages from people offering to help
• Monitor your bank accounts for unauthorized transactions

Where to Report

• Facebook's built-in reporting feature for suspicious accounts and phishing links
• Local police cybercrime unit (Cảnh sát Phòng An ninh mạng)
• Your bank's fraud department if money was transferred
• National cybercrime reporting hotlines in your country