Hacked Facebook account sold a fake truck to a woman's own friends

Scammers who hijack a Facebook account do not need to trick the account owner twice; they only need the owner's existing friends to trust a familiar name. WBRC reports that Melissa Stombaugh's Facebook account was taken over, and the hackers used it to sell her belongings to her own friends. If a friend's account suddenly posts items for sale, call that friend on a number you already have before sending any money.

The hackers changed the email address and devices linked to Stombaugh's account, locking her out completely. Posing as her, they posted that she had to put her father in assisted living and was selling his things: a truck, a Peloton, other big-ticket items, all listed cheap. Her father found out first, texting her a joke about selling his belongings before he had died. Stombaugh had posted nothing.

The step the scam depends on

The fraud does not rely on fooling Stombaugh. It relies on her friends recognizing her name and her face in the profile picture, and treating that as proof enough to send money. Her friends paid through Venmo, believing they were buying real items from someone they knew. The money went straight into the hacker's account. Some friends then drove to her house to collect what they had paid for. One told Stombaugh her husband was outside looking at the truck they had put a deposit on. There was no truck.

Stombaugh tried to intervene herself. She set up a second, fake account and messaged the hackers directly, posing as a buyer, to see if she could draw them out. She and her friends also reported the posts to Facebook as a scam. Facebook's response, she said, was that the posts did not violate any standards and would stay up. WBRC made multiple attempts to reach Facebook for comment and received no response.

What let it happen

Stombaugh did not have two-factor authentication turned on. Without it, a password alone was enough for the hackers to get in, and once inside, they changed the account's linked email and devices, which is what locked her out and let the impersonation run unchallenged. She has since set up two-factor authentication on her other accounts. The scam worked because a name and a photo were enough for her friends to trust a post, and because nothing on her account required a second check before someone else could take it over.

Check a message

Received something like this? Paste it into the Flggd message checker before you reply, click or pay.