How Criminals Exploit Social Networks to Steal Identities, Spread Malware, and Defraud Users

UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 13.4 Free with a free account

How Criminals Exploit Social Networks to Steal Identities, Spread Malware, and Defraud Users

Ethics in Technology · Chapter 13: Digital Espionage, Online Threats, and the Science of EncryptionSection 13.4 · lesson 81 of 11612 min · free with a free account

← The Security Risks Hidden Inside Instant Messaging Platforms and Chat ApplicationsNext lesson: Spying in the Digital World: How Organizations and Nations Steal Secrets Electronically →

Earn 3 college credits for Ethics in TechnologyRecommended for credit by NCCRS · Computer Science 195 · self-paced · one payment, lifetime access
Enroll in Ethics in Technology · $250 →Download the syllabus (PDF)

In this lesson

Profiles, relationships, links, and permissions can turn apparent trust into exposure.

  • Distinguish invented profiles from cloning and impersonation.
  • Explain catfishing and a romance scam’s trust-building pattern.
  • Recognize malicious social links and excessive app permissions.
  • Assess quiz-data collection, warning signs, and recovery-question risks.

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,466 words). Read along, or search it.

Chapter 13

Criminal Exploitation of Social Networks

Social networks connect people through profiles, relationships, and shared content. Criminal deception can exploit those same connections. We will distinguish an invented profile from impersonation of a real person. Account takeover is another way to misuse an established identity. Next, we will examine catfishing and romance fraud. The source describes how repeated contact can make a financial request persuasive. We will also consider malicious links and outside apps. A familiar share does not prove a destination or developer is trustworthy. Finally, we will examine quizzes and surveys that seek excessive personal information. Warning signs help us identify what needs independent checking. Identity verification, careful financial judgment, and limited app permissions work together when a social request asks for money, information, or access.

Why Social Platforms

Reach, Connection, and Personal Detail Can Support Deception

Social platforms offer a large audience in one environment. They also create apparent trust between connected accounts. A friend, match, or mutual contact can make a message seem normal. Voluntarily posted interests and life events add personal context. A deceiver can use that context to make a request appear tailored. A cold message may feel less credible than an apparently familiar connection. That difference does not establish the new request is truthful. A profile can be invented, cloned, or compromised. A familiar name therefore still needs verification for a sensitive action. The source groups these risks into profiles, romance scams, links or apps, and quiz harvesting. Those categories can overlap, so assess the identity claim, requested action, and data access together rather than assume one label settles the risk.

Profiles and Impersonation

An Invented Identity and a Copied Identity Differ

An invented fake profile represents a false person or persona. Stolen photos can help create its apparent identity. A cloned profile instead copies an existing real person. The name and image can resemble the account contacts already know. New connection requests may then reach the real person’s contacts. Apparent mutual connections can add credibility without proving the account belongs to that person. After connection, the profile may request money or circulate harmful links. It may also collect details about the target’s social circle. Businesses and public figures can be impersonated in a similar way. Fake giveaways and fraudulent customer support are examples from the source. Cloning a separate profile differs from hijacking the real account, although both mechanisms can exploit trust associated with an established identity.

Catfishing and Romance Fraud

A False Relationship Can Become a Financial Request

Catfishing uses a false online persona to build a relationship. The persona may rely on stolen photographs and an invented backstory. Its goals are not always financial. Romance fraud uses deceptive relationship trust to obtain money or financial benefit. Repeated daily contact can continue for weeks or months. That attention can create an apparently genuine emotional connection. A later crisis may involve a medical emergency, stuck shipment, or travel expense. The story conveniently makes payment seem like the solution. A recent divorce, bereavement, or difficult period may be exploited. The responsibility belongs to the deceiver, rather than the person seeking companionship. Do not assume every romance scam follows an identical sequence; understand the emotional pressure and financial request without treating vulnerability as blame.

Recognizing the Pattern

A Typical Romance Scam Builds Trust Before Demanding Money

The source illustrates a typical romance scam through several stages. A false persona or stolen photograph supplies the starting identity. Personal conversation then echoes the other person’s interests. Repeated contact can deepen apparent attachment over weeks or months. A claimed emergency introduces the financial demand. The crisis is framed as something a payment can resolve. After receiving money, the deceiver may disappear. The deceiver may instead remain and request additional payments. Patience can make the later story emotionally harder to question. This pattern is not a required timetable for every case. Time invested in a relationship does not independently prove identity or truthfulness, so both rushed and long-established online financial requests deserve careful judgment.

Malicious Links

A Familiar Account Can Carry Credential Theft or Harmful Content

A familiar social account can carry a deceptive link. A message may promise to reveal who viewed a profile. Another may advertise a shocking video or sensational story. Curiosity and apparent friendship can lower hesitation. The account may be cloned or genuinely compromised. A destination can imitate a real login page. Submitting credentials there may enable unauthorized access under the available account controls. That new account can then be used to contact additional people. The deception can therefore travel through established relationships. Clicking alone does not always cause account theft or infection. The actual destination, user interaction, software protections, and access conditions affect the outcome; evaluate the request rather than equate a familiar sender with a safe link.

Third-Party Apps

A Platform Login Does Not Endorse an Outside Developer

Outside apps can connect through a platform’s login or account system. Quizzes, games, and add-ons may offer legitimate useful functions. Using the platform’s login does not independently endorse the developer. A malicious or overly intrusive app may request unrelated permissions. Review the actual information and actions being authorized. Available capabilities vary with the platform and permission design. Information entered directly into an app can also be collected. Review connected apps and restrict or revoke unwanted access using the available controls. The controls may be confusing, but revocation is not universally impossible. Stopping future access does not automatically erase information already copied elsewhere. Assess permission and data-deletion questions separately, rather than assume that an entertaining function justifies broad access or that disconnection retrieves every previous disclosure.

Quiz and Survey Harvesting

A Harmless-Looking Activity Can Collect Excess Personal Data

Quizzes and surveys often appear harmless and entertaining. They may also arrive through friends, rather than unknown senders. That presentation can reduce attention to requested access. The source describes friend lists, photos, location history, and birthdates as possible data categories. Personal answers can supply additional identifying details. Actual collection depends on available permissions and information users provide. The diagram illustrates one possible flow from a friendly quiz to excessive collection. Combined data may create a detailed profile. That profile may support targeted misuse or resale. Not every quiz is malicious, and no app automatically gets every category on every platform. Data harvesting in this lesson means collection beyond the stated purpose; ask why each requested detail is needed before granting access or submitting answers.

From Data to Misuse

Separate Details Can Be Combined into a More Detailed Profile

Separate details may become more revealing when combined. Collected information can be paired with other exposed data. A resulting profile may support targeted deception or resale. Birthdate and personal answers can also matter to account access. Some systems rely on weak checks using personal knowledge. Information that is public, shared, or guessable is poor proof of rightful ownership. That is the weakness behind the source’s recovery-question example. Birthdate alone does not bypass every identity check. Stronger controls can require additional evidence. Current NIST guidance rejects security questions as an acceptable authentication approach under its requirements. Evaluate the purpose, permissions, developer, and privacy information, rather than disclose identity-related details merely because the app describes its activity as entertainment.

Warning Signs

Profile and Relationship Signals Prompt Further Verification

Profile warnings include a recently created account and inconsistent history. Few mutual contacts may conflict with a claimed long-standing connection. A reused image or urgent request after connecting can also deserve attention. None of those traits independently proves fraud. Verify the claimed identity through a known independent route. Romance warnings include repeated avoidance of video calls and unusually fast emotional claims. An overseas or unreachable story can help explain why meeting never occurs. A request for money or gift cards adds financial pressure. Distance alone does not establish deception. Consider the combined claims, financial demand, and available evidence. An image search may reveal inconsistent identity use; a convincing photograph or call still does not independently establish truthfulness or authorize payment.

Warning Signs

Link and App Requests Need Purpose-Based Judgment

Sensational language can draw attention toward a malicious link. A mismatched destination deserves further checking. An app requesting unrelated permissions raises a different access concern. Review the actual destination, developer, and requested capabilities. Quiz warnings include broad profile access before showing any content. Personal questions may closely resemble weak recovery-question answers. Missing developer or privacy information makes the recipient and purpose less clear. Impersonation uses another established identity to deceive. Catfishing builds a relationship through a false persona. Romance fraud uses deceptive trust for a financial goal, while harvesting concerns excessive collection. Slow down before a sensitive action, and check identity, financial claims, destinations, and permissions separately instead of letting friendly sharing substitute for judgment.

Review and Apply

Explain How Trust and Personal Data Can Be Misused

A cloned profile resembles an identity the recipient already knows. Its name, image, and apparent social context can create credibility. Romance scammers may spend time building trust before a financial demand. Repeated contact can make a claimed crisis emotionally persuasive. A friend’s link can appear credible even when the account is cloned or compromised. Entertainment can similarly conceal excessive quiz-data collection. Birthdate or personal answers may support identity deception. They can also undermine weak knowledge-based recovery checks, rather than bypass every account’s controls. Independent verification and limited access address different parts of these risks. FTC guidance advises against sending money or gifts to an online romantic interest not met in person. Assess the actual identity, request, destination, and permissions, so apparent connection does not become an unchecked transfer of money, information, or access.

About Ethics in Technology at UPI Study

Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses

Compare: Cybersecurity vs Ethics in Technology · Which ethics course?

Why take it here

Why students take Ethics in Technology with UPI Study

The right and wrong of the digital worldEthics in Technology looks at the choices technology forces on people and organizations: security and privacy, surveillance and the law, big data, hacking and cyber warfare, malware and breaches, intellectual property, cybercrime, encryption, artificial intelligence and responsible digital citizenship. It suits computer science, information technology and business degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About How Criminals Exploit Social Networks to Steal Identities, Spread Malware, and Defraud Users

What is the difference between a fake profile, a cloned profile, and a hacked account?
A fake profile invents a person, often using stolen photos, while a cloned profile copies a real person's name and images to fool their contacts. A hacked account is the real person's account under an intruder's control. All three exploit trust in a familiar identity to ask for money, spread harmful links, or gather information. Mutual connections do not prove ownership, so confirm unexpected requests through a channel you already know.
What are the warning signs of a romance scam?
Common romance scam warning signs include fast declarations of love, repeated excuses to avoid video calls, a story about working overseas or being unreachable, and a sudden crisis that money or gift cards would solve. Scammers may build trust for weeks or months first, so a long relationship does not prove honesty. A reverse image search can expose stolen photos. The FTC advises never sending money or gifts to an online romantic interest you have not met in person.
Are social media quizzes a privacy risk?
Social media quizzes can be a privacy risk when they collect more data than their stated purpose needs. Some request access to friend lists, photos, location history, or birthdates, and answers about pets, schools, or hometowns can match weak security questions. Combined data can support targeted scams or be resold. Not every quiz is malicious, but check the developer, permissions, and privacy information first. Current NIST guidance does not accept security questions as a way to authenticate users.
How do third-party app permissions on social media put your data at risk?
Third-party apps that connect through a social media login can receive whatever profile data and actions you authorize, and a malicious or intrusive app may request permissions unrelated to its function. Using the platform's login does not mean the platform endorses the developer. Review requested permissions before approving, and check connected apps regularly to revoke ones you no longer use. Revoking access stops future collection but does not delete data the app already copied.

About the Ethics in Technology course

How many college credits is Ethics in Technology?
Ethics in Technology (Computer Science 195) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Ethics in Technology cost and what is included?
$250, paid once, with lifetime access: all 116 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. It is sold on its own and is not part of UPI Study PRO.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Ethics in Technology take?
It is self-paced with no deadlines. The 116 lessons total about 28 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Ethics in Technology.

116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Ethics in Technology →Download the syllabus
Ethics in Technology
3 credits · NCCRSEnroll →