Beware “I Can’t Believe He Is Gone” Facebook Scam

A popular Facebook scam that has been doing the rounds recently is the “I can’t believe he’s gone” scam which automatically posts malicious links (and tags friends) from compromised Facebook accounts.

If you’re scrolling down your Facebook newsfeed and come across a post similar to the one below, tread carefully, the post is actually a scam.

I can ‘t believe he is gone, i’m gonna miss him so much

Despite appearing to have been posted by a Facebook contact, the post was actually the result of cyber-crooks who have managed to gain some access to your contact’s Facebook account.

Scams like this – that automatically post messages from compromised Facebook accounts – have been around for years. However the “I can’t believe he is gone” variant first appear in early 2024, gaining particular traction in June 2024 after eluding Facebook’s spam filters.

Sponsored Content. Continued below…

How does the scam work?

The post is a typical example of social engineering, which is a crook or spammer’s ability to lure would-be victims into doing something they shouldn’t do – in this case, clicking a link.

In the cases we’ve seen these links either lead to a dead-end (likely meaning the companies used by the scammers to host/direct to their scam pages have caught on to the scam and terminated their services) or they link to fake news articles which try and trick users into any of the following –

1. Agree to download “software” to view an article/video – the software is actually malware.
2. Enter their Facebook login details into a spoof login page – the details are then stolen.
3. Complete surveys/questionnaires to view an article – these are surveys that bombard you with spam and share your details with marketing companies – and may even sign you up to hard-to-cancel subscription scams.

If either of the first two, scammers could gain access to the victim’s Facebook account to post the same scam messages.

In the most recently examples we’ve seen posted on Facebook, the malicious link is posted as a comment to the original scam post. See below.

If you see these posts appear on Facebook, don’t click on any of the links and let your Facebook friend know to remove the post, as well as change their Facebook login password.

Q “I was tagged in such a post. Has my security been compromised?”

A No. Being tagged in these posts doesn’t mean you’ve been compromised. Only if your account was actually posting these messages would we advise for a password change.

Additionally if you downloaded any “software” as a result of this scheme, we recommend a full antivirus scan.