IN SHORT: An innocent but interesting message is posted on a Facebook community page. It's about a lost child or dog, or a serial killer, or a bear attack. But as soon as it's shared enough, it's edited - replaced with an offer that could drain your bank account or steal your identity.
"Anyone Having Financial Challenges This Festive, NCP is running a Promotion," reads a scam message circulating on Facebook worldwide in September and October 2022.
It goes on: "Download App, Sign Up and Get Rewarded by EBT. Please Share With Others so we all Gain From This."
The message includes a screenshot that seems to be of a payment verification from the US-based Fresh EBT smartphone app.
The verification message begins: "Your EBT NCP prepaid card has been funded! $2,543 has been added to your NCP Mobile account."
The scam message has appeared on community pages, mainly across the USA, under several different user names.
But weirdly, the screenshot of the app's payment verification is exactly the same. Every single user seems to have captured the screenshot at 11:33, with four internet connection bars and the phone's battery half full.
It gets weirder.
A new method of scamming on Facebook
The message is clearly part of what Africa Check has come to call the Facebook post editing scam. We've been investigating and exposing it for months.
Here are a few of our reports:
Facebook fraudsters up to new tricks: Go2Bank scam spread by editing ordinary posts
Girl in blue 'missing' across the USA? No, just another Facebook scam
Serial killer, missing child, missing dog? Beware the new Facebook post editing scam
This is how the scam works.
A seemingly innocent message is posted on a Facebook community page. But the message has lots of potential for virality, for users to share it. Some messages pull at the heartstrings - a missing child or dog, for example. Others evoke fear: a serial killer on the loose, or a bear attack on a car.
Once the message has been shared by enough users - and passed by the community page moderators - it is edited. Its contents are replaced with a scam message, such as the "NCP is running a Promotion" scam.
It's often difficult to work out exactly how a scam works.
But most Facebook post editing scams try to get users to download an app. This is likely to install malware on their devices. The malware could then steal valuable personal information such as credit card details. It could even take over the person's online identity.
This brings us to how Africa Check first came across the Facebook editing scam.
Many of the messages are posted on US community group pages. But the users posting them have names common in Southern African countries.
We strongly suspect that these users' Facebook accounts have been hacked. But we're still to confirm the suspicion.
How to protect yourself
Here are a few ways to identify this particular scamming method, and protect yourself from it.
It may seem odd, but all of the first, pre-edited messages include the round push-pin location emoji. This may be to remind the scammers to change the message to include the name of the community page they're posting in.
Sign up for free AllAfrica Newsletters
Get the latest in African news delivered straight to your inbox
Most of the messages are posted on local community pages, often informal buy-and-sell groups.
Don't believe - or share - messages from people you don't know, particularly if they are posted in an open community page.
If you're a Facebook page moderator, take a little time to investigate people posting messages that seem particularly sensational - about a lost child, for example.
And if you come across an offer on Facebook that seems too good to be true, take a look at the post's edit history. You can do this by clicking the three dots at the top right of the post.
Finally, be careful online. There are lots of internet fraudsters trying to con people out of their money - even on Facebook. Find out more in our general guide to Facebook scams, and how to spot them.
