Imagine getting a Facebook friend request from the deceased. This happened to me not once, but twice. The account belonged to a distant relative named Carolyn who passed away in 2020 at the age of 96 due to COVID-19-related complications.

Carolyn’s daughter-in-law, Janet, says, “Even into her 90s, Carolyn was somewhat active on Facebook. [Afterwards, it] was a useful tool to share information about her passing and gave the family a place to peruse old photos, either for memories or to use in her obituary.”

In the digital afterlife, Carolyn had become what experts call a “digital zombie.” Her account had been reactivated after her death, and not by accident.

The Impact of Digital Grave Robbers

Carolyn’s story is common. Many social media users interact with these so-called digital zombies daily without even realizing it. Of course, deceased Facebook friend requests do not come to life on their own. 

While investigating Carolyn’s story, I found hackers, or digital grave robbers, frequently target these accounts. For most, it’s a simple process to report when your account has been hacked, but for deceased users, someone else must notice changes to the account.

The Emotional Toll of Deceased Facebook Friend Requests

The shock of seeing a deceased relative or friend active online can rekindle grief. For Jack, Carolyn’s son, hearing his mother’s account had been hacked was horrifying.

“[I] certainly [felt] a sense of violation,” he states. “My most pressing concern was for some of my siblings who live farther away and [had] relied on Facebook for keeping in touch with Mom. I didn’t want them to see a hacked post.”

Because family members and friends have to notice a problem first, Facebook’s current policies aren’t helpful in removing these accounts. And digital grave robbing may cause fundamental shifts in privacy policies.

Why Do Facebook Hackers Hack Facebook?

Digital grave robbers can make a profit by hacking into deceased accounts. According to a 2013 survey, the average value of a person’s digital assets, including bank accounts, medical records, photos, blogs, and videos, totaled around $35,000. Celebrity data may be worth even more.

Expert Gary Rycroft argues in The Digital Afterlife, for example, that an Anne Frank blog would be valuable, but it would be exploitative to hack the data. Stan Lee’s Twitter account, for instance, was used after his death to promote a line of NFT comics. Not surprisingly, this was met with some backlash.

Even non-celebrity accounts, like Carolyn’s, can be valuable to hackers. “Deepfakes and other forms of digital impersonation of the dead make it easier to scam people and institutions,” explains Dr. Tamara Kneese, director of developer engagement in the software and advanced technology group at Intel.

These scams range from selling Ray-ban sunglasses to voting in elections. There are even more nefarious scams in Japan.

“Japan has a huge number of senior citizens. So, [these gangs] keep track of who is deceased, and then they reach out to the family, saying that ‘we have access to all your online things. Unless you give me money, we’re able to do this or do that.’ That has been a disturbing trend,” says Dr. Faheem Hussain, clinical associate professor in the School for the Future of Innovation in Society at Arizona State University.

Read More: The Traumatic Loss of a Loved One Is Like Experiencing a Brain Injury

How to Memorialize a Facebook Account

There are ways to protect your deceased loved ones from getting their Facebook account hacked. The memorialization function designates the account as a page that allows you to share memories and protect against fraudulent activity. Though Facebook has policies on the digital afterlife, there are still holes that are vulnerable.

In Carolyn’s case, once I reported it, Facebook policies only had information on impersonating a friend or a stranger and didn’t cover the impersonation of a dead individual. However, I found I could request the addition of a Legacy Contact for Carolyn’s profile.

What Is a Legacy Contact?

A Legacy Contact is an individual designated to handle a deceased account after a user has passed on. In speaking with Jen Ridings, manager of policy communications at Facebook, I was surprised by the ease of the process.

“You can select a Legacy Contact in the Memorialization Settings section of Facebook’s General Account Settings,” Ridings explains. “The Legacy Contact does not gain access to the account and messages but is permitted through assignment to moderate the deceased user’s profile, download the deceased’s shared content and disable the profile.”

How Do Legacy Contacts Prevent Facebook Fraud?

Legacy Contacts can help decrease the number of digital grave robbers, says Dr. Jed Brubaker, associate professor of information science at the University of Colorado Boulder, who helped write the software to create Legacy Contacts.

“[Memorialization] does end up protecting the account in a number of ways. For example, you can’t log into an account that’s been memorialized,” says Brubaker.

Read More: Living With Anticipatory Grief

How Prevalent Is Facebook Memorialization?

Unfortunately, there is a large backlog of memorialization requests. According to a 2022 report, a record 3.4 million deaths resulted from COVID-19, which caused a boost in deceased accounts. The Oxford Science Institute predicts that by 2070, Facebook will have more deceased users than live ones.

Even with the number of deceased accounts rising, these issues seem to fly under the public radar. In one study, 20 percent of participants knew about memorialization and other digital afterlife tools, and only 6 percent had activated them.

After Carolyn’s account had been hacked twice, Jack and Janet finally requested memorialization for Carolyn’s profile. “Because it’s been a couple of years since she passed away, this felt like the right thing and the right timing to do it,” Janet says. “It’s nice that her friends will still be able to access posts, but that it locks down her account. I hope it truly does stop the hacking.”

Due to the sensitive nature of this subject, only some sources for this story are referred to by first name only.

Read More: How Cybercriminals Are Targeting Internet-Connected Cameras

This article was originally published on Sept. 21, 2022 and has since been updated by Discover staff.