Fake funeral live stream scams target grieving Facebook users

Some crooks have the morals of an alley cat. But some sink even lower.

Over the past few months, Malwarebytes Labs has discovered scammers active on Facebook who are preying on mourners by using stolen images and fake funeral livestream links to steal money and/or credit card information.

These scammers are becoming more and more active and new cybercriminals are also adopting this method, which we see very often. When a scheme works, more criminals join them.

Currently, we know of two different approaches. One uses fake funeral live streaming links. It asks people to follow a link where they can watch the funeral ceremony and share the link with their friends and family. The other asks for donations on behalf of the deceased’s family.

We have been following the progress of such a scam, but you should know that there are several variations.

Usually this type of scam starts with a Facebook comment under a funeral home notice.

“POST UPDATE:

If you can afford it, you can donate.

Please share with family and friends

Watch (name) Loveing ​​Memorial & Funeral Service Live Online

WATCH LIVE (link)”

The domain the comment links to is not unique. Malwarebytes Premium blocks at least 4 other domains involved in the same type of scam. And there were more that had been taken offline by the time you read this.

If you follow the link, you will arrive at a landing page similar to this one.

All buttons on this site pointed to a domain that we block for phishing.

Adding the domain to the exclusion list allowed me to follow the procedure and I ended up on a site that asks you to sign up for your “favorite movies” so that I can supposedly get full access. Remember, I came here following links to a live stream of a funeral, not because I wanted to watch my “favorite movies.”

After providing the scam site with a fake email address, I was allowed to move on.

Here I am prompted to activate my subscription by providing my credit card details. Why do they need my credit card details for a free service?

This is why the site offers:

“WHY YOUR CREDIT CARD?

We have streaming licenses for our content only for certain countries. That’s why we need to verify your location with a valid credit card. Your subscription to all our content is only €2.00, unless you decide to upgrade to premium at the end of the 3-day trial subscription, or if you don’t cancel your subscription during the trial period.

But the real reason can also be found by looking closer. Did you spot that little pre-checked line at the bottom of the left panel?

I’ve made it bigger so you can read what the small text says.

“I accept the membership conditions and wish to subscribe to a secondary subscription. Recurring payments 2X every 14 days, current rate (€64). Cancel at any time.”

In March 2024, the BBC warned that these cybercriminals sometimes respond to a memorial post within minutes, using a fake profile and including the deceased person’s photo and personal information in their message.

Cybercriminals are very good at making these Facebook posts appear authentic. They often copy and paste real photos of the deceased from a funeral director’s website or a legitimate tribute site. But these photos are fake and can cost a lot of money to those who fall for them.

Protect yourself and others

Several funeral homes have begun adding a note that “this funeral is not livestreamed” to their online notices to reduce the risk of people being victimized.

The National Funeral Directors Association states:

“You should not have to pay to watch a live stream of a funeral and official links will be provided by the funeral director to the grieving family.”

Be wary of strange friend requests. These may be from scammers looking for a way to comment on your post.

When you see a comment containing these links, please report it to Facebook immediately. They will be removed as soon as possible so that others can be spared.

Never give out your credit card information unless you are 100% sure of the identity of the person you are dealing with. And even then, providing this type of information online still carries risks.

Related fields

Fake streaming sites:

Qtvlivestreamhd(.)com

Hqonlivestream(.)xyz

Visitpageaus(.)com

Auseventstream(.)com

Phishing sites:

pbg4jptrk(.)com

paperpadpen(.)com