Facebook scams: When your "friends" are actually hackers

Scams cost Americans roughly $50 billion each year, and according to the Better Business Bureau, they affect one in four homes. The most frequently reported scams are delivered by phone. But more than half of victims say they were contacted online through websites, e-mail, social media and more.

Experts say more and more people, including millennials, are becoming victims on Facebook. So what happens when a person you think is a Facebook "friend" turns out to be someone else?

For Shellie Drummond, it started when she found the Facebook profile for a friend from years back, named Deborah Boyd.

"I was on Messenger and my friend's name came up," she told CBS News correspondent Anna Werner.

Soon "Boyd" was telling her about a so-called government grant she'd gotten through an agent on Facebook. Sure enough, the agent then told Drummond she could get financial assistance from the government. All she had to do was provide some personal information, then send $1,500 in fees, to get up to $100,000 in grant money.

"The person that I was corresponding with that I thought was my friend had vouched for this foundation, and I believed her," said Drummond.

So she wired the $1,500 to Florida, then waited for the delivery driver (like the one shown on Facebook) to deliver her $100,000 in cash.

But they never came.

And when Drummond tracked down her friend by phone, Deborah Boyd told her, "It wasn't me. You got scammed."

Turns out, Boyd's Facebook account had been hacked by scammers who locked her out, then quickly reached out to try to con her family and friends, who she then had to warn: "Please do not send them anything, and delete yourself off that page. Because it's not me."

"They're basically capturing that trust you have in this person and using it for their own gain," said Emma Fletcher of the Better Business Bureau.

So we wondered: were the scammers still active?

To find out, "CBS This Morning" set up our own fake account on Facebook, and contacted Boyd's imposter. Sure enough, she claimed she got a $50,000 grant and said we could get one, too: it wasn't a loan, and we wouldn't have to pay it back.

"She's not wasting any time," Fletcher said.

Werner showed Fletcher the conversation that progressed. "Is that typical of what you see happening?" Werner asked.

"Well, once you show an interest, you know, they're going to go in for the kill," Fletcher replied.

And it wasn't just the fake Deborah Boyd account: we found what appears to be a network of fake Facebook profiles offering grants, from $50,000 to $1,000,000 -- all while assuring us it wasn't a scam. "Swear to God," one said.

But those photos of the "agents"? A quick search using Google Images turned up the truth: the photos are real, but those people don't offer grants. One is a real estate agent from Vermont. The other? A professor at MIT.

So if those aren't the real people, who's really running those Facebook accounts? 

Computer expert Gary Miliefsky set up a way to track the scammers' location: he built a page that looks like a money transfer company's website, but really finds a computer's unique IP location.

"This website is an IP tracker," Miliefsky said. "So when they click the link thinking they're going to a popular money transfer site, they are allowing us to track them."

We got the scammers to click on it, and lo and behold … the scammers are in Lagos, Nigeria.

"Russians use malware, the Chinese use malware. The Nigerians, they use social engineering and they use social media," said Miliefsky.

But if we were able to track them, what about Facebook?

The company told us it has "a dedicated team … helping to detect and block these kinds of scams," and has "developed several techniques" to stop the abuse. But Boyd told us Facebook still hasn't solved her problem, and the scammers still have a fake profile up with her name.

"These people should not still be contacting my friends and family," Boyd said. "No way should they be. This is, what, six months later, nine months later? Come on!"

After Werner reached out to Facebook, it asked us for the URLs for the scam accounts, which we provided. Within hours, it appeared Facebook had blocked those accounts.

But Deborah Boyd says she has never been able to get back into her old profile, which has a lot of family photos and memories that she'd like to have back.

By the way, the people we mentioned whose photos were used? One declined to comment, but the other expressed shock when we told her. She had no idea her photo had been taken off her own website and used by fraudsters for a scam.