FACUA asks Data Protection to investigate a fault on Facebook meaning that messages can be sent in the name of another user

FACUA-Consumers in Action has requested that the Spanish Data Protection Agency (AEPD) open an investigation into a security fault on Facebook. The fault allows the sending of private messages pretending to be a different person.

Fraudulent messages can be sent simply by knowing the email address associated with someone’s account, in many cases this information is readily available on their profile page. The username of the impersonated profile is also needed, this information is available from the address bar (http://facebook.com/username). 

FACUA recommends users of the site to keep their Facebook registered email address hidden on their profile page until the problem has been solved. Even with these