Start connecting only with people you know: your circle decides who sees you

Sarah picks up her phone after dinner and finds three notifications. A friend request from a colleague at her new office, one from a profile with the name of a girl who may have been at secondary school with her, and one from a smiling man in uniform with no friends in common. Accepting takes a second, and declining feels almost rude.

That gesture, though, is more than a greeting. Every person who joins your contacts gets a seat in the room where you share photos, trips, birthdays, your children’s names, the café where you have breakfast. A stranger’s profile, once inside, sees all of this just as your friends do. And it can use it, even months later, for purposes that have nothing to do with friendship.

This recommendation — R23 of the Cyber Welfare Framework — does not ask you to shut yourself away or to be suspicious of everyone. Social media is also a place to meet new people, find old classmates and follow people who inspire you. It asks for something simpler: to decide consciously who has access to your information. That is the idea behind connecting only with people you know, and it takes a few minutes to learn.

What this recommendation says

Recommendation R23 states that the contacts who can see your personal content should mainly be people you genuinely know, people with whom you have a real relationship.

“Genuinely know” means two things:

• you know who the person is away from the screen, or you have a way of checking;
• the relationship exists beyond the request itself: you have spoken, met, worked or studied together.

The second point is the one people miss most often. A familiar name, a believable photo and ten mutual friends are not enough: they are exactly what a fake profile — an account created to impersonate someone, or to look like a person who does not exist — tries to put on display.

Following a source and opening the door are two different things. Following the public profile of a newspaper, a public body, a science communicator or an artist means receiving their content: you are the one looking. Accepting a friend request, or letting someone into the followers of a private profile, is the opposite: that person is the one looking at you. R23 is mainly about this second movement.

What it is not. It is not a ban on making new acquaintances online, and it is not an invitation to distrust everyone. Someone you meet in an interest group or on a course can become a contact: what matters is that access to your life comes after trust, not before. Nor is it a guide to the privacy settings of the platforms, which are a topic in their own right and will be covered in the upcoming Security Measures on social media.

Where it applies. To every space where someone can become your contact: personal profiles, messaging accounts with visible statuses and stories, professional networks, parents’ groups, gaming communities, dating apps.

Why it matters

Your circle of contacts is like the list of people who hold a key to your home. It does not matter how strong the door is: whoever has a copy of the key can walk in whenever they like.

On social media, what you share with “friends” is often far more personal than what you share publicly. Put together, it tells people where you live, what time you leave the house, who your family members are, where you go on holiday and what you care about. For anyone who wants to deceive you, or deceive someone else using your name, it is valuable material.

The mechanism that exploits this information is called social engineering: persuading someone to do something — pay, click, reveal a code — by playing on trust rather than on technology. The more personal a message looks, the more believable it is. And a stranger who has been watching you for months can write a very personal message.

The concrete consequences show up on four fronts:

• privacy — photos, habits and places visible to people you have never met;
• targeted deception — messages built on your details, sent to you or to your friends;
• misuse of your network — a fake profile you have accepted looks more trustworthy to your contacts;
• time and peace of mind — reports, explanations, contact lists to clean up, and the feeling of having been watched.

One aspect deserves special attention: your choice protects other people too. When you accept a profile, your friends see that you are connected and tend to trust it more. A well-kept circle is a favour you also do for the people close to you.

A concrete example

Back to Sarah. The profile of the girl from secondary school has the right name and a blurry photo on a beach. There are eight mutual friends: Sarah recognises two of the names. She accepts.

For a few weeks, nothing happens. The profile leaves a few likes, comments on a photo of the dog, wishes her a happy birthday. Meanwhile, it sees the party photos, the name of Sarah’s son’s school, the town where she will spend the summer.

One day a private message arrives: “Hi Sarah, I’m in a bit of trouble, I’ve lost my wallet while travelling, could you top up my phone? I’ll pay you back tomorrow.” Or the message goes not to her but to Sarah’s sister, who can see that the two are friends and trusts it.

Nobody has “hacked” Sarah’s account. All it took was coming into the circle through the front door.

The point where this chain breaks is the very first one: a quick question, on a different channel, to someone who really knew that classmate. “Have you heard from Julia? She’s sent me a friend request.” Often the answer comes back within a minute: “Julia already has a profile, she’s on my friends list.”

When to apply it

The rule always applies, but there are moments when it makes a clear difference.

• When a request comes from a name you know, but from a second profile. If you are already connected with that person, a new account in their name deserves a check before anything else.
• When “friend suggestions” show you unfamiliar faces. The platform calculates them automatically: being suggested does not mean being trustworthy.
• After a public event. A wedding, a concert, a trade fair: requests arrive from people who “were there too.” Some are genuine, others are not.
• In groups and communities. Chatting with someone in an interest group is different from giving them access to your personal profile.
• In professional settings. A request from a supposed recruiter or client may be genuine; access to your personal profile is a separate question.
• When you are going through a difficult time. A house move, a bereavement, a separation, a spell of loneliness: at moments like these, a kind and persistent contact is harder to assess calmly.

How to apply it

You do not need to review everything in one evening. What you need is a rule of thumb to use every time.

1. Ask yourself one question before accepting. “Do I know who this person is outside social media?” If the answer is yes, fine. If it is “I think so,” move on to the next step.
2. Check doubtful requests on a different channel. A message, a phone call, a question to a mutual friend who knows the person. Do not ask the profile itself for confirmation: someone pretending to be someone else will say yes regardless.
3. Look at the profile calmly. How long it has existed, whether the photos look lived-in or like a catalogue, whether your mutual friends actually know the person. The typical warning signs are gathered in the post on the signs of a fake profile.
4. Tell the people you follow apart from the people who follow you. To follow a public source — a public body, a newspaper, an expert — that source does not need access to your profile. Anyone who wants to see your photos and your movements, on the other hand, should be someone you know.
5. Leave requests pending without feeling guilty. An unaccepted request is not an insult. If the person is real and knows you, they will find another way to make themselves known.
6. Review your circle from time to time. Contacts you do not remember, empty profiles, accounts that have never written to you: you can remove them quietly. The step-by-step method is in the post on how to clean up your social connections.

Common mistakes to avoid

• “We have friends in common, so it’s fine.” Mutual friends only tell you that other people have accepted that profile, not that they know who is behind it.
• Accepting so as not to seem rude. Politeness is owed to people, not to accounts. Nobody is entitled to access your life just because they asked.
• Asking the profile itself for confirmation. “Is it really you?” is a question an impostor always answers with yes. The check has to happen somewhere else.
• Confusing numbers with value. Lots of followers do not make a profile safer or more important; often they just make it more exposed.
• Thinking it is enough not to post anything significant. Your friends list, your likes and the photos you are tagged in say a lot, too.
• Keeping contacts you no longer recognise. Your circle changes over time: a contact that was useful years ago may now be an abandoned profile, or one that has ended up in other hands.

How this connects to the Cyber Welfare Framework

R23 takes security into a place where people rarely look for it: relationships. It is the behaviour that turns “accept” from a reflex into a choice.

Digital maturity levels.

• FL1 — Basic. You accept almost every request, especially if there are a few mutual friends. It is the most common starting point, not a fault.
• FL2 — Beginner. You pause before requests from strangers and tell the sources you follow apart from the contacts who can see your profile.
• FL3 — Autonomous. You check doubtful requests on a different channel and review your circle of contacts regularly.
• FL4 — Skilled. You spot duplicated or carefully crafted profiles at a glance, and you know how to report them and warn anyone who might be affected.
• FL5 — Expert-Guide. You help family members, colleagues or students build the same habit, without making them feel guilty about past choices.

R23 is the key step from FL1 to FL2 for life on social media, and it remains an active reference at every level after that.

How to check you are applying it properly

Three questions, to be answered honestly.

1. If I scroll through my contacts, do I recognise almost every name and could I say how I know them?
2. The last time I received a doubtful request, did I check outside the platform before accepting?
3. Are the people who can see photos of my children, my home or my trips the people I posted them for?

Quick checklist

• ☐ Before accepting a request, I ask myself whether I know the person outside social media
• ☐ I always check requests from a second profile of a friend on a different channel
• ☐ I do not treat mutual friends as sufficient proof
• ☐ I can tell following a public source apart from giving access to my profile
• ☐ In recent months I have removed at least one contact I did not recognise
• ☐ If a contact asks me for money or codes, I check before replying

If a box stays empty, you already have your next step. If you would like a more structured measure of where you stand, you can take the digital resilience self-assessment.

R23 sits alongside other recommendations on social media, each with its own scope: limiting social login is about the services linked to your profile, while the recommendations on posting photos with QR codes and on turning off photo geotagging are about what you post. Profile privacy settings will instead be the subject of the upcoming Security Measures MS6 and MS7.

In short

Your circle of contacts decides who sees what you share. Accepting a request is not a greeting: it gives access to your personal life, and indirectly to your friends’ lives as well.

The answer is not to shut yourself away, but to choose: let in mainly people you genuinely know, check doubtful requests on a different channel, tell the sources you follow apart from the contacts who see you, and review your circle now and then, without any drama.

Social media remains a place to meet new people. The difference lies in the order: trust first, then access.

Something to think about. If you could see today the full list of people who look at your photos, how many of them would you genuinely recognise?

Explore this recommendation

This recommendation is the pivot of a content unit. Each post looks at a different aspect.

• Risks of accepting strangers online — what gets hit, in terms of the confidentiality, integrity and availability of your information and your network
• Consequences of a fake profile among your contacts — the concrete effects on the operational, financial, legal, reputational and personal levels
• How to clean up your social connections — the mitigations, from reviewing your list to what to do if you have accepted a fake profile
• Signs of a fake profile — the indicators to check and what they mean
• How friend suggestions work — the platform features that shape who gets suggested to you, with their advantages and limits
• Fake profile attacks — the ways fake profiles are used to deceive people and their networks

Related resources

Short reads from the Resources section, for anyone who wants to focus on a single aspect:

• Fake Dating Apps: Recognising the Ones Built to Extract
• How to Recognise Phishing When It Is Built to Be Convincing
• Security and Privacy Settings: The Half Hour Worth Spending

Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.