Helen opens her social network in the evening, after dinner. Among the notifications there’s a friend request: a smiling face, a photo at the seaside, twelve mutual friends. The name means nothing to her, but twelve mutual friends feel like a guarantee. She accepts, as she has done before, and moves on.
There’s nothing odd about that gesture. But accepting a contact isn’t a greeting: it’s a permission. From that moment on, that person sees what Helen shows to “friends only”, and appears among her friends in the eyes of everyone else.
So the more useful question isn’t “who would even care about me?” but a different one: if that contact weren’t who they claim to be, what would be touched?
This post answers it by looking at the three aspects by which the security of any information is measured: that it stays private, that it stays correct, and that it stays available. They are the practical translation of three technical words — confidentiality, integrity, availability — and they help you see that the risks of accepting strangers online don’t stop at the privacy of the person who clicks “accept”.
It expands on the recommendation of connecting only with people you know.
Three questions to measure an impact
For any contact request, these are the right questions to ask:
- What could this person see, once accepted? — this is the confidentiality question.
- What could they do, to me or to others, by being one of my contacts? — this is the integrity question.
- What could I lose if things went wrong? — this is the availability question.
For a colleague or a neighbour, the answer is reassuring. For a stranger it changes, because a contact doesn’t just look: they become part of Helen’s network, and from there they can reach everyone who trusts her.
Confidentiality is the guarantee that information can be read only by those who are authorised to read it. On social media, you are the one who grants that authorisation, and the simplest way to grant it is to accept a request: “friends only” settings protect you well, but only if your friends really are friends.
A practical example
Helen’s posts are visible to her contacts only. Inside that circle are her holidays, the gym on Tuesday evenings, her daughter’s birthday party with the school banner in the background, the dog’s name. Whoever is accepted sees all of it in a single evening.
What the incident looks like
A stranger among your contacts doesn’t need to steal anything: they read. They piece together habits (when Helen is away from home), places (where she works, where she goes running) and people (who her family and colleagues are). Taken one at a time, these are harmless details; lined up, they make a very precise portrait. It is the starting material for social engineering — the art of persuading someone to do something by exploiting their trust rather than a technical flaw. Your friends list matters too: for anyone who wants to approach other people by posing as an acquaintance, it’s a map.
What to watch for
- a recent contact liking photos that are years old, as if scrolling through your whole profile;
- chat questions about personal details (where you work, when you’re going away, what the school is called) with no reason linked to a real conversation;
- friend requests reaching several people in your circle at around the same time, from the same profile.
What to do
Look at your profile through a stranger’s eyes: many social networks offer a preview of how it appears to others. Then scroll through your friends list and ask yourself, for each name, whether you could say who they are. The details hidden inside photos — a saved location, a visible code — are topics in their own right, covered in the recommendations on turning off photo geotagging and on posting photos with QR codes.
2. Integrity: your network doesn’t become a tool for deceiving others
Integrity is the guarantee that information isn’t altered or misused by someone with no right to do so. Here the point is no longer what a stranger can see, but what they can do by exploiting the trust your network places in you.
A practical example
A fake profile — an account created with an invented name and photos, or ones taken from someone else, to look like a real person — sends Helen a friend request. Once accepted, it sends friend requests to her friends. Each of them sees “mutual friends: Helen” and trusts it a little more. Helen has done nothing wrong towards them, but her name has become a reference.
What the incident looks like
With trust built this way, the profile can suggest an investment “that worked for a friend of Helen’s” or ask for a small loan. Or it can use what it has read to write Helen herself a tailored message: this is targeted phishing, a scam attempt built with real details about the person so that it seems believable.
In some cases the next step is profile cloning: someone creates a second account with Helen’s name and photos, and writes to her contacts pretending to be her. How to recognise these profiles is the subject of signs of a fake profile; how these schemes are organised, of fake profile attacks.
What to watch for
- friends asking whether you really sent a certain message or request;
- a second friend request from a profile with your name, or with the name of a friend you already have among your contacts;
- messages containing true details about you, combined with an unusual request for money, codes or clicks.
What to do
When a request comes from someone claiming to be a friend, check through another route: a phone call, a message to the number you know. If you notice that a profile is using your name, let your contacts know and report it to the social network. What to do when messages are sent from your real account is explained in the recommendation on messages sent in your name.
3. Availability: your profile and your contacts stay within reach
Availability is the guarantee that you can use your account and reach your people when you need to. It seems far removed from a friend request, but sometimes it’s the last link in the chain.
A practical example
A contact Helen accepted months ago sends her a link: “Look, you’re in this video too.” The link leads to a page that imitates the social network’s sign-in screen. Helen types in her password, and shortly afterwards she can no longer get in.
What the incident looks like
Whoever takes control of a profile often changes the recovery email address and phone number. Meanwhile the profile can be used to write to friends, and it may be reported by the people who receive those messages. Faced with many reports or unusual activity, some platforms temporarily restrict or suspend an account pending checks: a reasonable safeguard, but for the real owner it means being locked out.
A cloned profile causes confusion too: some friends block the real one, thinking it’s the fake. The result is similar: lost contacts, interrupted conversations, sometimes years of memories out of reach.
What to watch for
- the correct password is rejected, or you receive a notice of an email change you didn’t ask for;
- sign-in notifications from devices or places you don’t recognise;
- a notice from the platform that your account has been restricted or is under review.
What to do
Protect the account with a second authentication factor: this is what the recommendation on protecting accounts with a second factor describes. Keep your recovery email and phone number up to date, and keep a way of reaching the important people in your life outside the social network. If you use your profile to sign in to other services, the effect of a lockout spreads further: that’s the subject of the recommendation on limiting social login.
| Aspect | What a stranger among your contacts can do | Why it matters |
|---|---|---|
| Confidentiality | Sees photos, habits, places and a friends list meant for contacts only | The harm happens even without leaving traces |
| Integrity | Uses your name as a guarantee, prepares tailored messages, clones your profile | It involves people who trust you |
| Availability | Leads to account takeover or restriction, causes confusion among your contacts | It cuts you off from relationships, conversations and memories |
A scenario that brings them together
Two years ago Helen accepted a profile that claimed to know a former schoolmate. A few “likes”, then nothing more.
Last autumn that profile changes its name and photo. It has read Helen’s profile: it knows her daughter swims, that she spends summers in the mountains, who her closest friends are (confidentiality). It writes to one of them, mentioning Helen and a holiday they took together, and proposes a “deal” (integrity). To Helen it sends a link to a supposed video of the swimming gala: she enters her password and loses her profile for two weeks (availability).
Three different impacts, one single cause: a contact accepted out of politeness and forgotten. What happens next, in terms of money, relationships and time, is described in the consequences of a fake profile among your contacts.
The impacts that show up later
Not every effect appears straight away, which is why “nothing has ever happened” isn’t a reliable check.
- Dormant contacts. A profile you accepted and never heard from again keeps seeing everything you post. And it can change hands: some fake profiles are built up in bulk and then passed on.
- Information that ages well. Your date of birth, the name of your school, the name of your first pet never change. Read today, they can be used years from now to guess a security question or make a message believable.
- A network that grows on its own. Friend suggestions take your existing contacts into account: every stranger you accept makes it more likely that the system will suggest you to other strangers, and them to you. The mechanism is explained in how friend suggestions work.
- References that stay. Your name among the “mutual friends” keeps working for that profile with every new person it contacts, even when you no longer think about it.
This isn’t a reason to view every new person with suspicion, but to make choosing your contacts a habit: a circle made of people you know reduces all four of these effects, including the ones you will never see.
Not all contacts carry the same weight
The impact depends on how much that person sees and how much your network trusts them.
| Type of contact | Main impact | Why |
|---|---|---|
| Family, friends, colleagues you know in person | Low | The relationship exists outside social media and can be checked |
| Profiles with many mutual friends that you don’t remember | Integrity | Mutual friends pile up: they don’t prove a real acquaintance |
| Very attractive, flattering or “investment expert” profiles | Integrity and confidentiality | These are the forms most often used to open a conversation and then ask for something |
| Accounts presenting themselves as support staff or as the platform itself | Availability | They ask for sign-in details or codes, and lead to account takeover |
| Contacts accepted years ago and never heard from again | Low in itself, high if the profile changes hands | They see everything, and nobody remembers them |
The last row is the one that counts: the highest risk often comes not from today’s request, but from the ones accepted and forgotten.
Why even “harmless” requests matter
The reasons for accepting are almost always kind ones. They don’t always hold up.
| What we tell ourselves | Why it doesn’t hold up |
|---|---|
| “We have loads of mutual friends” | A fake profile gets them precisely by sending requests to many people in the same circle |
| “My profile is private anyway” | “Private” means visible to contacts: once accepted, the stranger is a contact |
| “I’ve got nothing to hide” | The risk isn’t a secret being revealed, but your information being used to deceive you or others |
| “If they behave badly, I’ll remove them” | What they’ve already seen or saved stays with them, and the signs often come late |
If the answer to “who is this person to me?” is a moment’s hesitation, that’s usually an answer already.
Link to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Awareness | Recognising that accepting a contact is a permission, with effects on you and on your network |
| Skills | Being able to read confidentiality, integrity and availability as three concrete questions when a request arrives |
| Secure Behaviour | Reviewing your contacts list regularly and checking unusual requests through another route |
Reference level: FL2 — Beginner. This is the level at which you move from “I know I shouldn’t accept everyone” to “I understand what happens when I do.” To see where you stand on your other digital habits as well, you can take the digital resilience self-assessment. Detailed management of social media privacy settings will be covered by the dedicated Security Measures still to come.
Summary
- Confidentiality is about what a stranger sees: photos, habits, places, friends.
- Integrity is about what they can do using your network: targeted phishing, cloned profiles.
- Availability is about what you can lose: your account, your contacts, your memories.
A stranger among your contacts doesn’t produce just one impact: it opens the door to all three, for you and for the people close to you.
One thing to do today. Open your friends list, or the list of profiles you follow, and scroll through it for ten minutes. For every name you couldn’t link to a real person, ask yourself whether you want them to keep seeing what you post. How to tidy up calmly, without offending anyone, is explained in how to clean up your social connections.
Related content
- Connecting only with people you know — the recommendation this expands on
- Consequences of a fake profile among your contacts — the concrete effects on money, relationships and time
- Signs of a fake profile — how to recognise a request that doesn’t come from a real person
- How to clean up your social connections — what to do, in order of priority
Related resources
Short pieces from the Resources section, for anyone who wants to focus on a single aspect:
- Security and Privacy Settings: The Half Hour Worth Spending
- How to recognise phishing when it is built to be convincing
- Fake Dating Apps: Recognising the Ones Built to Extract
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
