Facebook deleted two accounts this week that stole photos of a 3-year-old boy affected by chickenpox and used them to scam users. The cybercrooks falsely claimed the boy in the photos had cancer, and said Facebook would donate money for the boy’s surgery if people liked and shared the posts.

According to The Daily Dot, the perpetrators were likely using the post for “Like farming” purposes. Scams like that work by accumulating a ton of likes with an attention-grabbing post (the BBC says that more than 1 million people interacted with this particular hoax), and then selling the page or targeting those who liked the page with bogus or malicious content.

The boy’s photos were already out there because his mother posted his severe case of chickenpox to beg for free vaccines in the UK. In other words, because the pics had already gone viral once before, they were uniquely vulnerable to be stolen and used in this kind of scam. Still, that doesn’t excuse Facebook’s lack of action when it came to removing them. The site disabled the guilty accounts twice, only to restore them hours later. It finally removed them once and for all only after the BBC publicized the case.

“Clearly anybody should have the right to appeal their account being taken down, but if it’s returned up that quickly it doesn’t show much due process has been taken in checking it out,” cybersecurity expert Alan Woodward told the BBC. “It’s difficult not to conclude Facebook was doing the bare minimum here.”

As always, this case is a good reminder to check your privacy settings and make sure your photos can only be seen by the people you want to see them. You never know what could happen to them if they fell into the wrong hands.