Facebook operates a lightweight version of its site for older networks and devices. This version does not use the same advanced JavaScript restrictions as the modern app or desktop site. Open your desktop or mobile browser (e.g., Chrome, Safari). Copy the URL of the locked Facebook profile.

Most sites ask you to paste a Facebook profile URL and then demand that you “log in again” to verify your identity. That login page is a fake. If you enter your email and password, you’ve just handed your Facebook account to scammers.

If the user has a locked profile, their privacy is clearly important to them. The honest method to see their full profile picture is to send a friend request.