IDefense could not be immediately reached for comment on the legitimacy of the hacker’s offer. However, it previously said that it did not purchase any of the accounts as part of its study because that would violate its corporate policy.

Image Mark Zuckerberg, a founder of Facebook, the social networking site that says it has sophisticated ways to defeat fake accounts. Credit... Kimberly White/Reuters

Criminals steal log-in data for Facebook accounts, typically with “phishing” techniques that tricks users into disclosing their passwords or with malware that logs keystrokes. They then use the accounts to send spam, distribute malicious programs and run identity and other fraud.

Facebook accounts are attractive because of the higher level of trust on the site than exists in the broader Internet. People are required to use their real names and tend to connect primarily with people they know.

As a result, they are more likely to believe a fraudulent message or click on a dubious link on a friend’s wall or an e-mail message. Moreover, the accounts allow criminals to mine profiles of victims and their friends for personal information like birth dates, addresses, phone numbers, mothers’ maiden names, pets’ names and other tidbits that can be used in identity theft.

Last summer, Eileen Sheldon’s Facebook account was hacked and used to send messages to about 20 friends claiming she was stranded in Britain without a passport and needed money. Ms. Sheldon, who lives in California, had recently been living in London, and one friend, believing the ruse, wired about $100 to the thieves.

Other friends smelled a fraud and warned Ms. Sheldon, who quickly reported the problem to Facebook. She does not know how her password was stolen.

While the accounts that were compromised and offered for sale could be legitimate ones like Ms. Sheldon’s, they most likely also included bogus accounts, Mr. Howard said. IDefense did not see the accounts themselves, but the inclusion of many accounts with small numbers of friends suggests the seller could have created fake accounts, perhaps using an automated tool, and sent out blind friend requests.