Raymond A. Pompon, senior security officer at HCL CapitalStream, which provides electronic services for financial institutions, said such prosecutions were tricky. “Oftentimes you do know who it is, but you actually have to prove this person did it — his hands were on the keyboard.”
If or when the time for prosecution comes, Facebook is unlikely to hold back. It has pursued a number of civil suits against spammers and scammers that have led to record judgments.
“We’re pretty relentless,” Mr. Sullivan said.