Well, it's rather disappointing that they didn't catch something as simple as that ;)

It's already nontrivial to create fake Facebook accounts. For those serious about it, who already deal with IPs and mobile numbers, I can't imagine that creating novel photorealistic faces would be all that problematic.