"Battle tags" are used for identification among Diablo 3 players, and they are not unique. When you pick your battle tag, you are assigned a random 4-digit number to go at the end of it, such as:
EliteD00d#1234
However, on my friends list and when I'm in-game, this suffix is not displayed by default. I'm worried about the potential for a malicious user (or someone with a compromised account) to change their battle tag, either to impersonate me or impersonate one of my friends.
Even if you don't believe it to be a security risk, my current understanding of the friend's list indicates that I can't tell 2 people with the same BattleTag apart if I'm looking at my friends list or while we're in game. What happens if in a game or on my friends list there are two people with the same "root" battle tag? How does the game differentiate the two different accounts?
This seems to be a confusing question, so let's consider a concrete example:
Say I have two friends, both named Bob. They are terrible at picking Battle Tags and they both pick "Bob." For brevity's sake, one is Bob#1 and the other is Bob#2. I give the Bobs my BattleTag, and they both send me friend requests.
My experience with the UI thus far seems to indicate I'd get a friend request from both that just reads "Bob wants to be your friend." The #1 or #2 is not present.
Further, the number is not shown for my current friends either on my friends list or in-game. I don't specify this number when I send a message or quick-join a game.
Say I'm playing with both the Bobs, and we're fighting a hard group of demons. Bob#1 calls out "Hey, I'm in trouble with this group, help!" – on the chat UI, I see
[Bob] Hey, I'm in trouble with this group, help!
How do I know which Bob is about to get smacked down?
Say one of the Bobs goes rogue. He decides to impersonate the other Bob and drag his good name through the mud. How do I know which Bob is Evil Bob?
In short if two people on my friends list have the same Battle Tag, how do I tell them apart?
Best Answer
From the point of view of an attacker who wants your stuff, impersonating another friend you have seems like a relatively difficult thing to pull off.
If you are still worried, you could take the following steps:
Do not add people you do not know to your friends list. If they add you, contact them through some other means (e.g. SE chat room, IM, whatever) and tell them to put something identifiable in the message that is attached with the friend request (as an aside, I've probably rejected a half-dozen requests made because my name was on the GSE list and I didn't recognize them) or check their numeric identifier afterwards (right-click name, "View Profile"):
Use RealID as Melini mentions. This is unique and will display their real name.
Talk to/interact with your "friends" before blindly giving them stuff. If they're level 1, don't give them stuff for their or their "other friend's" "level 59 Witch Doctor". If you're worried about giving away level 1-20 stuff, the opportunity cost of simply talking with your "friend" is vastly higher than grinding mobs in Hell/Inferno. If they are level 50-60 somehow (dubious, see above), don't blindly give them a ton of gear. Hopefully your friend would be offering other gear in return as they happen across it.