Facebook has offered "memorialization" for accounts of deceased people for a while, but it seems that the bar has been lowered for how they verify the person in question is actually expired. Ideally, how it works is a friend or relative of a deceased person fills out a form from the Facebook Help section that gives the name, email, and account name of the deceased person. It also asks if you're a friend, immediate family member, or other.
Lastly, it asks for proof that your friend is dead, but it will accept a link to an online obituary as sufficient proof. If your friend has a common enough name, just Google their name + "obituary" and you'll probably find a match.
Once memorialized, your buddy will be locked out of his or her account. R.I.P.!
(WARNING: Don't do this. It's at the very least a pain in the ass for your friends.)
Update: Why is it so easy to fake a friend's death? A Facebook spokeperson tells Buzzfeed, "we try to take all necessary precautions when processing user requests and provide an appeals process for any possible mistake we may make." It doesn't explain why there's no email confirmation or why an obituary for someone 50 years older than the alleged deceased was accepted as valid proof of his death.
1. To kill BuzzFeed's John Herrman, I just filled out the memorial request form:
I claimed to be an immediate family member of FWD editor John Herrman to make it seem more real (there's no verification I'm related).