Do not accept the request. A second friend request from someone already on your friends list is one of the most common signs of a cloned Facebook profile, where a scammer copies a real person's name, profile photo, and public posts into a new fake account, then sends friend requests to that person's actual friends list in hopes of reaching people who will trust the name they recognize.
Before doing anything else, check the real account. Message your friend through their original profile, a text, or another platform and ask directly if they created a second account. In almost every case they did not, and they may not even know they have been cloned until you tell them. If they confirm it is fake, you now know for certain the new request is malicious.
Report the duplicate profile to Facebook. Go to the fake profile, click the three-dot menu, and choose Find Support or Report Profile, then select the option for a fake account impersonating someone. Facebook typically reviews these quickly since impersonation reports are high priority, and the account is usually removed within a day or two if the report is clear.
Warn your mutual friends. Cloned profiles work by sending requests to everyone on the real friend list, so other people you both know are likely getting the same request. A quick post from the real account or a message to a few close contacts can stop others from accepting and limit how far the scam spreads.
Do not click any links or respond to messages from the fake profile. Cloned accounts are usually created to send phishing links, ask for money in an emergency, or promote fake giveaways once a connection is established. If you already accepted the request and chatted with the account, stop responding, unfriend and block it immediately, and avoid clicking anything it sent you.
Check your own privacy settings while you are at it. Limiting who can see your friends list and profile photo to "Friends Only" instead of "Public" makes it much harder for scammers to clone your profile in the future, since cloning relies on publicly visible photos and friend lists. Review this under Settings & Privacy, then Privacy Shortcuts or Profile Settings, depending on the current version of the app.
If the fake account already contacted people pretending to be you and asked for money or personal information, treat it like impersonation fraud: report it to Facebook, tell affected friends to disregard any requests, and if money was sent, report it to the platform used for payment and consider filing a report with the FTC or local police, since impersonation for financial scams is a form of identity theft.