If you create one to prank your friend, and he ends up falling for it and sharing it in another group, and it gets to someone who alerts the authorities, without including the context of "this was sent to me by a guy who's a bit of a joker", and railway management's policy is to take all reports seriously rather than verifying their provenance...I find it hard to think anyone in that chain should really be held liable.

The person who alerts the authorities should be held liable - they had the option to verify before doing so, but chose not to.