How Facebook accounts get stolen: three common methods and how to shut them down
Most stolen accounts were never hacked in a technical sense. The owner handed over the key themselves, through a link or a code. Here are the three methods, each with the setting that blocks it.
Almost every week we see a post like "My account was stolen, ignore any messages from it." In most of these cases, nobody broke Facebook's encryption or exploited a complex vulnerability. The attacker convinced the account owner to hand over the key.
Here are the three most common methods, each followed by the setting that blocks it.
Method one: a fake login page
You get a message on Messenger or by email: "Your page has been reported for copyright infringement and will be deleted within 24 hours. Click here to appeal." The link opens a page that looks exactly like Facebook and asks for your password.
The page isn't on Facebook. It's on a different domain with a similar-looking name, and whatever you type there goes straight to the attacker.
- Facebook doesn't threaten to delete your page over Messenger, from an account you don't know.
- Check the address bar. Anything other than
facebook.comormeta.comis not Facebook. - Urgency ("within 24 hours") is a red flag on its own.
What blocks it: two-factor authentication. Even if you type your password into the fake page, the attacker still needs the second code from the authenticator app on your phone.
Method two: "I sent you a code by mistake, can you forward it?"
A friend, or an account that looks like your friend, messages you: "I accidentally sent a code to your number, can you send it to me?" Your friend's account has already been stolen, and the code you received is the recovery code for your own account.
The moment you send it, the attacker changes your password, email and phone number, and you're locked out.
Never send a verification code to anyone, no matter how close they are. There's no real reason for someone else to need a code that arrived on your phone.
What blocks it: not sending the code. Using an authenticator app for two-factor authentication instead of text messages also makes the trick harder, because the code never arrives as a message someone can ask you for.
Method three: a password you use somewhere else
If your Facebook password is the same as the one you use on an old forum or shopping site, and that site's data leaks, attackers will try it on Facebook, on your email and on every other account you have. This is automated and happens to millions of accounts every day.
Something similar happens when you install "cracked" software or unknown browser extensions. Some of them steal the passwords saved in your browser along with your open login sessions.
What blocks it: a different password for every account, a password manager to remember them for you, and never installing software from unofficial sources.
Check your account now
Even if nothing has happened to you, take five minutes to check these places under Settings & privacy → Settings → Accounts Center → Password and security:
- Where you're logged in: if you see a device or city you don't recognize, log it out right away and change your password.
- Two-factor authentication: turn it on and choose an authentication app.
- Recent emails: shows the security emails Meta actually sent. Any "Facebook" email you can't find here is fake.
- Turn on two-factor authentication with an authenticator app today, not tomorrow.
- Save your backup recovery codes somewhere safe, off your phone.
- Never send a verification code to anyone, even your closest friend.
- Change your Facebook password if you use it anywhere else.