Believe me, I never expected to ever write a title like that on a Stack Exchange site either!
Yesterday evening I got a call from my mother. She is quite tech savvy and generally knows her way around spam and viruses. However, yesterday she was startled: she got an email from Facebook thanking her for her purchase of 40 dollars worth of poker chips in the Facebook game TexasHoldEm. She was ultimately sure she had never done a purchase like that, but she was worried she had lost money one way or another.
The email seemed genuine. Logo, text, sender, and links all pointed to genuine Facebook resources. I decided to take a look and followed the link to the 'receipt'. A payment overview at Facebook.com opened and everything was documented as the email had stated: her account had acquired 40 dollars worth of poker chips in the app (game) TexasHoldEm. Surprisingly, though, those chips were paid with a PayPal-account registered to an email address we have never heard of:
This is odd for two reasons: we live in Belgium, but have no relation, friends, family or otherwise, in Germany. Second we know no one by that name either.
At first I thought it may have been an error on that person's side, or that it is simply possible to 'donate' chips to someone else's Facebook account. But this would allow app developers to spam people who had never used their app with free gifts, so this seemed unlikely.
I then checked her account's recent activity, more specifically the 'recent sessions' tab. To my surprise there was indeed an active session in Düsseldorf, Germany. As a panic attack, I immediately ended that session. Unfortunately that also hid the information about that session. For me this meant only one thing: her account must have been hacked, as she hasn't been to Germany and there is no way there could be an active - poker-playing - Facebook instance there.
In light of this, I urged her to immediately change her password. After that, Facebook seems smart enough to know you made the change because you thought something was wrong: it proposed to go through her recent app activity and post and possibly deleting strange behaviour. Indeed, the app TexasHoldEm had been used, and there had been four posts (of the app on her behalf) that she had been playing the game - going back one whole week.
As a conclusion I would think that someone hacked my mother's account, played poker on it and paid for chips him/herself and ... That's it. Maybe I am getting old, but isn't this weird behaviour?
Why would a hacker do this: hack some one's account, buy poker chips with their own PayPal account, and play the game? And how can I better protect myself against such 'attacks'?
The poker chips were for Zynga's Poker game on Facebook. As has been mentioned in the comments, you cannot withdraw won money from this game. This is valuable - and intriguing - information which makes understanding the hacker's motives even harder.