Today when I logged in Facebook, no 2FA was shown.

I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately set it up again, and performed the security check (change password, check phone number, posts, comments) offered by the "Not me" log-in option.

Since I usually use Facebook on semi-public computers, the account might be hacked. Are there any other things that I should do to protect the account?

I assume that there should be some SMS confirmation before succeeding in turning off 2FA, but I received none. Should I worry my phone's security? Also, although I didn't reuse my Facebook account password on other sites, are there other credentials I have to change?

1 Answer 1


The authentication token/cookie was probably saved and you were not prompted to login in with 2FA/MFA. Normally changing 2FA/MFA settings requires you to input a new OTP again so unless you're second factor was compromised you're most likely safe in terms of access to the account - data can have been stolen/compromised. Also consider using an option that is not SMS for 2FA/MFA like an authenticator app or yubikey (U2F).

More information


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .