0

My Facebook account has had its password changed four times today, and I'm wondering what to do.

The first time, was at 5:02pm. I received an email saying that my password had been changed. I recently moved to Canada (from Australia), but the email informed me that someone from Perth, Australia had changed my password. At 5:08pm, I had changed my password again; nothing particularly secure, but I added five symbols and numbers to the end of my previous password. I figured that putting up some small roadblock might make them stop targeting me. I got facebook to log me out of every device, and checked my recent activity, and confirmed they hadn't managed to do any other damage.

The second time was 5:35pm. Now the login came from Sydney, Australia (all the way across the country). I responded at 5:43pm. Again, I logged out of every device, made sure they had done no damage. This time I enabled 2-factor authentication, sending messages to my mobile phone. This is a step I have been reluctant to do for a very long time, for a number of reasons. I gave Facebook my brand new Canadian mobile phone number, and it did start sending me codes when I logged in again. I also chose a very long password; it was a sentence, but not a short sentence, and one that nobody would think to utter except me (including one word that is not a word). For good measure, I also enabled two-factor authentication on my device for my primary email, which is with gmail, in case it was being hacked (though Google usually informs me of unusual sign in activity).

The third time was 9:56pm back in Perth. Notably, I never received a text message from Facebook about the sign-in. I did receive a "Facebook account recovery code" to my email, but nothing to my phone. But, I did press the "If you didn't request a new password, let us know" link in this new email, at which point they locked the account.

The fourth time was 10:18pm. Again, an account recovery code was sent at the time. I don't know how they managed it, to be honest, because I'm pretty sure I couldn't log in at that stage.

So, I have some questions, and I'd be very grateful of anyone can help me out.

  • How is this possible? I thought two-factor authentication and signing out of all devices would be a silver bullet. How could they log into Facebook without my phone receiving a text?
  • Is it common for someone to be targeted like this? Why would they try four times in one day to break into my account? Or is the Sydney one a separate person, in which case, why would there be two people trying to lock me out of my own account?
  • What do you think they could have access to? Specifically, what devices/accounts must they have access to in order to pull off something like this?
  • Do I need to worry about them accessing my now locked Facebook account? I'd like to get some sleep soon, as I need to be up in 8 hours.
  • Are my devices compromised? Having both my laptop and phone compromised is the only way I can wrap my head around this. Is there any other plausible explanation, before I nuke both of them?
  • Basically, what can/should I do?
10
  • Change the password to your email account is the first thing that comes to mind. If I was a malicious hacker, I'd target your email because of password reset emails.
    – Jeroen
    Jul 20, 2021 at 6:20
  • @Jeroen Thanks, I just did that. Let me know if you think of anything else I could do.
    – user261535
    Jul 20, 2021 at 6:31
  • A thought occurs: does the email telling me that my Facebook password changed actually indicate that somebody had access to my account? Or could they be spamming "I forgot my password" requests to my email, and causing Facebook to reset my password?
    – user261535
    Jul 20, 2021 at 6:51
  • i doubt it was even from facebook, i get fake stuff like that all the time, and it didn't use 2fa.
    – dandavis
    Jul 20, 2021 at 6:59
  • @dandavis Maybe. It looked pretty authentic, and when I got genuine emails (specifying my location, right after changing my password), gmail added them to the same conversation. I don't really know this stuff, but is it possible for fake emails to blend into email chains like this?
    – user261535
    Jul 20, 2021 at 7:01

1 Answer 1

3

I'm not sure if this is worthy of an answer, but I think I have figured out the problem here (if not a way out of my predicament).

The issue is, I think, that someone in Australia has gotten access to an old defunct Australian number attached to my Facebook account. They are now using this number to obtain account recovery codes. These codes will make you choose a new password, then lead you to the account, which is locked. So, it is possible for the hacker to change my password, while still being locked out of my account (just like me).

What I need to do is somehow remove this number from my Facebook account. This is proving very, very difficult, as the Facebook help site doesn't seem to be working for me (including Facebook help desk), and most options seem to assume you still have access to your own account. However, I'm guessing that this is not a security.stackexchange problem.

I guess the takeaway from this is that you should not leave old phone numbers (and probably email addresses) attached to your accounts.

2
  • Yes, this does seem plausible and would explain all the details you mention.
    – schroeder
    Jul 20, 2021 at 18:22
  • @schroeder Thank you for the confirmation and your consideration. It feels better to at least have a handle on what is happening.
    – user261535
    Jul 20, 2021 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.