Category: Phishing

Stolen Facebook Accounts

stolen facebook accounts

There is a large rise in Facebook Account Theft right now. I can’t explain the sudden surge, but for the last few weeks, I see people complaining about and suffering from stolen Facebook accounts almost every day. We need to go over the details, so that you are prepared and protected.

How Facebook Accounts Are Stolen

Your Facebook account can be stolen when a bad guy tricks you into revealing your password. Or, a cybercriminal can attempt to reset the password on your account, and then trick you into giving them the reset/authorization code. Then, they set a new password on the account, locking you out and giving themselves all the control.

To finalize the theft, the crook replaces the email address and/or phone number on your account with their own email/number. This makes it nearly impossible for you to recover your account.

Phishing emails are a common way to take passwords from people. Messages or pop-ups that look deceptively similar to real Facebook notices can pressure people to type in their credentials. But right now, I’m seeing a lot of password-theft happening via stolen accounts, using impersonation tactics. Example:

John Doe gets a PM from his cousin, Uncle Buck. “Hey, John! I’m having trouble with my Facebook account, and I need your help. Imma send you a code — can you tell me what that number is? It’ll help me reset my password, thanks!” John Doe thinks he’s helping his uncle, so he waits for the code to arrive by text message. When it comes, he types it in and sends it over.

But Uncle Buck isn’t Uncle Buck. A cybercriminal is inside Buck’s account, and when he gets the code, it allows him to finish a password reset on John Doe’s account. John Doe soon finds this out, when he is forced out of Facebook and cannot log back in. His account has been hijacked just like Uncle Buck’s.

How to Protect Your Facebook Account

  • Never share any security code with anyone. When a numeric code is texted or messaged to you, it is for your use only. In the wrong hands, that simple code can defeat the security of an important account. This goes for Facebook, Gmail, your bank login and any other online account you use.
  • Facebook offers some basic security tips at this page. Implement as much of their advice as you can handle.
  • Consider setting up additional security features for your Facebook account, like 2FA and login alerts. More info on that at this page.
  • If you get any fishy emails or PMs from people you would normally trust, pick up the phone and call the sender. Figure out if they really sent those message, or if you’re corresponding with some impostor in Scamdinavia.
  • Change your Facebook password at the first sign of trouble.
  • Review your Facebook Profile and make sure your Friends List, phone number and other personal info is not viewable by the public. The privacy level on that info should be “Friends Only”, or better yet, “Only Me.”

What to Do If Your Facebook Account is Stolen

  • Do not delete any security-alert emails that you receive from Facebook. They could be invaluable toward recovering your Facebook. When your password, email address or other sensitive info is changed on your account, you will receive an email. Each message will state: “If you did not make this change, click here.” Sometimes, clicking where indicated is your only hope of reverting the scammer’s change!
  • Try to recover your account at www.facebook.com/hacked . Alternate links and methods are at this page. I must warn you, though, this process can be time-consuming, frustrating and ultimately unsuccessful. Facebook has made this process difficult, and there is no easy way to contact them.
  • Contact people outside of Facebook, to let them know your account has been compromised. Tell them to not trust your account until further notice. Ask them to look at your account for any suspicious posts or content. If they see anything that looks bad, suggest to them that they report it to Facebook.
  • If you want to try to call Facebook, please know that it probably will not help. They do not want to answer the phone for non-paying customers, and at this time, you cannot yet pay Facebook for proper support. But I will give you their corporate numbers in California, just in case: 650-543-4800 and 650-308-7300. Please be careful seeking out other Facebook contact info, as most of the phone numbers you might see in a Google search belong to scammers.
  • There are many companies on the internet that claim to be able to recover your stolen account, for a fee. Most of these are fraudulent operations. Beware! But one company called Hacked.com seems to be legitimate. I can’t vouch for them 100%, but they have a significant internet footprint and reasonable reviews about the recovery services that they provide.
  • If all else fails, or the recovery process is too money or time-consuming, make a new Facebook account.

Relevant for Protecting Other Social Media Accounts

This post focuses on Facebook, as that’s where I’m seeing the most harm done right now. But the overall threat and advice is relevant elsewhere. LinkedIn, Instagram, Twitch, Twitter… Accounts can be targeted and stolen on many other social media websites, using the same tactics I’ve described.

And the amount of support you get (almost none) will probably be the same, if you are a free or non-paying user. I will help where I can, but I have no special abilities to get Facebook to do the right thing. It’s up to you to stay alert and not get in a jackpot. Stay suspicious, my friends!

What To Do About Phishing Websites

I am seeing a rise in phishing websites; here’s some info on what you watch out for!

When you use a search engine, cybercriminals can game the results. They have ways to get their fraudulent websites to rise to the top of the page, and one method for this is simply to pay for ad placement. Check out this example:

I went to the Bing search engine and typed in the name of a local credit union. The first three results look like what I wanted, but they actually go to phishing websites. These phishing sites seem like the real deal, and offer convincing graphics and login fields. But anyone duped by these impostors may end up giving their banking passwords to crooks!

Also understand: This type of phishing isn’t just for financial sites. Recently, Cory Doctorow was shanghaied by a phishing result for the Thai restaurant he wanted to order from.

Protections

To protect against this rubbish, first please be on the lookout for the small markers next to search results that say “Ad” or “Sponsored”. Ignore or bypass any search results with those indicia.

Consider installing a browser extension that judges and rates your search results. Bitdefender Trafficlight puts a marker next to search results, to let you know what’s good or bad before you click on anything.

Change your browser’s search engine. If you explore your browser’s Settings or Options, there will be a menu or other way to set your default search provider. Right now, I see Bing and Yahoo being exploited the most. Stay away from AOL or Ask.com. Google might be safer. DuckDuckGo appears to be a great and safe choice, for now.

Install an ad-blocker into your browser. I consider ad-blocking to be your second line of defense (after your antivirus), and good free ad-blockers are widely available. This sort of tool might suppress some of the sponsored links you might otherwise encounter.

Bookmark your financial and most important websites in your computer’s web browser. Use your bookmarks more and your search engine less to get to things you visit daily.

On mobile devices, bookmarks are good, but apps are better. If your bank or other important company offers a dedicated, branded app, use it! Download it from the app store and use it instead of loading their site in your browser.

Reactions

If you encounter a phishing website, consider reporting it. The sooner a bad site is reported, the faster it may be removed from the internet.

If you were duped by a fraudulent website, take action as soon as you figure things out. Change any passwords you may have submitted to the bad site, and contact any financial institutions that you may have shared or used when you were phished. If you haven’t already, ask your bank about activating 2FA protection for your accounts.

And in general, give the real company a heads-up about what you’ve encountered. They may appreciate knowing about the impostor efforts out there.

© 2023 BlueScreen Computer

Theme by Anders NorenUp ↑