15 ms·
Facebook activated my dormant account and won’t let me deactivate it
- Nugem_ 10y agoI uploaded a picture of my driver license with my finger covering my D.O.B. and address. They responded by deleting my account I was locked out of and did not want online any longer.
- rmcfeeley 10y agololol
- Velox 10y agoWhat would the alternative be? Allow anyone to request that an account is deleted? Facebook needs some form of verification due to the password being breached (and its great that they are checking for that sort of thing)
- bigbugbag 10y agoThe alternative would be to actually delete the account as it should have happened in the first place when the user requested it years ago.
- mimi89999 10y agoSend a verification email as for a lost password?
- xmattx 10y agoAdditionally, the only info they need is your name, birthday and photo. Anything else can be blocked out. I don't really consider that 'giving them my government issued id'.
- JasuM 10y agoRequiring the same standard of verification for activating an account. Of course, they want to make it easy so it's unlikely to happen...
- wodenokoto 10y agoIf he knew his password he could deactivate the account using the same standard of verification as was used for reactivating it.
- djrogers 10y agoHe does know it, but Facebook is requiring that he change it before deleting his account.
- a3_nm 10y agoThe alternative would have been for Facebook to close the account in 2012, as the user wanted.
- SippinLean 10y ago>Allow anyone to request that an account is deleted? "anyone" with the proper access credentials?
- jmcdiesel 10y agoWhen said credentials have been leaked elsewhere, they aren't "proper" anymore.
- adam12 10y ago> What would the alternative be? Not to re-activate an old account without email re-verification.
- darkFunction 10y agoFor those who still have access and don't just want to deactivate- https://www.facebook.com/help/delete_account https://www.facebook.com/help/delete_account
- bigbugbag 10y agohttp://www.accountkiller.com/en/ http://www.accountkiller.com/en/
- deadbunny 10y agoMy guess is that someone is using password db dumps and then using those credentials to login to Facebook accounts, in this case it reactivated it. TL;DR Don't use the same password on multiple accounts, no matter how "unimportant".
- flipp3r 10y agoFairly sure someone is. I haven't been using FB for months and last week received a "messenger sign in code" SMS from FB. (I use LastPass btw with each site their own pw, I highly doubt they need your actual current password to login)
- developer2 10y agoPhone number reuse is also a major pain in this scenario. If your mobile phone number has ever changed, you still likely have the old number registered with many sites. The SMS you received may not have been for your Facebook account, but rather for someone else's account using your new phone number that used to belong to them. The number of sites that use - sometimes even requiring - SMS as a backup authentication mechanism, even while you use a separate authenticator app, is astounding. Cell phone number recycling is just as bad as email addresses.
- NietTim 10y agoYep - my rockstar account was 'hacked' a few weeks ago and I now have a fancy eastern european looking username
- nthcolumn 10y agoThey got your hackernews account also NoTim?
- deleted 10y ago[deleted]
- averagewall 10y agoSince his Facebook account is clearly important to him, he shouldn't have reused a password that he shared with unimportant sites.
- bcraven 10y agoNo I think you've missed the point, the _account_ is unimportant: "I do not want an account on Facebook. I have been happy to live without Facebook for the last 5 years." What is _important_ is the fact that it was activated without any user input, and can't be deactivated without handing over quite substantial trust.
- crottypeter 10y agoGP has not missed the point. The deactivated account should have been secured with a decent password (if the "lack-of-an-account" was important). It wasn't reactivated without any user input - or at least we can't possibly know that. We just don't know who the user was who did the reactivating.
- bigbugbag 10y agoDecent or not is irrelevant to the triggering of the breached credentials. You could have the best possible password ever, once you give it to a service that stores it plain text it's game over. The actual password issue here is password reuse and what should have been done is not having a facebook account in the first place. Is it even possible to get out of facebook once your data is in there ? The user being the account owner, we do know (provided we trust him) that it was not him so yes it was reactivated without any user input. From what I gather it could be that email/password was used on another service that got breached and either a bot or someone trying all those breached credentials on facebook caused the reactivation, or a relative that knew the user/pass or facebook trying to collect more personal data on old inactive accounts and inadvertently getting exposed once again.
- falsedan 10y agoPlease don't blame the user for this terribly-unfriendly UI flow.
- krashidov 10y agoIs this a possible phishing attack?
- rmcfeeley 10y agoI can't see link without... drumroll... Having Facebook DO U HAV FACE
- rmcfeeley 10y agoWhat could possibly go wrong?
- webignition 10y agoIt may not be Facebook themselves that caused the account reactivation. I'm was very recently in a similar situation having a Facebook account that was deactivated about 5 years ago (I thought I had deleted it). I received the exact same account reactivation notification email as in the article and I also started receiving photo post notification emails. Upon attempting to sign in to my Facebook account to investigate, I was presented with a screen informing me that my account had been locked due to recent suspicious activity. In my case I did recall my password and as such didn't encounter the ID verification process. I was presented with the details of the most recent login which was shown to be from a Samsung phone and from a Russian IP address. I have never owned a Samsung phone nor have I ever visited Russia. My girlfriend's Facebook account was also recently accessed in similar suspicious circumstances. I suspect that account credentials acquired from breaches of non-Facebook services are being used to attempt to access Facebook accounts.
- csydas 10y agoI would suspect a similar circumstance for the author's situation. Facebook does do some weird things to try to resume user engagement, but I've not really seen them re-active accounts on their own. More than likely it was password reuse resulting in a breach. The Author even considered that the password was checked by some automation against sites like haveibeenpwned, which makes sense to me to some degree for Facebook to be actively checking against, but they seem to dismiss this in favor of a spying option. I agree that having to submit a government issued ID seems a little incredulous for being able to deactivate the account, but as others have suggested, I'm not really sure how else the author can prove they are who they say they are. It seems that any such approach would be equally egregious to the public eye (i.e., anyone can make a fuss and shut down a facebook account), but certainly there must be some middleground, such as multiple authentications. A lot of the sanity checks used by companies are pretty unreasonable for most users to remember or pass - Microsoft and Skype, for example, have basically locked me out of my main skype account; their recovery challenge was to name the exact account names of 6 of my contacts as well as the the last two group chats I had been a part of. Since I hadn't used the account in about 2 years, this was really difficult for me, and the account names were even more difficult since people were using handles instead of real names, so the exact formatting was all but forgotten. Riot Games Inc. had similar methods, asking "what was the first skin you were gifted and who gifted it?" when my friend was trying to recover their hacked account. That was stuff that had occurred years ago, and we had no idea who gifted what and when. Again, I don't really pretend to have a good solution for these scenarios, but such solutions seem like they're just obstacles for the actual owner instead of neerdowells that overtake accounts.
- I_am_tiberius 10y agoSeriously, after 5 years they still have your account information? Are they completely nuts?
- kalata 10y agoOn Facebook, there's a difference between "deleting" and "deactivating" your account. OP did the latter, in which case it stays in the DB but is made invisible to everyone else. All you have to do to make it a normal, visible account again is simply log in. Deleting is a different matter.
- I_am_tiberius 10y agoI deactivated my account in 2010. At that point in time the only option was deactivating the account. Not sure what I should do now.
- mcbridematt 10y agoI have an email from when I _deleted_ mine (September 2010): Subject: Account scheduled for deletion "Hi Mathew, We have received a request to permanently delete your account. Your account has been deactivated from the site and will be permanently deleted within 14 days. If you did not request to permanently delete your account, please login to Facebook to cancel this request: http://www.facebook.com/login.php http://www.facebook.com/login.php Thanks,The Facebook Team" I know there was a difference between deactivate and delete, deactivate tried to guilt trip you ( like this http://mashable.com/2009/07/22/facebook-deactivate-account/#nnbTKGwVT5qn http://mashable.com/2009/07/22/facebook-deactivate-account/#... ) whereas delete had some hoops on the form to jump through. I've just checked by attempting to log in - "The email address you entered does not match any account"
- I_am_tiberius 10y agoUnfortunately, I don't have the email I received anymore and can't remember what exactly the content of the account deactivation email was. Most probably the same as yours though. I have the feeling that checking if the account still exists by trying to logon is: 1. not a good check 2. maybe conra-productive because they now maybe assume you are interested in getting back your account.
- cocktailpeanuts 10y agoAt least they emailed you about it. In my case they reactivated it for some reason and I had no idea for months until someone told me they saw my Facebook page. I had just deactivated because I wanted to take a break from all the fake relationships, but I never really hated the company itself. But now that I know this company just does whatever they want and doesn't care about the contract with their users, I despise them with passion. It's one thing to change privacy policy, but reactivating someone's account without permission when he clearly has deactivated is almost illegal. I ended up completely deleting my account (that's different from "deactivating". It's actually all gone (hopefully) I'm sure there are many people like me and OP out there. It's sad that people can't do much about it as individuals even when their privacy is fucked with.
- tedunangst 10y agoWell, if you give somebody your facebook password and they reactivate your account, shouldn't you be angry with that somebody?
- cocktailpeanuts 10y agoWhere did i say I gave someone my password? I said it just got re-activated automatically without me knowing. No one else other than me knows the password. And I never got a notice. I am angry at you.
- jmcdiesel 10y agoFB doesn't just randomly reactivate accounts... If your account comes back, it was probably compromised. Spammers and scammers look for deactivated accounts because i will be longer until they are discovered...
- alvil 10y agoI'm in the same situation, I didn't use my account several years. Than I tried to login, and account is locked. I was asked to send my ID. I did it. Now I'm waiting fifth month to unlock it and nothing happens. They have my ID, I don't have account access.
- megous 10y agoHa, Facebook UI without logging in is the stupidest. Help center behind a login, emails that can't be unsubscribed from from the email without login, stupid popup that blocks the view every now and then if you're logged out... I'm tempted to try logging in if they really deleted my account after I requested it.
- bigbugbag 10y agoBreaking news: they delete nothing, at best outside access is disabled.
- megous 10y agoI don't hold my breath either. I marked all content as removed, before deleting the account, and removed all advertising topics, and yet after a month of not using FB, the advertising topics were re-generated as if the old content was there. Also a few posts that I marked as deleted popped back in and were showing again. But nevertheless, they advertise that they actually remove the content, when you delete the account (saying it can take a few months before they prune all the backups from it), so it would be fraud if they did not. Also EU, there's a right to delete.
- aftbit 10y agoI'm surprised nobody has said this yet: tweet at Facebook, or contact their support.
- ardaozkal 10y agoSupport's at help center which needs login. Facebook afaik does nor have twitter support.
- mintplant 10y ago> I am concerned that they knew that I used this password on several different sites. How did they know that? I suppose they keep an automated list of passwords that have been hacked on other sites, when those hacked passwords are made public? If so, that much is reasonable. A clear demonstration of how users don't read error messages, as the screenshot that appears above this paragraph spells out the exact method the author suggests.
- sleepychu 10y agoand at the bottom of the page: > You can also try other challenges to confirm your identity.
- a3_nm 10y agoThe identity challenge does not matter: you shouldn't have to confirm your identity to protest against the reactivation of an account you intended to close. The point still stands: OP intended to close their account in 2012, and are now being signed up again without their consent.
- wodenokoto 10y agoOf course you should. Else anybody can close accounts that have been purposely reopened.
- llukas 10y agoNo. Instead of reopening account on a whim require id when account is being reopened.
- crottypeter 10y agoFrustrate returning customers ... not a great idea
- 10y ago
- davewasthere 10y agoPretty obvious your leaked email/password (from another website) was tried against facebook. And while I agree with not likely to upload photo of our driver's licence/etc.. it's pretty likely this is really just to verify that it's your account to delete (although I'm sure you could photoshop something that passes pretty easily if you were malicious) and it sounds like they remove that proof of identity pretty securely afterwards.
- tokenizerrr 10y agoThey say: > We aren't aware of any suspicious login activity on your account So they admit they don't think anything is going on, even. Facebook is just punishing the author because they committed the sin of password reuse. And the punishment for password reuse is apparently demanding ID before allowing the author to do anything with the account that belongs to them. Even though they control the email address associated with the account.
- crottypeter 10y agoThey aren't aware of suspicious activity because they think OP reactivated his own account!
- tokenizerrr 10y agoSo supposedly OP was allowed to reactivate the account without any hassle at all, but then to actually sign in ID has to be shown? That is even more ridiculous since that just leaves the account in a limbo state for no reason at all. Should have asked for ID prior to reactivating if going down that road.
- lazyjones 10y ago> So supposedly OP was allowed to reactivate the account without any hassle at all, but then to actually sign in ID has to be shown? That is even more ridiculous Try to think about it without all that negative mindset. Someone quite obviously obtained the (careless) author's password from a leaked user database of another site. They used it to log on to FB and reactivate the account. That isn't suspicious, because the last login IP address FB had is 5+ years old and having a different one now is not unlikely. Then, the author logged on with his IP address - which was suspicious to FB, because they thought the legitimate owner of the account had recently logged on using a different IP address (perhaps even from a different country). In addition, it took him several attempts to get the password right. Therefore, they demanded some ID.
- lutusp 10y agoLet's call a spade a spade -- these people are parasites. After reading the linked article I ran a generic inquiry and discovered that "Paul Lutus is on Facebook[1]." False and annoying. I suspect this is how Facebook can claim to have so many followers. I'm sure there are many dead people who are "on Facebook" too and, by virtue of being dead, less likely to object. 1. https://www.facebook.com/paul.lutus https://www.facebook.com/paul.lutus
- crottypeter 10y agoNo they didn't! go back and read your own post and the screen shots.
- deleted 10y ago[deleted]
- 01000001 10y agoThis is why every site should have it's own unique, strong password.
- raverbashing 10y ago"its own" And yes it should, and expendable passwords because the world is filled with morons who "encrypt" your password with rot13 or one round of unsalted md5 (but your better follow their "strong password rules")
- 01000001 10y agoThanks for the correction. You know, I was once taught, quite poorly, that the apostrophe is used for possession, and when I'm not mindful about it, my brain makes this jump that when referring to something that "belongs" to whatever "it" refers to, that it therefore possesses this thing and therefore should have an apostrophe. If I think about writing, I write its, but when I'm thinking what I want to write and my fingers just type it, it is like a layer of execution intercepts that thought and correct it. I guess that's just the brain and one of its features, it's nuts. Getting back to the subject, this is one of the biggest issues, idiots who hold our data and yet don't add salts to their encryption because salt is bad for you.
- ClassyJacket 10y agoThat works great until you have to actually remember it.
- intoverflow2 10y agoNoticed that they've started sending me notification emails about things my friends connected to my account that was deactivated for 4+ years. I was worried it had been hacked and activated by someone so I logged back in. Nope, so turned off the emails and "deactivated" it again.
- raverbashing 10y agoI'd say upload some crap as the photo id and let the minions deactivate your account for 'abuse' Edit: just saw that was done. Let them play their stupid game like they're important. Does power hungry Mr Z thinks he's some kind of police to ask for a photo id?
- gargravarr 10y agoThis is concerning since I had assumed the data contained in 'inactive' accounts would eventually be deleted. I closed my own account in 2011 because I found no benefit to having one. Given how difficult it was to close my account the first time around, I'm now expecting to receive a similar email. Why would they hold onto all this data for years after the account was closed? They're not going to be able to glean anything else from it. If necessary, I'll pull a Data Protection Act request on these goons.
- bigbugbag 10y agoYou certainly fooled yourself in assuming that, it is, at least I thought it was, common knowledge that facebook does not delete a single thing ever they just disable it for user access. I seems to remember this was exposed a few years back with the introduction of a "past memories" features or something that mistakenly took some of the supposedly deleted content and put it in the spotlight. They hold onto this data because: 1. You gave them full legal rights to do so by agreeing to their ToS and giving them full ownership of everything ever collected on you by facebook. 2. Exploiting user data is how the make money. (well that and investor story time).
- type0 10y ago> ... common knowledge that facebook does not delete a single thing ever they just disable it for user access. That is correct, I remember there even was a presentation video from one of FBs engineers describing exactly that, also that they intended to burn that data to long time storage archival discs (probably already are). I have no time to look for that video but if someone knows what it was called please link to it, it should be somewhere on the youtubes.
- ageofwant 10y agoA few egregious interracial mano-a-mano "mature" midget porn pics sprinkled with a collage of pre-teen bikini pics (A 12 line python script). And a pre-cooked rant from some Nazi site about negros and bitches and negro bitches was all it took to get me out. Some concern from family and friends but a "Yea, got hacked, be careful out there" took care of that. Make the system work for you mate.
- lazyjones 10y agoYet another situation that proves it's not reasonable to let users keep their account information/data for an extended period of time when they don't use the service. FB should provide backup/restore functionality for account data and delete accounts after N months of inactivity. They should require e-mail confirmation for logins after N weeks of inactivity and any suspicious logins. The author of the article is lucky that he still owns his geocities.com e-mail address, many such old domains have been sold and re-used. Inactive/Dead accounts are useful for bragging with account numbers, but for users they're just a risk and burden.
- forhisown 10y agoIt said that the email and password was shown to be the same as a compromised account so may well have been activated by a malicious party. Don't reuse accounts and don't consider Facebook to be unimportant even if you don't like it.
- matrix2596 10y agoDeactivate is different from delete. They knowingly only show deactivate which keeps the data, the link for delete is not immediately accessible from their site. https://www.facebook.com/help/delete_account https://www.facebook.com/help/delete_account
- bigbugbag 10y agoNot helpful in OP case but for those in need of how deleting accounts on various services, accountkiller[1] will provide the info you need. About facebook account deletion: Publicly visible text/images often aren't properly deleted even when you succeed in deleting an account. Try editing or deleting them manually before deleting the account itself. If you're unsure what happens to your tracks: this can be found mostly in the Terms of Service/Privacy Policy; otherwise you can always contact Facebook and ask personally. By the way, deletion requests don't necessarily mean your data will actually be deleted (e.g. due to legal obligations). [1]: https://www.accountkiller.com/ https://www.accountkiller.com/
- macleanjr 10y agoTo echo others in this thread, the same happened to me. The account was deactivated in 2009, and I used a password that I know to have been compromised in hacks of other services. After several weeks, I got an email yesterday telling me that due to no further suspicious activity, they unlocked the account without Photo ID verification. I went in and scheduled the account for deletion.
- awinter-py 10y agoDoes anybody have conversion stats for the facebook signup process? What's the dropoff rate when it wants to scan your driver's license? Do they do this in every country? Do they do it on mobile? I'm more disturbed by 5 year data retention than the crappy verification step.
- developer2 10y agoThe request for ID is certainly not standard across all accounts and situations. My guess: the account reactivation came from a different location than OP's home country/state, or OP themselves moved states/countries in the past 5 years. The account being reactivated from a different location would certainly be cause for alarm. This would be a reasonable check in my book, as it is the best way to fight against compromised credentials - you know, the exact situation OP finds themselves in for having reused their Facebook password on other (previously compromised?) sites. What the OP doesn't seem to understand is that the attacker may have been able to technically "reactivate" the account, but they also probably can't actually gain access until they provide ID. This ID requirement has likely saved the OP's account from actually falling into the attacker's eager hands. OP is complaining about the privacy implications of a compromised reactivation by an attacker, and sour they are being asked to prove that they are not the attacker. Take off the tin foil hat, stop crying foul, be grateful Facebook seems to have saved your password-reusing ass, send them the ID, and then delete the account instead of deactivating it.
- awinter-py 10y agoemail verification would have also stopped reactivation in this case.
- ojr 10y agoFacebook has credit cards on file, it is not surprising to me you need to confirm your identity on a platform that takes payment information. In software products, it is safe to assume that they'll be dealing with payments of some sort, so it is best to not even sign up for services, also since your real identity is what advertisers want to sell to which keeps the product free.
- turc1656 10y agoThe author claims the request for ID is an "invasion of privacy"? Such a claim is absurd. A request for something is not an invasion of privacy and never is. He can simply decline to provide the information - which is the path he took. The ability to take such an action makes it a decision. He just doesn't like that his account is not in his control. I get that. The situation sucks. But guess what - too bad. He never owned his account in the first place. That information belongs to Facebook and is the property of Facebook. Also, the Facebook page clearly says to block out everything except the photo, name, and birth date. This is information Facebook already has and the photo upload is simply for verification purposes. This makes his claim of privacy invasion even more ridiculous since he already gave them that information years ago.
- jmcqk6 10y ago>He never owned his account in the first place. That information belongs to Facebook and is the property of Facebook. Don't you think that was part of the point and part of the problem?
- johnmc408 10y agoI am in this situation as well...Facebook does not have my picture or real age. They do have my correct name and I still have the original registration email. I don't want to upload my ID as I can't see how it will do them any good...of course I can't get in to my FB account though ;-)
- thunder-ltu 10y agoI am so glad I've deleted my Facebook account a long time ago. A request to provide a photo ID for a social network platform just shocks me. Welcome to the Orwellian world, dear people...
- madchops1 10y ago1) your acount shouldn't have been reactivated 2) but If you could get an account deaactivated without proving who you are, then that could cause a lot of issues.
- tobyjsullivan 10y agoTL;DR: Author reuses same password for most websites. Password was leaked. Attackers likely used password to try and login to his old FB account, causing it to reactivite. Facebook has protections which prevent attackers from accessing account based on stolen password alone (no doubt preventing further damage from attack). Author is annoyed by this.
- dwg 10y agoNice summary, but it downplays the issue. The author has no remedy other than sending a photo ID. Why is an account able to be reactivated using a password known to be compromised? Perhaps Facebook should require an ID _before_ reactivation if the password is compromised, instead of the other way around.
- gfo 10y agoTo preface my comment, I don't like the idea of providing government-issued ID either. I'd like to see their privacy policy regarding the storage of the ID and if they collect the info from it. Having said that, I'm almost glad this measure is in place. Assuming the account was only deactivated and not completely destroyed (and let's be honest, they likely never completely destroy all data on a user) an attacker can very easily assume the identity of that user as well as invade the privacy of their friends who have an account but lock down info to only their connections. What I'm trying to say is, showing ID seems extreme, but given the amount of power you gain by getting access to someone's Facebook account today, it doesn't seem entirely unreasonable.
- NOSHSHNACKERS 10y agohappend to me too. I am in the process of trying to create as many accounts in my name as possible to drown out the original one I cant acess anymore that is now active. Oh an suck a f uck Fb
- giancarlostoro 10y agoAlso I don't think he actually deleted his account but deactivated it and mistook that for account deletion. I've deleted my account on numerous occasions, once it's gone, it's gone from the end user perspective (whatever FB actually does on the back-end is not truly promised I assume).
- ChuckMcM 10y agoSeems like an interesting way for law enforcement to get a picture of someone they don't have on record :-) (ok that is pretty paranoid). I would probably hit them up with a 'Right to be Forgotten' cease and desist letter demanding facebook remove everything they have associated with the account.
- glitcher 10y agoI used Facebook briefly years ago as part of a job requirement, but the account sat stagnant and unused for a very long time. Recently I thought I would login just to see if the account was still there, and found that FB had deactivated my account. The only path to reactivate the account is to send them my government issued ID. In my case it doesn't matter because I don't want to reactivate the account anyways, but if things were different I would be absolutely horrified at the thought of sending them my driver's license or passport photo.
- razorunreal 10y agoSimilarly (arguably worse) someone can create a drop box account using your email address and there is no verification nor mechanism to say that it is not yours. Their support will repeatedly bug you to use an automated system, and of course the automated system cannot fathom that you do not have or want an account. I think it took a couple of weeks for them to actually delete it. Alternatively you could try the lost password flow, log in and delete all the files belonging to the poor sap that made a typo. All the while, you hope none of those files were intended for you.
- giancarlostoro 10y agoI see another problem: The OP thought he deleted his account, but actually deactivated it. I've deleted my account before, even in the last few years and it requires a specific link from the FAQ, otherwise you only get a deactivation link, it takes about 2 weeks, if you login after the 2 weeks, you will not get an account back. If years passed and you can still somehow get a response from FB about your account, you didn't delete your account, you deactivated it. Edit: It seems this is common enough to be in the FAQ as well: https://www.facebook.com/help/359046244166395/ https://www.facebook.com/help/359046244166395/ How to DELETE your account (will take about 2 weeks or so DO NOT LOG ON TO YOUR ACCOUNT or it will cancel the arrangement): https://www.facebook.com/help/224562897555674?helpref=related https://www.facebook.com/help/224562897555674?helpref=relate...