It's probably worth clarifying that a "compromised login" means "you know the username and password for an account, but we suspect you may not be the actual acc

It's probably worth clarifying that a "compromised login" means "you know the username and password for an account, but we suspect you may not be the actual account holder." Basically, knowing someone's username and password is not enough to get into their Facebook account. Every time this happens, we don't let the suspicious login into the account, and instead make them pass some additional authentication challenge. Often this involves a "social captcha" (see http://lifehacker.com/5743872/facebook-experimenting-with-social-captchas-for-authentication http://lifehacker.com/5743872/facebook-experimenting-with-so... or https://www.facebook.com/blog.php?post=486790652130 https://www.facebook.com/blog.php?post=486790652130), which basically tests that you are the account owner based on the shared knowledge of who your friends are. Accounts are often compromised outside the facebook ecosystem (via phishing, malware, sharing their password with a site that was compromised, etc). I think the fact that we catch so many is actually pretty awesome. A more-accurate (but less link-baity) headline might be "Facebook prevents 600,000 compromised logins / day."