3 ms·

Reviewing their post: I was mislead by the bad wording. Their account is not deleted but disabled. Your friend needs to fill out this form: https://www.faceboo

Reviewing their post: I was mislead by the bad wording. Their account is not deleted but disabled. Your friend needs to fill out this form: https://www.facebook.com/help/contact/260749603972907 https://www.facebook.com/help/contact/260749603972907 It is not practical for FaceBook to have a video call with you every time your password is changed or you login with a new IP. Consider teaching your friend how to use a password manager and randomly generated passwords, and telling them to enable 2FA. Your account is only as secure as your password, and I can basically guarantee your friends account was taken over because of password reuse or phishing, both of which a password manager can curtail

richardw 4y ago
Thank you for taking the time! That’s very kind of you, so have an upvote. I’m advising him on recovery attempts but he’s away at a shoot until the 17th, which is a month after the hack. Let’s see if he can sort it. I think someone got an old email that was linked to his account. Instagram seems to have a fair approach here that does include some face video: “If you request support for an account with photos of you, you'll be asked to take a video selfie of you turning your head in different directions to help us check that you're a real person and confirm your identity.” https://help.instagram.com/368191326593075 https://help.instagram.com/368191326593075
- cmeacham98 4y ago
  From my understanding, they have until 30 days after disabling to appeal. That said, I don't know if appealing stops the clock on deletion, so I would do so ASAP. Facebook has a similar policy as well to gain access to an account (For Facebook, you have to show them a copy of your government ID). The problem is, if the attacker had access to the recovery email, they don't have to go through Facebook support. That's the point of the recovery email: to recover your account if you get locked out, access to it is taken as proof you are you. Also, it's possible your friend just forgot to mention it, but they _don't_ mention needing to reset their password after the attacker got in. If that's the case, that means the attacker got in with their password - i.e. they know the password. If they can try to login with their password and get "account disabled" (rather than "incorrect password"), and they didn't change it as part of attempting to recover their account, then they should assume that password is burned and need to change every account that uses it ASAP (and stop reusing passwords ;) )

richardw 4y ago

Thank you for taking the time! That’s very kind of you, so have an upvote. I’m advising him on recovery attempts but he’s away at a shoot until the 17th, which is a month after the hack. Let’s see if he can sort it. I think someone got an old email that was linked to his account. Instagram seems to have a fair approach here that does include some face video: “If you request support for an account with photos of you, you'll be asked to take a video selfie of you turning your head in different directions to help us check that you're a real person and confirm your identity.” https://help.instagram.com/368191326593075 https://help.instagram.com/368191326593075

cmeacham98 4y ago
From my understanding, they have until 30 days after disabling to appeal. That said, I don't know if appealing stops the clock on deletion, so I would do so ASAP. Facebook has a similar policy as well to gain access to an account (For Facebook, you have to show them a copy of your government ID). The problem is, if the attacker had access to the recovery email, they don't have to go through Facebook support. That's the point of the recovery email: to recover your account if you get locked out, access to it is taken as proof you are you. Also, it's possible your friend just forgot to mention it, but they _don't_ mention needing to reset their password after the attacker got in. If that's the case, that means the attacker got in with their password - i.e. they know the password. If they can try to login with their password and get "account disabled" (rather than "incorrect password"), and they didn't change it as part of attempting to recover their account, then they should assume that password is burned and need to change every account that uses it ASAP (and stop reusing passwords ;) )