4 ms·

Thank you for taking the time! That’s very kind of you, so have an upvote. I’m advising him on recovery attempts but he’s away at a shoot until the 17th, which

Thank you for taking the time! That’s very kind of you, so have an upvote. I’m advising him on recovery attempts but he’s away at a shoot until the 17th, which is a month after the hack. Let’s see if he can sort it. I think someone got an old email that was linked to his account. Instagram seems to have a fair approach here that does include some face video: “If you request support for an account with photos of you, you'll be asked to take a video selfie of you turning your head in different directions to help us check that you're a real person and confirm your identity.” https://help.instagram.com/368191326593075 https://help.instagram.com/368191326593075

cmeacham98 4y ago
From my understanding, they have until 30 days after disabling to appeal. That said, I don't know if appealing stops the clock on deletion, so I would do so ASAP. Facebook has a similar policy as well to gain access to an account (For Facebook, you have to show them a copy of your government ID). The problem is, if the attacker had access to the recovery email, they don't have to go through Facebook support. That's the point of the recovery email: to recover your account if you get locked out, access to it is taken as proof you are you. Also, it's possible your friend just forgot to mention it, but they _don't_ mention needing to reset their password after the attacker got in. If that's the case, that means the attacker got in with their password - i.e. they know the password. If they can try to login with their password and get "account disabled" (rather than "incorrect password"), and they didn't change it as part of attempting to recover their account, then they should assume that password is burned and need to change every account that uses it ASAP (and stop reusing passwords ;) )

4 ms·

Thank you for taking the time! That’s very kind of you, so have an upvote. I’m advising him on recovery attempts but he’s away at a shoot until the 17th, which

by richardw 4y ago

cmeacham98 4y ago
From my understanding, they have until 30 days after disabling to appeal. That said, I don't know if appealing stops the clock on deletion, so I would do so ASAP. Facebook has a similar policy as well to gain access to an account (For Facebook, you have to show them a copy of your government ID). The problem is, if the attacker had access to the recovery email, they don't have to go through Facebook support. That's the point of the recovery email: to recover your account if you get locked out, access to it is taken as proof you are you. Also, it's possible your friend just forgot to mention it, but they _don't_ mention needing to reset their password after the attacker got in. If that's the case, that means the attacker got in with their password - i.e. they know the password. If they can try to login with their password and get "account disabled" (rather than "incorrect password"), and they didn't change it as part of attempting to recover their account, then they should assume that password is burned and need to change every account that uses it ASAP (and stop reusing passwords ;) )