Facebook phishing scam says you’re a ‘Trusted Contact.’ Don’t believe it

If you get a message from a Facebook Friend telling you they urgently need your help accessing their account — pause, because someone’s trying to use Facebook security against you.

Access Now yesterday revealed details of the phishing scam that has apparently claimed a few victims recently. It’s basically an attempt to con you into handing over your account codes to someone you think you can trust.

The attack is initiated by someone who has already taken over the account of a friend. They send you an urgent message claiming to need help getting back into their account, and to check your email for a recovery code. At this point, they try to log into your account using the “Forgot my password” button. The idea is that, when you check your email and see the recovery code from Facebook your scammer triggered, you’ll send that code and thereby give them access to your account.

This capitalizes on a security feature from 2013 you might not know about. Facebook has a feature called “Trusted Contacts,” which allows you to choose 3-5 friends who you trust to help you recover your account in the event you get locked out. The scammer claims you are one of their contacts, and a cursory search on your part will tell you the feature is a real thing even if you’ve never heard of it. It’d be easy to get sucked in.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!

One easy way of avoiding this scam is to contact the person whose account is messaging you — via phone call, ideally, in case their other accounts have also been taken over. If they don’t know what you’re talking about, then that’d be a clue. Also, it helps to know exactly which Friends have you as their Trusted Contacts, so you’re not taken by surprise.

Another giveaway is the information they request. When you get locked out of your account, your Trusted Contacts don’t just send you a recovery code — they each send a part of a recovery code. You need a part from all of your Trusted Contacts in order to get back into your account. So it won’t look the same as the recovery codes you would use on your own account.

We’ve contacted Facebook for comment.

TNW is hosting a flagship event in New York City in December. It’s going to be ? Click here for more info on the amazing speakers, the venue, and how to request an exclusive invite.