Cyberattacks are multiplying, and with them we detect a significant increase in attempts at scams and digital deception. Users not only need to be aware of these maneuvers but also learn to recognize the most common vulnerabilities. A question asked too often (perhaps with some malicious intent) is how Facebook accounts get hacked. Our goal today is not to explain that, but to teach you how to defend yourself against a hypothetical attack and keep your profile protected.
Weak passwords: the most common entry point
It seems unbelievable to have to explain this, but if a user ends up with their Facebook account hacked, the most likely cause is that they used a weak password, or worse, reused the same password across different services. If one of them suffers a breach and credentials leak to the web, your entire digital life could be exposed.
The first line of defense is to change your password to a much stronger one, and use a password manager at the same time. Earlier we shared a list of the best ones on the market, but personally I believe KeePass stays a couple of steps above the rest, thanks to its free, open-source, and offline profile.
Another essential resource is the site Have I Been Pwned, which helps you check whether your email addresses appear in leaked databases. If you can't replace your emails, at the very least make sure every service that uses them for login is protected with strong passwords.
Phishing (emails, pages, calls, etc.)
An email claiming to be from the "Facebook security department", an "emergency" in your bank account, a social media profile announcing you've won a giveaway, warnings about possible leaked photos, alerts about account closure... we've read and heard it all. Welcome to the world of phishing, one of the most effective methods of social engineering.
The idea is simple: rob you of something. Credentials, numbers, codes, accounts, whatever. Some attackers use fake emails, pages, and profiles. Others bet on vishing, voice phishing, or voice solicitation, with more direct interactions like phone calls or voice messages.
The most important thing to understand about phishing and vishing is that it's about human security. The vulnerability is you, and with that in mind, there are some points you should never lose sight of:
- No one is going to call or contact you without explicit prior consent. Not Facebook, not Netflix, not Spotify, not Starbucks, not your bank, not your internet provider, not the IMF (it's happened to me), not Nigerian princes, not Bill Gates, not Elon Musk. No one. You must assume all these attempts at communication are malicious and looking to steal something from you.
- Don't open any suspicious email, don't click on any strange link, and don't download an attachment if you can't verify its origin.
- Never enter or share personal information, especially in pop-up windows. No real company will ask you for data this way.
- Look for spelling errors or translation problems. A hallmark of phishing is that many attacks are low quality and ignore basic details like spelling.
Man in the Middle (MITM)
We love free public Wi-Fi, why deny it? It keeps us connected, helps save data on our plans, and has gotten us out of a jam several times, however... it's not necessarily secure. The Man in the Middle concept applies to many cases, but here we must imagine a fake or compromised Wi-Fi network run by a malicious element posing as a public Wi-Fi network. It doesn't matter exactly how: if the attacker knows what they're doing, they can listen to/log everything that goes through their network, including Facebook and other social media credentials.
The ideal would be to avoid public Wi-Fi networks altogether, but we must be realistic: at the very least, make sure the available network is trustworthy (asking for the network name at an establishment never hurts), and try to use a VPN for the most sensitive connections. Here are four free options if you don't know where to start.
Keylogging
By far, the worst case. The presence of a keylogger equates to a compromised device, and the same goes for all services you've accessed. As the name suggests, the keylogger records everything that goes through the keyboard, from usernames and passwords to card numbers and security PINs. If someone installed a keylogger on your computer, they're after much more than just hacking your Facebook account.
It's technically possible to recover from an attack like this ("nuke and pave", changing all passwords on all services, and extreme vigilance to detect strange movements in online banking and other profiles), but the best defense is to prevent the keylogger from being installed in the first place.
- Once again, distrust any download link or strange attachment you might receive. Try to verify its origin. Ask.
- On mobile devices, avoid alternative keyboards developed by companies without reputation. The Play Store is in a constant battle against malicious apps looking to steal information, and there's always a keyboard with gifts in the background...
- The security of current operating systems has improved a lot, but it's never a bad idea to add an additional protection tool. Malwarebytes remains one of the most recommended, and it has a complete article dedicated to keyloggers.
- Shared computer? Check USB ports and other details. We've already heard stories about mysterious hardware in the past...
How Facebook accounts are hacked: In summary
Some attackers focus on one of these strategies. Others apply a combination of all of them, but to gain access to a Facebook account, the most likely approach is to try weak passwords and aim for phishing. Of course, this isn't limited to Facebook. You should also think about Twitter, TikTok, Instagram, Discord, Twitch, and everything that's of interest to you online. Good luck!
