Facebook user Aaron Thompson reported that a thief gained access to his account by simply sending the support team a fake passport to unlock his account.
The hacker accessed Mr. Thompson's personal and business information on Facebook. The social media platform quickly repaired the damage and apologized.
Mr Thompson, from Michigan in the US, learned of the chain of events leading up to the hack from an email from Facebook, titled: “Description of the problem you are experiencing.”
It included this request: “Hello, I no longer have access to my mobile number. Please disable the code generator and login approval from my account. Thank you…” In reality, this email was not sent by Mr. Thompson, but by a hacker.
Facebook responded with a message, advising the fraudster to send a photo or scan of their ID to “verify that they are the account owner.” That image was also forwarded to Mr. Thompson’s email account with the reply: “Thank you for verifying your identity. You should now be able to log in to your account.”
Once the hacker gained access to the account, he removed all the site administrators and sent Mr Thompson's fiancée an image of his genitals.
Mr Thompson was "quite upset" when he realised what had happened. "It's blatant harassment," he said.
At that point, he initiated an email conversation with Facebook, trying to inform them that he was in fact the owner of the account and that the previous messages and the passport ID had not been sent by him.
"Please investigate further, it will be easy to see that my account has been hacked. They sent a fake ID to the Facebook help team to reset the email and password," he wrote.
Mr. Thompson also reached out to Facebook via Twitter and received a response from communications security office Melanie Ensign. She replied: “You need to make sure something like this doesn’t happen again. Your security policy needs to be reviewed and corrected.” Mr. Thompson later offered some security advice.
“The hacker was able to make this request and hack my profile within four hours, while I was sleeping. I didn’t even see that someone made this request. There was no notification on Facebook, no notification on my phone. Given the seriousness of the information theft, if someone goes to hack an account, I think Facebook should freeze the account to check if they are actually using their original email or phone number to get the account back.”
He also stressed that if the request comes from a "suspicious IP address that appears unrelated to the account's regular IP," it should not be accepted.
