We’ve recently uncovered an attack with a client’s system that takes your Facebook advertising account and runs spam ads from your page, with your budget.
What’s happening?
Attackers are gaining access to Facebook user accounts. They’re setting up spam ads for fake shoes and jewellery with the user’s own ad account. The ads use the credit card that’s on the account.
How’s this happening?
We’re not sure exactly how Facebook accounts are being compromised right now — there’s a range of ways that attackers can access your Facebook password. The Facebook security team are currently looking into this and we’ll have more updates as they come.
How do I prevent this?
While the exact way passwords are being comprised isn’t yet known, there’s a few things you do to prevent this:
1. Change your Facebook password
It should be unique (not used for any other logins) and secure (ideally a random selection of characters, numbers and symbols more than 10 characters long). This makes your password much harder to crack. While you’re at it, do this for your other important accounts.
2. Enable two factor authentication
On Facebook:
- Go to your Security and Login Settings by clicking in the top-right corner of Facebook and clicking Settings > Security and Login.
- Scroll down to Use two-factor authentication and click Edit
- Choose the authentication method you want to add and follow the on-screen instructions
- Click Enable once you’ve selected and turned on an authentication method (SMS method is fine)
With this, even if your account is compromised, attackers won’t be able to log in without the code that’s sent to your phone each time.
3. Be cautious
Don’t click links from suspicious emails, SMSs and messages (like Facebook Messenger). If the URL doesn’t look right, avoid it. Avoid any prompts outside of Facebook that ask for you to log in and make sure your OS is up to date and run a virus scan.
Taking these precautions should reduce the chance of this happening to you significantly. We’ll provide updates once we know more. If you think you’ve been affected contact your IT support provider and let us know.
