Facebook's state-sponsored hacks notification is not spam

By Fusion Staff  |  October 19, 2015 | 4:47pm
Latest

Last week, Facebook announced that it will start notifying users whose accounts may have been hacked by “state-sponsored actors.”

In a post discussing the new feature, Facebook Chief Security Officer Alex Stamos explained that, “while we have always taken steps to secure accounts that we believe to have been compromised, we decided to show this additional warning if we have a strong suspicion that an attack could be government-sponsored.”

Basically, Facebook explained, the new measure is supposed to alert users that the security breach is a serious one, and that they shouldn’t ignore the warnings:

We do this because these types of attacks tend to be more advanced and dangerous than others, and we strongly encourage affected people to take the actions necessary to secure all of their online accounts.

Facebook didn’t go into specifics on how they’ll figure out if a compromised account was targeted by state-sponsored hackers, but the move isn’t all that surprising. TechCrunch points out that Google made a similar move back in 2012, and that Facebook has been ramping up security overall. Plus, the notification will recommend users to implement “Login Approvals,” a tool that Facebook already encourages all users to opt-in to and is a straightforward two-step verification system. And we’ve seen some nasty hacks this year that authorities are tracing back to China —all good reasons for Facebook to stress the importance of following its safety protocols in the case of such a breach.

But the move will only work if people believe that the notifications are legit. It seems that may not be the case. Wary users may recall phishing attempts that, falsely, warned them they had violated a Facebook policy or ones from a “Facebook Recovery” warning users that their accounts could be terminated. So it’s not a huge surprise that a number of comments on the state-sponsored hacking security announcement are from users wondering if the announcement itself is fake:

This comment is at the top of the thread:

Even after some discussion, the user was not convinced the Facebook post is real:

It seems the confusion is stemming from poor imitations of the Facebook notifications. Another confused user posted a link to a message she received and suspected wasn’t from Facebook:

That message (which is indeed false) was posted in response to a comment the user made on the Bubble Blaze Facebook page:

So let’s clear this up right now. Facebook will notify you if they suspect your account has been hacked by a state-sponsored actor. The message will, as Facebook said in its announcement, look like this:

It will come from the Facebook security team, which is verified, and can be found at: Facebook.com/security. It will not look like this:

And it will not come from an unverified account, even if that account is called “Facebook security,” or some variation. It also likely won’t use exclamation marks at all, but especially not like this: “!!!” It will not feature randomly capitalized words. You should not give out personal, or any, information to such accounts.

That is all.

Danielle Wiener-Bronner is a news reporter.

 
Join the discussion...