Facebook Let’s People Find the Phone Numbers of 2FA Accounts

  • Facebook users who have activated 2FA are searchable and identifiable by anyone.
  • Most users have not realized that their number can be looked up, and many don’t know about the relevant setting.
  • The social media giant has taken advantage of people giving out their phone numbers to achieve better ad targeting.

Setting up the two-factor authentication on online platforms is a good practice to secure your account from falling into the wrong hands, but on Facebook, 2FA comes with a serious security-undermining catch. According to multiple reports that were spewed in many forms last week, the phone numbers that are added by Facebook users who enable the 2FA step are searchable by anyone out there. The worst part is that the phone numbers are linked to a unique user ID, so those who can search and find your number can also make the correlation with your identity. The even worst part? There’s nothing you can do about it, as there’s no disabling option for this phone number “lookup” function.

Long story short, Facebook’s goal was once again to deliver more targeted ads, and they have dynamically promoted the adoption and setting up of the two-factor-authentication layer on their platform so that they get to go deeper into their users’ private data. As security researcher and academic Zeynep Tufekci put it in a tweet: “Facebook has used security to further weaker privacy”.

Only a couple of months back, Facebook admitted that they had shared the phone numbers that users added on their account for the activation of the 2FA with advertisers. Back then, users reported that a few weeks after activating their 2FA, they also started receiving targeted ads on their phones, something that was conveniently never mentioned when users were bombarded by Facebook to set up their 2FA for additional security. Once someone adds a phone number (or more), there’s no way of getting it back, and while users can restrict the "look up" function to only their “friends”, disabling it all together is impossible.

This renders Facebook users susceptible to SIM swapping attacks, a common account hijacking method that is useful when targeting people who have enabled the 2FA feature. That said, and while 2FA is a generally suggested approach, the way that Facebook handles user data is throwing the benefits out of the window. Now, and since May 2018, Facebook users have had the option of activating 2FA without registering a phone number. The alternative authentication methods come in the form of apps like Duo Security and Google Authenticator, so if you want to activate 2FA on Facebook and still have a peace of mind, do it this way. If you still prefer the phone number way though, at least switch your “look up” setting down to the “Friends only” option.

Are you using 2FA for your Facebook account? Have you ever checked the “look up” settings? Share your thoughts on our socials, on Facebook and Twitter, or just write us a comment down below.

REVIEW OVERVIEW

Latest

How to Watch Rooms We Love Online From Anywhere

A new lovely series focusing on beautiful houses and great interior designers is set to soon premiere, this time with an emphasis...

How to Watch Elizabeth: A Portrait in Parts Online From Anywhere – Stream the Queen Elizabeth II Documentary

Elizabeth: A Portrait in Part(s) is a documentary on the life of Queen Elizabeth II, the longest-lived, longest-reigning British monarch and longest-serving...

How to Watch Shoresy Online From Anywhere: Stream the Letterkenny Spin-Off Series

Shoresy is the foul-mouthed, chirp-serving, mother-loving, fan-favorite character, and this show sees him join a senior AAA hockey team in Sudbury on...
For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari