ATTEMPT OF HACKING?

 A friend of mine recently requested a password reset for his Facebook account. The verification code was sent through WhatsApp. Without verifying the source carefully, he used the code and successfully changed his password. Despite the somewhat suspicious nature of the message, he was still able to access his Facebook account afterward.

A few days later, when he mentioned the incident to me, I advised him to reset the password again, this time using the verification code sent directly to his registered email address. I also recommended several precautionary steps: logging out from all devices, creating a strong and difficult-to-guess password (using a combination of uppercase and lowercase letters, numbers, and symbols), enabling two-factor authentication, checking active login sessions, removing any unfamiliar devices, and reviewing his email and phone number recovery settings. These are measures I would personally take as well, it is always better to be safe than sorry.

(And I also asked him to check all his other social media like Instagram, Threads even Twitter (X) and LinkedIn etc. just to be safe as you don't know how sophisticated hackers can be nowadays)

Receiving a verification code via WhatsApp is not the most common method, although it can happen under certain circumstances. Hackers sometimes imitate OTP or verification messages to create panic and trick users into revealing their codes.

The WhatsApp message itself raised some suspicion. Although it appeared to come from Meta, official verification messages are usually sent under recognizable names such as Facebook, Meta, or WhatsApp. A random sender name like “Geeta Code” is not typical for an official message.

The message also indicated that it came from a “Phone number from Indonesia, Business account.” Normally, official WhatsApp verification codes related to Facebook are sent from verified business accounts clearly labeled as Facebook or Meta, not from unrelated names.

In addition, the message format looked rather generic. It read:

“Update Notice: [Code Number] Account information must not be shared.”

Official Facebook verification messages typically say something like:

“Your Facebook code is [Code Number].”

However, the fact that he was able to successfully change his password suggests that the code did correspond to a legitimate Facebook password reset request.

In some cases, companies use third-party messaging gateways to deliver OTP codes via WhatsApp, which may result in different sender names appearing. Even so, the situation still seems unusual.

The concern is that although he managed to regain access using this suspicious-looking code, it could also indicate that someone else might attempt to duplicate or hijack the account and begin posting under his name. I have seen this happen before to another friend, and I advised him to immediately reset his password, inform his contacts on Facebook, and report the issue to Facebook at the same time.

Sometimes, the old school approach is still the best school, use the verification code sent to your registered email address rather than taking the quicker route through WhatsApp or, in some cases, SMS.