Facebook Suspicious Login Alerts

A suspicious login alert from Facebook does not necessarily mean your account has been taken over by attackers -- but ignoring it also risks a future takeover. The most useful first step is to quickly check all active login sessions to see if an unauthorized device or location has gained access to your account.

That can be done from Facebook's login history settings, where you can see a list of all recent logins and the devices used. There, you should hunt for any unfamiliar locations or devices -- these unrecognized sessions may be signs that someone else is trying to get into your account.

If a suspicious device or location is found, it is recommended to change your password right away, disconnecting the dubious device if possible, and enabling Facebook's two-factor authentication. This security layer means that an unknown attack on your account would also need to bypass the extra credential.

But even if no suspicious sessions are in the login history, you should be cautious of the alert itself -- it may actually be an attack vector. Untrustworthy messages or emails that look like official Facebook communication, warning about suspicious login attempts, could be phishing.

Facebook says its support system only sends some alerts to specific devices, and claims never to request sensitive information like full passwords in an email. That is why it is advisable to be skeptical of messages about suspicious logins: report it to Facebook's email for suspicious messages or use the suspicious link tool in Meta's core Help Center, instead of opening it or responding to the email directly.

If opening Facebook's login history reveals that an account has already been compromised, it may mean recovery is much more difficult, Meta says. While basic password resets are effective as preventative measures, they may not stop an attacker that has already changed the account's contact information -- like the email address used for password resets.

To recover a completely compromised account, you can use Facebook's hacked-account flow on a device that has previously been used to log in to the account in question, preventing the need to verify contact information or even knowing the current password. But as with phishing messages, it is recommended to seek advice from Facebook's official customer support pages on a reliable, non-compromised device.

If you receive a suspicious login alert from Facebook, confirming it and understanding the possibility for future attacks is the most constructive way to respond, after confirming somehow the login was unrecognized, the best first step is to immediately update the account's security settings, disable any suspicious devices, and report to Facebook a possibly fake alert. After starting down the preventative steps for recovery, Facebook's Help Center stands as the best option a user has to recover from a full takeover.