Facebook Is Spamming Users Via Their 2FA Phone Numbers (mashable.com)

According to Mashable, Facebook account holder Gabriel Lewis tweeted that Facebook texted "spam" to the phone number he submitted for the purposes of 2-factor authentication. Lewis insists that he did not have mobile notifications turned on, and when he replied "stop" and "DO NOT TEXT ME," he says those messages showed up on his Facebook wall. From the report: Lewis explained his version of the story to Mashable via Twitter direct message. "[Recently] I decided to sign up for 2FA on all of my accounts including FaceBook, shortly afterwards they started sending me notifications from the same phone number. I never signed up for it and I don't even have the FB app on my phone." Lewis further explained that he can go "for months" without signing into Facebook, which suggests the possibility that Mark Zuckerberg's creation was feeling a little neglected and trying to get him back. According to Lewis, he signed up for 2FA on Dec. 17 and the alleged spamming began on Jan. 5. Importantly, Lewis isn't the only person who claims this happened to him. One Facebook user says he accidentally told "friends and family to go [to] hell" when he "replied to the spam."

Comments

Re:Users misunderstood what Facebook's 2FA stood f

[Anonymous Coward]

As someone who is very good with password hygiene and also uses a VPN, I've basically had 2FA forced down my throat. I am definitely suspicious that this was just a way to track me more easily under the guise of security.

The original user is an idiot

[Etcetera]

I can virtually guarantee that he was confused and enabled his mobile number as "the" mobile number on his Facebook account when setting up 2FA. (In fact, I'd be surprised if Facebook allowed a distinct 2FA number that hadn't already be validated as belonging to you to be set.)

As for why it showed up on his wall, maybe if he used Facebook more he'd realize that that's a feature. Send an SMS to the 5 digit SMS code and it will be interpreted as a FB Status update (unless it matches another string, like poking a user using a distinct notification number).

It's rarely used nowadays because a majority of folks probably use the app, but if you want to update via text message that's how you do it.

Ticket closed: PEBCAK (and stop whining)

Doesn't surprise me at all.

[QuietLagoon]

This is the main reason why I did not give Facebook a 2FA phone number the dozens of times I was prompted to do so. If Facebook wanted it that badly, I suspected it was not for my own benefit (i.e., I was the product being sold) It just seemed to me that they would either spam me directly or sell the number to advertisers or both.

trickery

[Tom]

Possible user errors aside, why would you ever willingly give your phone number or any other personal details not strictly necessary to a company in the business of selling your personal data ???

It should be obvious to an idiot that for FB, 2FA is just a welcome excuse to get you to give up your phone number, which of course they will immediately turn around and sell.

Honestly, you have to be stupid not to spot that.