Orphaned Accounts After Hacking

“You know what: Microsoft became miserably incompetent in IT All of the tech giants have really broken account recovery flows. They&#x27;ve all been glomming on recovery options, single sign-on, 2FA, etc features and none of it is coherent, with lots of dead ends where the optional recovery option it suggests isn&#x27;t actually supported.<p>Amazon has a lot of issues with accounts shared between their national storefronts. I lost a Google account that owns a YouTube channel since it wants to 2FA to a long-gone phone number. Apple has a lot of oddities when you used different emails for your Apple ID, iTunes Connect, and iTunes before they unified everything.<p>One great example though is Facebook<p>My wife&#x27;s Facebook account recently got hacked, and I managed to recover it though this crazy workflow:<p>The hacker had removed her email address and phone number from the account, changed her password, and added their controlled Meta account as a connected account. This connected account had an email but no password, so it could not be removed without adding a password to it, which required verifying the attackers email address.<p>None of the account recovery tools worked (including the “this wasn’t me” link in the Facebook “did you just delete your phone number” email - what is the point of that link) - they couldn’t find her account by email or phone number, and even though the Facebook app itself was still logged in, none of the account center tools allowed us to do anything without the new password. It also did not allow us to remove the connection to the hackers Meta account or log it out from their devices because it had no password and it would become orphaned with no login.<p>What seems to have worked for us:<p>1. Open the still-logged-in FB Messenger app on her phone. It now asks to add a phone number to enhance security. We did this.<p>2. Now install WhatsApp and sign up using the phone number.<p>3. Now go into the Facebook app, change password, I forgot my password, and use WhatsApp as 2-factor authentication.<p>4. Now we have control of the password again! We also added a app (TOTP) 2-factor authentication and iOS passkey to her account at this point to add more options for control.<p>5. Go to Meta Quest website (meta dot com), and log in via Facebook. This logs us into the attackers account!<p>6. We could now add a 2-factor authentication to the hackers account, after which it also now let us change the password of the attackers account without knowing the old one.<p>7. With a password on the account, we can now log them out of all other devices (the attackers phone).<p>8. We could also now change the permissions so the attackers Meta account could not be used to log in to her Facebook account, but it’s still listed as a related account since it requires email confirmation to remove.<p>9. Managed to use the 2-factor code to reset the email address on the attackers meta account, so now we own it completely!”