Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Meta is using my 2FA to call and sell me

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 84 posts

Re: Tell HN: Meta is using my 2FA to call and sell me

#71

Post by rsync »

Dave_TRS wrote: post #55
rsync wrote: post #54

Don't use your personal mobile phone for 2FA. Use a "2FA Mule" that is only for that purpose: https://kozubik.com/items/2famule/ I have the ringers silenced on mine so I wouldn't know if they got any spam calls ... and I assume they do ...

Google Voice is free and will forward SMS's to email, which can then be set up with rules to various other emails. Most banks accept google voice numbers Twilio numbers are a dollar a month and will also forward to email or you can log into the twilio web interface to pick up sms codes if needed. Rejected by more places the demand 2FA

"Google Voice is free and will forward SMS's to email ..."

...

"Twilio numbers are a dollar a month ..."

I wanted very much to keep my telephony within twilio and maximize the mini-telco that I built for myself there ... however almost zero 2FA requirements can be fulfilled with "voip" numbers that are not honest-to-god mobile tagged phone numbers.

That's the whole point of the 2FA Mule, etc.

Re: Tell HN: Meta is using my 2FA to call and sell me

#73

Post by dpkirchner »

runevault wrote: post #63
Dave_TRS wrote: post #55

Earlier quoted context omitted.

Google Voice is free and will forward SMS's to email, which can then be set up with rules to various other emails. Most banks accept google voice numbers Twilio numbers are a dollar a month and will also forward to email or you can log into the twilio web interface to pick up sms codes if needed. Rejected by more places the demand 2FA

Some services don't allow GVoice 2fa. I tried it for instagram because I refuse to give Facebook my real number and they rejected it.

Same, although my goal was to use a Google Voice number that could be shared amongst a team, for integrating with Facebook's APIs.

Re: Tell HN: Meta is using my 2FA to call and sell me

#74

Post by codyZ »

Jochim wrote: post #21
ignite wrote: post #12

Earlier quoted context omitted.

I thought that companies you are doing business with are allowed to call you. He has an account, they can call. Also not a lawyer.

I'd assume in this case that they'd be allowed to call his business. It sounds like his personal contact details are entirely separate from his business ones. I don't believe they should ever be using personal details to contact a business. Even if he did provide them his phone number. In many places, that data may only be used for the purpose for which it was given. If they request a phone number for 2FA and then us…

Correct - My personal number is nowhere to be seen anywhere on the business account.

Re: Tell HN: Meta is using my 2FA to call and sell me

#75

Post by codyZ »

crazygringo wrote: post #48

Just to be clear... You're absolutely sure , 100%, this is Meta employees themselves calling you? And Meta sending you e-mails? Not spammers, of which there are many, and they get your contact info from all sorts of places? And which often lead you to believe they're Meta when they're really just scamming you or trying to sell ad placement consulting/optimization services? Because with "multiple" calls and emails...…

Indeed it is. I too thought that perhaps it was a scam. But the call was followed up by an email from business.fb.com and per their Help Center, it is indeed from Meta https://www.facebook.com/business/help/372703956148310

Re: Tell HN: Meta is using my 2FA to call and sell me

#76

Post by codyZ »

ardit33 wrote: post #13

Sounds like alarmist reaction without proper evidence. How do you even know it is Meta? Anybody can get your phone #, and it is super easy to get spam.

I also thought it was a scam call but they followed up with an email to my personal email tied to my personal email from sign up from @business.fb.com domain per their help center https://www.facebook.com/business/help/372703956148310

Re: Tell HN: Meta is using my 2FA to call and sell me

#77

Post by codyZ »

Invictus0 wrote: post #9

Your anecdote isn't really evidence of anything and I'm skeptical that this is the case.

Perhaps I am an isolated incident and honestly hope for the sake of the community that it is. But they followed up with an email to my personal email tied to my personal email from sign up from @business.fb.com domain per their help center https://www.facebook.com/business/help/372703956148310

Re: Tell HN: Meta is using my 2FA to call and sell me

#79

Post by dimitrios1 »

LegionMammal978 wrote: post #44
dimitrios1 wrote: post #40

Earlier quoted context omitted.

Nice rhetoric yourself. I am sure big mega corp has nice checks in place to try and prevent these things, but no system is perfect, nor exhaustive. That's the problem when you are a data sink as a business, your #1 incentive is to keep the data flowing in. You would think that when you hand someone your telephone number and they promise to secure it or only use it for a specific purpose, the onus is on them to prove…

> You would think that when you hand someone your telephone number and they promise to secure it or only use it for a specific purpose, the onus is on them to prove they didn't misuse it. How could this be acceptably proven, in your opinion, if at all? "This information has never been misused" is the null hypothesis; it can never be proven for certain, from the moment the information is out of your direct control.

Proving it is another issue all together. Raising a reasonable concern that it was misused or mishandled triggers the process. And the process will uncover the the facts of the matter. For telephone numbers, the laws and regulations are pretty well written.

Re: Tell HN: Meta is using my 2FA to call and sell me

#80

Post by _nalply »

bedast wrote: post #50
kritiko wrote: post #38

Earlier quoted context omitted.

Using Facebook Business Tools requires you to accept an arbitration clause, which may limit your ability to pursue small claims against them: https://www.facebook.com/legal/commercial_terms/update

If they were using his business contacts, this seems like it would apply, as that data is collected from the business accounts which would fall under this agreement. But does this apply when using personal account data? Does the business account agreement override the use of PII on a personal account to initiate business solicitations? Definitely something to talk to a lawyer about.

Or just try small claims and see.
Post reply on HN