Meta Account Recovery Feature Found to Have High-Risk Design Flaw

ME News reports that on June 8 (UTC+8), GoPlus posted on X that a critical design flaw has been exposed in Meta’s account recovery feature, directly exposing users’ phone numbers, email addresses, and PII (personally identifiable information). Attackers can obtain a user’s full PII—including linked email and phone number—simply by entering a Meta username, without requiring any login or verification. This poses severe risks such as large-scale phishing attacks, SIM swap attacks, account takeovers, identity theft, and targeted social engineering. Recommendations: Remove or replace compromised email addresses or phone numbers as recovery options; change passwords for related accounts and enable 2FA; do not click on any emails or SMS messages claiming “account anomalies,” “verification,” or “password reset”; implement multi-channel verification and confirm legitimacy through official documentation or verified social media channels. (Source: ChainCatcher)