Facebook activated my dormant account and won’t let me deactivate it

> You can also try other challenges to confirm your identity.

FB has a history of collecting cross-site passwords from failed logins.

The Author even considered that the password was checked by some automation against sites like haveibeenpwned, which makes sense to me to some degree for Facebook to be actively checking against, but they seem to dismiss this in favor of a spying option.

I agree that having to submit a government issued ID seems a little incredulous for being able to deactivate the account, but as others have suggested, I'm not really sure how else the author can prove they are who they say they are. It seems that any such approach would be equally egregious to the public eye (i.e., anyone can make a fuss and shut down a facebook account), but certainly there must be some middleground, such as multiple authentications.

A lot of the sanity checks used by companies are pretty unreasonable for most users to remember or pass - Microsoft and Skype, for example, have basically locked me out of my main skype account; their recovery challenge was to name the exact account names of 6 of my contacts as well as the the last two group chats I had been a part of. Since I hadn't used the account in about 2 years, this was really difficult for me, and the account names were even more difficult since people were using handles instead of real names, so the exact formatting was all but forgotten.

Riot Games Inc. had similar methods, asking "what was the first skin you were gifted and who gifted it?" when my friend was trying to recover their hacked account. That was stuff that had occurred years ago, and we had no idea who gifted what and when.

Again, I don't really pretend to have a good solution for these scenarios, but such solutions seem like they're just obstacles for the actual owner instead of neerdowells that overtake accounts.

Given you more or less gave away the idea that you reuse your own passwords, if you haven't already, I suggest you start using a password manager and changing all your passwords to something random.

As it is now it's simply not possible for a regular person to decide that they do not wish to further participate with any of facebook's services, remove their account and all the data associated with it, and be confident that all of the data collection, analysis, and 3rd party identification/authorization that goes on with active facebook accounts stops when their account removal process is complete.

So no matter what any one individual does in regards to their unwanted facebook account there is always the possibility that something they would really prefer not to happen with it comes to be... like some hacker from who knows where gaining control of it and so adding another key element to their identity fraud dosier collection.

I've gone in three times now, made sure the account was "deactivated" (using quotes since we know it's not really ever deleted).

And I'm still getting notifications.

Something else is going on here.

"anyone" with the proper access credentials?

Not to re-activate an old account without email re-verification.

Don't you think that was part of the point and part of the problem?

> We aren't aware of any suspicious login activity on your account

So they admit they don't think anything is going on, even. Facebook is just punishing the author because they committed the sin of password reuse. And the punishment for password reuse is apparently demanding ID before allowing the author to do anything with the account that belongs to them. Even though they control the email address associated with the account.

Given their scale, Facebook doesn't have to ever delete anyone's account information, since they have enough money and power to keep everything indefinitely. Deleting account information would probably be like deleting money, since that data likely has real value (more so if someone changes their mind about deleting their account) even if it's no longer public.

It's not nuts, it just seems a bit mercenary. But then, Facebook is bigger than many governments now, so it also seems to be working in their favor.

Some concern from family and friends but a "Yea, got hacked, be careful out there" took care of that.

Make the system work for you mate.

I seems to remember this was exposed a few years back with the introduction of a "past memories" features or something that mistakenly took some of the supposedly deleted content and put it in the spotlight.

They hold onto this data because: 1. You gave them full legal rights to do so by agreeing to their ToS and giving them full ownership of everything ever collected on you by facebook. 2. Exploiting user data is how the make money. (well that and investor story time).

What is _important_ is the fact that it was activated without any user input, and can't be deactivated without handing over quite substantial trust.

What the OP doesn't seem to understand is that the attacker may have been able to technically "reactivate" the account, but they also probably can't actually gain access until they provide ID. This ID requirement has likely saved the OP's account from actually falling into the attacker's eager hands.

OP is complaining about the privacy implications of a compromised reactivation by an attacker, and sour they are being asked to prove that they are not the attacker. Take off the tin foil hat, stop crying foul, be grateful Facebook seems to have saved your password-reusing ass, send them the ID, and then delete the account instead of deactivating it.

And yes it should, and expendable passwords because the world is filled with morons who "encrypt" your password with rot13 or one round of unsalted md5 (but your better follow their "strong password rules")

Facebook afaik does nor have twitter support.