28 September

Facebook on your phone does not ask for your password every time, because it keeps you logged in with a stored credential that Facebook's announcement compared to a digital key. On 28 September 2018, Facebook disclosed that a bug in "View As", a feature for previewing how your profile looks to others, had let attackers steal these credentials and take over accounts without passwords, and about 90 million people were logged out as a precaution. In an October update Facebook revised the figure to about 30 million people whose credentials were actually stolen, and the Philippine newspaper BusinessWorld reported that 755,973 of the affected accounts were in the Philippines. Since June 2025 Facebook has supported passkeys on mobile, which can replace your password when you log in. To make sure no one else is logged into your account, check the list of logged-in devices in Facebook's settings, which Facebook's 2018 announcement pointed to as the place to log out of every device at once.