If a friend DMed you right now and asked you to forward a recovery code, would you do it?

That’s exactly how a 22-year-old man hijacked hundreds of social media accounts over three years.

He messaged victims from their friends’ already-compromised accounts and asked for recovery codes. Most people handed them over without thinking twice.

Today’s post covers what happened, why passwords alone don’t protect you anymore, and five things you can do about it.