All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
An interview invitation from Meta could be welcome news after weeks of job hunting. Scammers are counting on you being excited enough to follow their instructions.
Malwarebytes researchers uncovered fake interview-booking websites impersonating Calendly and Meta Careers.[1] They ask visitors to schedule a call before requesting their Facebook and Google passwords, along with the security checks needed to get into those accounts. The company published its findings on October 14.
Visitors pick a time, provide contact details, and complete a fake CAPTCHA. Then the page asks them to log in to Facebook. The imitation login window includes a fake address bar showing a Facebook URL. It also asks for a two-factor authentication code.
Next, it asks them to sign in to the Gmail address associated with the Facebook account. Fake Google screens collect passwords and can instruct visitors to enter verification codes or approve a sign-in prompt.
/images/2026/10/15/fake_interviews_stolen_accounts.png)
Meanwhile, attackers try those credentials on the real services, using the victim’s responses to complete the login. The pages have no affiliation with Meta, Calendly, or Google.
Two-factor authentication helps protect your account if someone steals your password. But entering a security code on a phishing page can give the attacker the next thing they need to sign in.
A genuine code can arrive because someone else is trying to access your account. Receiving it doesn’t mean the page asking for it is legitimate.
Keep two-factor authentication enabled, and use a phishing-resistant option where available. The Cybersecurity and Infrastructure Security Agency recommends phishing-resistant authentication over code-based methods.
Google supports passkeys, which let you sign in using your device’s fingerprint reader, face unlock, or screen-lock PIN. They’re tied to the genuine service, so you can’t accidentally type one into an imitation login form. Only create them on devices you own and control.
Verify the recruiter before following an unexpected invitation. The Federal Trade Commission recommends contacting the company directly, using a website or phone number you know is legitimate. Avoid relying on contact details supplied by the supposed recruiter.
Check the browser’s actual address bar before entering login details. A Facebook address drawn inside a webpage doesn’t establish where you are signing in.
Go directly to the affected service through its official app or website and change your password. Change it anywhere else you reused it, too.
For Google, review recent security activity and connected devices, then remove unfamiliar access. Check that your recovery email address, phone number, and authentication methods still belong to you.
In Gmail, look for forwarding rules or filters you didn’t create. Those settings could let someone receive copies of your messages or hide security alerts.
Google’s compromised-account guide walks through these checks and includes recovery instructions if you’re locked out.
If you also entered your Facebook credentials, secure that account immediately through the official app or website.
Learn more about how to avoid job scams.
Password manager with zero-knowledge encryption and a security audit that scores your overall password health
Share passwords via a one-time secure link with no Keeper account required on the recipient's end
Has never been breached and regularly publishes third-party security audits on its website
/images/2023/02/03/best-vpn-services.png)
/images/2025/04/16/nordprotect_review.jpg)
/images/2026/10/15/fake_meta_interviews_can_steal_your_logins_even_with_2fa.png)
/images/2026/09/25/google-and-meta-fake-ads-ftc-crack-down.jpeg)
/images/2026/08/26/the_thief_who_stole_your_iphone_would_also_like_your_passcode_please.png)
/images/2026/08/25/chameleon-seo-poisoning-phishing.jpeg)
/images/2026/08/25/fake-gta-6-demo-malware-steals-passwords.jpg)
/images/2026/08/05/fake-irs-crypto-scam.png)
/authors/thomas-kent-headshot-cropped.png){kind=small}
/authors/kate-quinlan-new.jpg){kind=small}
/images/2026/02/05/keeper-logo-full-color.png){kind=logo}
/authors/thomas-kent-headshot-cropped.png)