Facebook makes 2FA mandatory for high-risk accounts, an expansion of Facebook Protect, which covers 1.5M accounts and will be in 50 countries by the end of 2021
Facebook, a recently added subsidiary of Meta, said it will make two-factor authentication (2FA) mandatory for high-risk accounts likely …
Context & Ripple Effects
Facebook had already moved toward stronger account controls: its 2018 rules required 2FA for some Page managers with large U.S. audiences, and a 2020 update previewed security-key support and a broader Facebook Protect rollout. The current expansion turns that security program into a mandatory control for a defined high-risk group.
It also fits Meta’s later use of default protections for defined user cohorts, including automatic enrollment in Teen Accounts. The common thread is shifting safeguards from optional settings to platform-enforced account policy.
First-order effects
- High-risk Facebook accounts covered by Facebook Protect must use 2FA, making continued account access contingent on an added authentication step.
- Facebook Protect expands to 1.5 million accounts and is slated to reach 50 countries by the end of 2021, increasing the program’s operational footprint.
Second-order effects
- Page managers and other high-visibility account holders face a more uniform security baseline than under Facebook’s earlier, narrower 2FA requirement for certain large-audience Page managers.
- Facebook must support enrollment and authentication for a much larger protected cohort across its rollout markets, making the quality of the security flow part of the program’s reach.
Third-order effects
- Meta’s account-safety model is moving toward cohort-based defaults and mandates rather than relying solely on users to opt into protections.
- If this pattern continues, platform trust infrastructure will increasingly be defined by which accounts Meta classifies as needing mandatory safeguards and how broadly it applies those rules.
The trend: Major platforms are turning account protection from an optional feature into policy-driven, automatic or mandatory controls for higher-risk user groups.