Just now, I was sitting at my computer when a string of texts appeared on my phone with:

> XXXXX is your Facebook confirmation code, or go to https://fb.com/l/HASH

I never requested this, and I am even on a fairly new phone/SIM that I haven't used online and I've deleted Facebook and Messenger from my iPhone for months.

I opened up a VPN to another location, a private browser and copied the link over and saw what appeared to be the confirmation of a new Facebook account created by a random Vietnamese person whom I have no knowledge of nor connection to, and who either had this number a long time ago, or incorrectly entered his number when creating the account. (oddly enough, the entire wall is filled with Vietnamese posts)

What confused and worried me was a row of images under 'People You May Know', which featured a number of people I definitely do NOT know, but a person that I do.

Even more creepily, clicking on 'More', I see a number of people I do know intermingled within a list of a hundred+ completely random strangers.

Is there any documentation of how Facebook makes identifications like this? Only one person in the list I can confirm has my new phone number. The many other friends in the list have my main number, or no number, and many aren't even connected to each other in any meaningful way. Some friends that do have my number, did not appear in this list.

According to this [Guardian article](https://www.theguardian.com/technology/2016/jun/29/how-does-facebook-suggest-potential-friends-not-location-data-not-now):

> “We may show you people based on mutual friends, work and education information, networks you are part of, contacts you’ve imported and other factors,”

But if this is a totally fresh, empty and random account, how did they identify me? Is it as simple as reversing other peoples' uploaded contacts and widening the social graph from there?