Unrecognized Login Alerts: What Dealers Should Do First

The notification lands at 2:11 a.m.: a Facebook login from a city your dealership has never advertised in, on a device nobody on the floor uses. In the morning a rep will call it spam and tap "this was me" because the alternative is a delay. That tap is how a real intrusion keeps a session. Unrecognized login alerts are not noise. They are a fork: confirm a legitimate travel login, or treat the account as hostile until proven otherwise.

What dealers should do first is not "finish posting the aged units, then look." First is freeze that Facebook session's posting, identify whether anyone on staff was actually in that city, and either approve a known login or kill sessions and rotate credentials. Marketplace can wait an hour. A captured profile will not.

This article gives GMs and internet directors a first-hour sequence, a way to tell staff travel from theft, and a resume-posting rule that does not include panic bursts. Facebook's alert copy and buttons change; use the live security screens. This is operational guidance, not a guarantee you will catch every takeover. PostToMarket is not affiliated with, endorsed by, or sponsored by Meta.

Unrecognized Login Alerts: What Dealers Should Do First, Not Second

Order matters. People invert it: they post, they ask in the group chat, they change a password two days later. Invert that.

Minute one: stop using that account to post

If the alert names a Facebook profile that posts inventory, that profile stops posting until the alert is classified. Do not "just finish this one unit." Do not switch to a second browser on the same login to see if it still works. Working is not the same as clean.

If other reps post from other profiles, they can continue. If everyone shares this login, the whole Marketplace channel pauses. That cost is why shared logins are a problem.

Minute five: ask the only question that matters

"Was any employee legitimately signing into this Facebook account from that place and device, at that time?"

• Yes, named person, expected travel or new phone. Walk through the alert with them. Approve only that session. Log it.
• No, or nobody is sure. Treat as unauthorized. Do not tap "this was me" to make the banner go away.

"I buy ads from my couch in another state" can be legitimate. "A city we don't recognize and the GM is asleep" is not a couch.

Do not use the alert's own link if the alert arrived as a random DM or text

Email and in-app security notices from Facebook should be opened by going to Facebook you already use (typed URL or installed app), then opening settings / security, not by clicking a shortener in SMS. Phishers fake these alerts. Pair this article with phishing messages that target car dealers on Facebook.

How to Read an Unrecognized Login Alert Without Panic

Alerts are imprecise. They can flag a staff member on hotel Wi-Fi, a VPN, a new phone, or an actual attacker. Your job is classification, not vibes.

Signals that lean legitimate

• Time matches a manager who said they would log in from home or a conference.
• Device type matches a phone you issue.
• Location is the owner's suburb, not a random coastal city.
• The person can describe what they did in the session.

Signals that lean hostile

• Location far from staff and lots, with no travel.
• Device type the store does not use.
• Alert followed by Page role changes, password-reset emails, or 2FA prompts the owner did not start.
• Multiple alerts in a short window across cities.

When unsure, choose hostile. A false lockout costs an hour of posting. A false "that was me" can cost the Page.

Password reset emails in the same window

If the alert appears with a reset you did not request, the email inbox is part of the incident. Secure the email first if you can still get in; the mailbox is how Facebook account recovery works. If you cannot get into email, you are in recovery, not in a routine password change. Have a plan before you need it: an account recovery plan to build before you get locked out.

A First-Hour Checklist After an Unrecognized Login Alert

Use this when the login is not clearly a known staff session.

1. Freeze posting on that Facebook account.
2. Open security settings from a device and network you trust (dealership desk, not the hotel Wi-Fi that might be the story).
3. Review active sessions. Sign out all except the one machine you are sitting at, if you still control it.
4. Change the password to a unique value from the password manager. Do not reuse the old pattern.
5. Confirm 2FA is on. Remove unknown second factors. If 2FA was off, turn it on and vault recovery codes. Details: two-factor authentication for dealership Facebook accounts.
6. Audit Page roles for new admins or dropped admins.
7. Scan recent listing activity. New posts you did not make, deleted listings, price changes to bait numbers.
8. Scan Messenger for blast messages you did not send (spam from a captured account burns buyer trust fast).
9. Notify the GM. One owner of the incident.
10. Log time, alert details, actions. This is how you brief support or counsel if it grows.

After the account is believed clean

Resume posting slowly, on the normal cadence, not as a catch-up dump. A stolen account that you just recaptured, then used to blast thirty listings, is a good way to look like a bot to Facebook's systems. Conservative pacing is an operating standard, not a published Meta cap.

If listings were altered, fix or remove the bad ones. Do not assume buyers saw only the correct version.

If you cannot get in at all

Stop. Use Facebook's official account-recovery flow. Do not hire a DMing "recovery specialist." Do not post from a brand-new profile at full volume the same afternoon to "replace" the old one; warm up properly if you must open a new posting path.

What Not to Do First

• Do not ignore it until Saturday.
• Do not approve the login to clear a banner while you are "pretty sure it's nothing."
• Do not text a screenshot of a 2FA code to "IT."
• Do not keep a shared password in circulation; if this login is shared, rotate and split people after the incident, not before, because during the incident you need the password changed immediately.
• Do not announce "we were hacked" on the Page. You do not know that yet, and you will spend the next week on comments instead of sessions.

How PostToMarket Automates This

Unrecognized login alerts are Facebook's signal. PostToMarket cannot interpret Meta's emails and cannot promise the next login is friendly. What dealers should do first — freeze that profile's posting, keep other people's work moving, avoid a revenge burst — is easier when posting is queued per person instead of stacked on the one account that just lit up.

Freeze one user without freezing the rooftop

• Per-rep queues and team queue view so a manager releases claims off the affected poster.
• Managers assign those vehicles to another associate or let other sales reps self-queue.
• Other users stay signed into the extension with their email, not the compromised Facebook password.

Do not "catch up" with a burst

• The Chrome extension posts one vehicle at a time with human-like delays.
• Server-enforced daily post limits and delays sit there specifically so a scared afternoon does not become a machine-gun of listings from an account you just locked down.

Know what was in flight

• Statuses draft, posting, posted, sold, failed show whether a unit died mid-post when you killed sessions.
• Mark as sold and archive still applies; an incident is not an excuse for live ads on delivered cars.
• Team analytics by rep help you see which profile was actually posting, which is the one the alert is about.

Build the recovery plan before the 2 a.m. banner. Use queues so "first" can mean pause one person.

Treat the Next Unrecognized Login Alert as an Incident

Unrecognized login alerts: what dealers should do first is freeze posting on that account, verify a named human, and if you cannot, kill sessions, rotate the password, confirm 2FA, audit roles, then resume at a human pace. Swiping the banner away is not a procedure.

If one Facebook login is the only way your lot appears on Marketplace, every alert is an existential event. Split posters and queues. PostToMarket includes unlimited vehicles, editable AI listing copy, bulk import, and paced AutoPost. Starter runs $59 per month for one login. Dealership runs $299 per month for up to 13 logins.

Start the 10-day free trial with secure Stripe checkout. Practice releasing a queue on a calm day so 2 a.m. is not your first drill. Cancel anytime.