We've seen several "Facebook recovery" accounts on Facebook, some of them sharing a shortened URL masking a phishing page, asking credentials and payment details. Some of them were even offering technical support services.
21 May 2015 ... We've seen a certain j.mp shortened URL being shared by what we believe are
rogue (if not compromised) accounts within Facebook a couple ...