The app permissions should have been a red flag, except some users probably never even saw them since Facebook was pre-installed on their phones.