This 100%. I had the same thing happen to me (even though I have 2FA everywhere):

https://github.com/Niek/Niek/blob/master/facebook-scam/READM...