except

My apologies, I missed that possibility. The app still looks poorly put together regardless.

My point was that official applications rarely ever include them, not that it was intentionally placed there.

The app looks poorly made and there are clear spelling mistakes plus the fact that it was not offered by TikTok which should have made you suspicious. It sucks this happened but maybe you should have done some research and checked if this app actually did belong to TikTok. I assume the app also asked you to login to Facebook directly rather than OAuth which should also made you suspicious.

reCAPTCHA v3 is supposed to be frictionless so there would be no use for this as the user does not need to solve anything.

I doubt they would cost the same as regular iPhones.

I understand, but that sort of behaviour should have been thwarted quickly by their security team or policies setup against abuse.

I find it hard to believe this was a Social Engineering based attack. Elon Musk’s account was accessed multiple times after their tweets being deleted and it seemed to last forever, account by account being taken over.

The attacker must have added some high level access, for it to be still ongoing.

Argon2 supports peppering/secret parameter where it does a HMAC internally.

This seems nice on the surface, however I’m not sure it will be enforced at all or easily for that matter.

So, how does one build a card network?