Facebook has changed and failed to let us know about it. Take a look at your URL address (the top box on your screen.) If you see "http" instead of "https" you DO NOT have a secure session & can be HACKED.

Go to Account >
 Account Settings >
Account Security > 
click  on Change.
 
Check box (secure browsing), be sure to click  Save. Facebook has automatically set it on the non-secure setting!

Happy Facebooking!!