Social Media Expert & Founder of Snack Toronto.
getty
On December 30, 2021, I woke up to find that my Facebook user profile had been hacked and was disabled. This was weird—I have two-factor authentication turned on and I’m so hyper-aware of all sorts of scams. I didn’t click a single weird link, and the email address associated with my Facebook account wasn’t used for anything but this Facebook account.
I’m going to preface this article by explaining that I manage a social media agency, and my Business Manager managed thousands of dollars of spend for multiple different clients. My account was nearly 15 years old when this happened, and I had dozens of pages, ad accounts, pixels and other assets in this Business Manager.
Here’s what happened, what I did and what you can do if you’ve been targeted by a similar hack.
What Happened
First, the hacker somehow gained access to my account through my mobile phone. I reset and password protected all of my smart devices. I’m still uncertain as to how they were able to get past the two-factor verification, but they did.
MORE FOR YOU
Next, the hacker increased the individual ad account spend limit to the absolute maximum. Then, they created identical ads on each ad account and set the lifetime spend to $139,999. The ads were for a Facebook page called Minecraft 1.5.2 Store, which led to a website called King Cong Store.
After the hacker set the ads to run, they removed the other business admins from the Business Manager and removed all employees and clients from every ad account. The last action they took was posting a photo of child exploitation on my user profile, which is one of few community guideline rules that will immediately disable an account with no option for appeal. This means that, in theory, the ads could have run indefinitely.
What I Did
I immediately signed into my backup account. (Facebook later told me it’s against their guidelines to have multiple accounts—however, if you are not in the Facebook Marketing Expert Program like I am, you will have limited ways to contact them directly without creating another personal account.) I submitted a ticket through Facebook Support and through Facebook Chat. I also requested that my marketing expert look into this for me.
The next day, my Facebook marketing expert was able to see the ads running and immediately turned them off. They had already been running for a day and had racked up thousands of advertising dollars, which were thankfully refunded. What ensued after this was an absolute waste of resources, and hopefully you will learn from my mistakes. The Business Manager was reinstated, but I was never given access to it. No one seemed to know how to lift the enforcement or escalate to someone who could. I went back and forth for 30 days until my account was deleted.
What I Would Recommend So This Doesn’t Happen To You
Based on my own experience in dealing with this Facebook hack, here are some lessons I learned that can hopefully help you:
• Download an authenticator app right now to keep your user profiles safe. I had one downloaded but hadn’t yet input my Facebook account. This is one of the most secure ways to keep your account safe. There are many apps available such as Authenticator, Google Authenticator or Authy. In my experience, two-factor authentication is not the safest method anymore as scams have become more sophisticated with time.
• Add every page you manage to an individual person’s account as well as in Business Manager in case you lose access to your Business Manager. Thankfully, I’ve been around since before Business Manager, so for most of my accounts, I was already a page admin through a different account. If I hadn’t done this, I would have lost everything.
• Do not wait for Facebook Support to get back to you or to read your case. Ask to speak to a representative. Otherwise, if your experience is anything like mine, you will simply receive AI responses. Type this and nothing else: “I would like to speak to a representative now.” This would have saved me 30 days of back and forth. If this does not prove fruitful, open up a chat through Business Resources through a backup account. Where email clearly shows signs of AI responses, if you get someone through chat, you are most likely speaking to a real person (and will be able to tell).
• If you do get an email response within 24 hours of submitting your case, respond immediately. If you wait more than 24 hours, you will receive an email that the case will be closed automatically, and it appears that you are sent to the back of the queue. This could be a wait of 15 to 30 days, judging from my experience.
• Ask to submit a Business Manager Admin Dispute Request. I learned that you can request to take over a Business Manager if you have certain information. I submitted this but was denied because I had “multiple accounts on the platform.” (Facebook Support was counting my hacked account as a duplicate.) I ended up creating a brand new Business Manager and recreating everything all over again. If you have a business partner, it might be your only option to request a Business Manager Admin Dispute Request in their name.
While there used to be systems in place to help small to medium businesses when scams occur, the frequency and complexity of these scams have grown. My Business Admin access was never reinstated. While Facebook continues to complicate its processes, all I can recommend is that you diversify your ad management options, double down on your security and be open to change.
Forbes Agency Council is an invitation-only community for executives in successful public relations, media strategy, creative and advertising agencies. Do I qualify?
Go to Source
Author: Kelly Samuel, Forbes Councils Member
