Last week my Facebook page was hacked. In a few moments I was kicked off my page altogether, the verification details were changed and I wasn’t sure if I’d be able to get it back at all.
The thing is, I knew it didn’t feel right. I knew that this made me feel uncomfortable and that the dynamic was ’off’. But I ignored my instincts because…why? I’m not sure. But perhaps because I didn’t want to make a fuss or be rude.
My scam started with an email inviting me to go on a podcast. Not unusual, I get a lot of these. The podcast was one I hadn’t heard of but I looked it up and it existed (I don’t think they have anything to do with the scam so I won’t name them). They sent over a list of questions which seemed legit. Someone had clearly looked into my work in some detail (although now I wonder, perhaps AI just does that now?).
They said that in order to go on the podcast, I needed to have a set up pre-podcast meeting first. Again, not unusual. Usually you talk through possible topics and logistics. After some back and forth we arranged a time to speak over zoom.
When I got into the meeting, the first red flag was that his camera was off. Instead he had an image which said ‘Facebook Live’. I asked about it and he said oh yes, he should have told me it was an audio call. After a few preliminaries he said the podcast would be on Facebook Live and he needed me to set that up. He shared his screen with me and directed me to do a few actions. After I failed to do so, he suggested I shared my screen instead. I did, not the whole screen, just the FB window. He then directed me to log in and out of my FB account, and told me there would be a email notification from FB to let me add myself as a business manager so that I could join the FB Live. I did not show him any passwords or codes. I went to my email, there was the notification which looked like it was from Facebook and I clicked on the link.
Clicking on that link added ‘Online Events’ as an admin to my Fb page with full control over the business portfolio. It looked like it was added with my email address and so I thought I was adding myself.
That enabled the hackers to take over my page and to kick me off it entirely. They added a fake email (like mine but with one letter different) and changed the phone number associated with the account.
That was it. Facebook page gone.
Once this had happened, I tried to report it to FB, but had no luck. That’s because when you report a hacked page to FB, you have to choose from a drop down list of your pages to indicate which page has been hacked - and I was no longer associated with my page so I could not choose it. ‘You have no business pages associated with this email address’ said FB. ‘I know’ I said (to myself) ‘that is the problem’. There was no obvious way to inform Meta of this. This was the most stressful part. Not knowing how to inform FB, and not knowing what the hackers would do in the meantime.
I was lucky. Someone who works with me had partial access to my page and the hackers had not removed them (not sure why). They were able to raise a support ticket with Meta who sorted it out within 24 hours. I still had access to my Instagram account and was able to get into the FB page via that.
The whole thing was intensely stressful and made much worse by how hard it is to communicate with Meta once you’ve been kicked off your page. I have heard stories of people not getting their pages back for months or at all.
I’m left with a sense of paranoia and distrust. Yes I was stupid to click on a link, but when on a call with someone, it is somehow too easy to just do what you’re told. They confused me, I had no idea why I was going through these steps and I stopped thinking straight.
I wish I could say it won’t happen again, but you know, I can’t say that I am always on it, always alert for something wrong. All I can say is that I’ll try to listen to my own intuition better in future. If it feels wrong, then it probably is.