My Facebook Page (12K Followers) & all Blog Comments Disabled by Facebook due to Hacker

My Facebook Page with over 12,000 followers

I ran and maintained the Facebook page, The Art of Healing Trauma, since approximately 2012 so that represents 10 years of selecting quality content and also answering lots of comments.

Thousands of Blog Comments

Unfortunately, when I set up my blog, I didn’t know any better and I just used the Facebook Comments Plugin for the comments. I had no idea that this meant that someday I could lose thousands of quality comments that significantly add to the value of my blog. I answered every single comment on my blog for 10 years. Because the Facebook Comments module was so horrible – costing me hours and hours of work over the years as well as money hiring IT people and buying plugins to try to deal with it – I thought it could just suddenly fail one day so I copied my blog comments on June 19, 2018. At that time, I had 241 pages worth of comments in Calibri 12-point font. So, 241 pages plus the last four years of comments were destroyed by Facebook.

Friends / Personal Profile

I also lost all the friends that I made in the trauma healing community as well as all my other friends. And all my saved posts (many of which were for research for my blog and books), groups, activity logs, etc.

Thousands of Messages

I lost a lot of important messages from trauma therapists and colleagues that were in my business Page.

Destructive of Valuable Content and a Massive Amount of Work

I invested a lot of time into all of this. And all the valuable information – the content lost – is massive. The messages I got through my Page from therapists, colleagues, people around the world asking for assistance or just giving thanks. There are people who translated my articles into other languages and I’ll never know who they were now. So much data has been lost, and such a huge support network as well.

How it Happened

When I was setting up my ad, I didn’t do anything unusual that would have allowed a hacker to gain entry to my account. I did everything in the normal and expected way for setting up an ad. I didn’t answer any strange messages or click on any strange links. Others who have gone through this experience sometimes did things like answer messages from questionable people or click on links. In my case, the hacker gained entry without anything unusual happening on my end.

Immediately after the hacker gained access, Facebook put my account into 30-day review for violation of community standards. The only thing I personally had done to “violate community standards” is, right before this happened, I sent two silly sex jokes, via Facebook Messenger, to a friend. My friend liked them so there was no harm done there. A year ago, I posted some things on my personal profile that “violated community standards,” but to me were reasonable and legitimate opinions, but I had not posted anything with that designation recently. Few people saw those and I never got in any trouble for them at the time. I was not a prolific poster on my personal Facebook profile (whereas on my Page sometimes I posted 3 times a day). (I planned to go back and delete those posts from a year ago if my account was restored after the 30 days just to be safe but my account was never restored.)

From June 10-15, the hackers ran their ads through my account and charged my credit card for a total of 12 transactions totaling $438.

I immediately canceled my card and got the charges refunded.

The hackers continued unabated using other people’s cards. Something that caused extreme stress beyond all the stress of having my card charged was that after I canceled that credit card the hackers kept running their ads using my account and charging other people’s credit cards. I would get all these emails saying that they charged $20, $50, etc. transactions for some ad campaign onto someone else’s card.

Facebook was 100% Inaccessible

The worst part of it was there was absolutely no way to contact Facebook to get it to stop. Because my account was in review, I couldn’t use any Help or Support interfaces on Facebook. I searched articles upon articles for a few entire days and there was literally no way to get help or to contact Facebook to get them to stop the hacker from charging people’s credit cards. They also make it impossible to use a friend’s account to tell FB about problems with your account as the Help section just tells your friend to tell you to do something, but you can’t when your account is in review. So the hacker’s ad charges just kept going on and on, the same thing every day.

Emailed Facebook  

I finally found an article listing some email addresses for employees of Facebook and I emailed every single one of them asking them to get the IT department to stop the hacker from constantly charging people’s cards every day through my ads account. 

I sent the email to:

1. platformcs@support.facebook.com
2. CCox@fb.com
3. auchil@fb.com
4. SSandberg@fb.com

(These email addresses didn’t work: abuse@facebook.com, support@fb.com)

Apparently at least one of these emails went through because the hacker activity stopped.

The email I sent is at the end of the article.

Some Examples of the Countless Others who were Hacked and Lost their Pages, Profiles, etc.:

There are stories all over the place of people with followings who have lost access to their pages due to hackers.

Mashable – Facebook scammers are hacking accounts and running ads with stolen money

Facebook account hacked? Business Manager hacked? Here’s how to get help

In the above article, Mari Smith mentions that a social influencer “Adryenn Ashley had a big hacking experience. The bad actors took control of a large number of Facebook Pages she administers, including her own blue-check verified public figure Page, which she has still been unable to regain control of, despite following all the steps and speaking with her Facebook reps.”

Mari Smith also mentions, “I emailed my subscribers to get a sense of how commonplace hacked Facebook Accounts and Business Managers are. I was amazed to receive dozens upon dozens of replies all with very similar stories.”

FACEBOOK DISABLED MY ACCOUNT AFTER I WAS HACKED – NOW WHAT??

Clearly Unfair

I assumed my account would be reinstated after 30 days but instead, it was disabled.

This is unfair – hacking is something that’s completely beyond our control and something that we didn’t cause.

So Many Loops

When my account was first disabled, I immediately requested a review. Then I noticed that the message on my profile when I tried to log in said I still need to request a review. But there was never any way to do that. Almost every day of the 30 days I tried to request a review in some way but they were always unending loops. So, towards the end of the 30 days, when I would go to sign out of my account (thinking I might make another one to see if I could solve it from another account somehow) it would say that my account will be disabled unless I request a review (even though I already requested a review). But then when I would try to go into my account it would say my review is already requested. If I tried to request the review again from the Help Page for that, it would go straight to an error page. There were MANY unending loops because every single solution requires your account be active, which makes no sense because you’re trying to get a solution for an account that is disabled. (????)

Recourse?

If anybody knows any recourse, please let me know! 

I thought maybe I could send an appeal to The Oversight Board but that seems to have the same neverending loops as you need to access your disabled account to request an appeal for a disabled account that you can’t access.

***

Here is the Email I Sent to Facebook:

Hi,

My ads account has been hacked and is currently being used to run ads by hackers.

Every day I receive emails informing me of the charges that are being incurred on other people’s credit cards through my ads account.

Please get somebody in IT to get to the bottom of this and stop the hackers.

Details of the case:

I have over 12K followers on my business page The Art of Healing Trauma and have ad campaigns planned that 100% comply with all rules and policies of Facebook ads. Before I could even test a couple ads out, my Ad Account was hacked. The hackers removed me as a user from “Trauma Blog” pixel and proceeded to charge my credit card on file for about 10 ads, and then a second credit card (not mine) for another 8 or so (then two additional credit cards that don’t belong to me for ads today June 13).

Then my personal account was deactivated for a 30 day review (I read that this happens at the same time sometimes because the hacker’s activities set off the AI that detects these things).

Could you please have somebody in IT investigate and remove the pixel and ads belonging to “Trauma Blog,” remove Trauma Blog and remove that user? Probably they should delete all users, pixels and ads in the ads account associated with my business page The Art of Healing Trauma. Make sure to figure out how the hacker is getting into my account and stop them from accessing it. Then reinstate my Facebook account so I can manage everything. When I can manage everything I can make sure everything remains secure.

Because I cannot access my account, I can’t remove the users who don’t belong there, nor can I remove the fraudulent ads. I also can’t report anything to you via any of your contact forms. I also can’t manage my pixels because they are managed through The Facebook Plugin for WordPress which requires you to log into your Facebook account to manage the pixel.

There have been a lot of attempts to log into my account using the email heidi@heidimariahanson.com. This is not my email. It is an old email I had years ago. The hackers bought that domain (today actually), are hosting it on amazon AWS, and created that email with it. Please make sure nobody is logging in to any account in Facebook using the email address heidi@heidimariahanson.com.

Additional notes:

When I was setting up my ads I was asked if I needed help so I replied to the Support person via Messenger with one question about how to get the pixel set up on my WordPress website. When they replied via email this was included:

Your FBE Seller Support Inquiry | Job: XXXXXX Facebook Marketplace Team <case++aazqlkzdiw2joc@support.facebook.com>

Tue, Jun 7, 9:52 PM

They mentioned that I was no longer the user for “Trauma Blog” – I was not using that pixel for ads but I should be the only user for all pixels under my account. [Note: Facebook should have some kind of alert whenever a Page with one owner suddenly has that one owner kicked off their own ads campaigns so FB can go in and remove the hacker but apparently they don’t.]

“A. Pixel: XXXXXXXXXXXXX

– You do not have a role on this Pixel.

B. Pixel: XXXXXXXXXXXXX(*Trauma Blog Pixel*)

– The Pixel is owned by Business Manager: The Art of Healing Trauma

– You do not have a role on the Pixel via the Business Manager”

I set up two ads under “Trauma Blog ONLY” but I never launched them as I was still working on them.

Then I got an email from you saying there was unusual activity in my ad account and I need to verify payment info. Of course I couldn’t as my account is inaccessible.

These are the fraudulent charges and ads:

REFERENCE NUMBER XXXXXX 50.00

Jun 11, 2022 FACEBK XXXXXX -$9.00

Jun 11, 2022 FACEBK XXXXXX $15.00

Jun 11, 2022 FACEBK XXXXXX $21.00

Jun 11, 2022 FACEBK XXXXXX $62.00

Jun 10, 2022 FACEBK XXXXXX $62.00

Jun 10, 2022 FACEBK XXXXXX $9.00

EMAIL MESSAGE:

Date range Jun 9, 2022, 12:00 AM – Jun 9, 2022, 11:59 PM

Product type Facebook ads

Billing reason A manual payment was made on this account.

Payment method Visa · 2910

REFERENCE NUMBER XXXXXX

S71 Smart – genuine product – Copy $2.58

S71 Smart – genuine product $2.00

S71 Smart – genuine product – Copy $2.11

S71 Smart – genuine product – Copy $2.31

Campaign total $9.00

ALSO

REFERENCE NUMBER XXXXXX 62.00

REFERENCE NUMBER XXXXXX 62.00

REFERENCE NUMBER XXXXXX 21.00

REFERENCE NUMBER XXXXXX 15.00

THIS IS NOT MY CARD I DON’T KNOW WHOSE CARD THIS IS:

EMAIL MESSAGE:

Date range Jun 10, 2022, 12:00 AM – Jun 11, 2022, 10:30 AM

Product type Facebook ads

Billing reason A manual payment was made on this account.

Payment method MasterCard · 0840

REFERENCE NUMBER XXXXXX

S71 Smart – genuine product – Copy 691 Impressions $2.21

S71 Smart – genuine product – Copy 391 Impressions $1.11

PH44 Smart – genuine product – Copy 11,901 Impressions $20.24

PH44 Smart – genuine product – Copy 12,525 Impressions $19.74

PH44 Smart – genuine product 12,740 Impressions $20.63

PH44 Smart – genuine product – Copy 11,809 Impressions $20.31

S71 Smart – genuine product 136 Impressions $0.36

S71 Smart – genuine product – Copy 151 Impressions $0.40

Campaign total $85.00.