Hijacked Facebook accounts: More Kiwi small business wait weeks, with no help

Businesses locked out of their hijacked Facebook accounts feel as though they're in an infinite loop. Photo / AP

More small businesses with hijacked Facebook accounts say they’ve been trying for weeks – or in one case, months – to regain control.

They’re at a loss why it’s taken the social network so long to act on issues with its paid tools, and Facebook has failed to respond to multiple Herald requests for comment.

In the case of the Auckland Arts Festival, mar-comms head Terri Cuminskey says a fake profile has been linked to the organisation’s Facebook business account since October 20 last year.

Festival staffers were locked out of the account, meaning they could no longer buy paid, targeted Facebook promotions.

A resolution seemed close in mid-November after Cuminskey supplied documentation requested by Facebook, including a passport image, copies of recent invoices and various business documents.

But despite multiple emails from Facebook saying it was working on the issue, the festival had yet to regain control of its admin account this week.

Like other small businesses, it can still post regular updates but not use its account for paid promotions. In Cuminskey’s case, this year’s festival, from March 9 to March 23, came and went while the organisation was still stuck in a lock with Facebook.

Auckland marketing firm Razor lost control of its two Facebook business manager accounts on April 1 after, it says, Vietnamese hackers broke two-factor authentication to take control of a linked personal account.

The firm has been able to reach Facebook support since.

“Since this started I have sent at least 44 emails, started at least 14 support tickets and talked to four people on the phone,” Razor ad specialist Carrie McIntosh says.

“But we are constantly talking to people who have no ability to take any action. We receive templated email replies and are constantly asked for patience and given no timelines for fixes.”

Razor co-founder Chanelle Reid told the Herald she had found Facebook’s level of support “surprisingly disappointing”, all the more so given her firm was using the platform’s paid tools.

The lack of progress has affected Razor client Nicole Pye, who as of this week was still locked out of the Facebook business manager account she ordinarily used for three businesses.

The hackers put seven charges of US$1500 on a credit card tied to her Facebook admin account, apparently using the funds to buy ads pushing scams.

Pye says the money was refunded, but as of this week she had still not regained access to her business manager account, despite having been a Facebook advertiser for 10 years to the tune of $7000 to $8000 a month recently. She provided the social network with seven years’ worth of invoices for ads bought on its platform.

She was also frustrated because she had “spent a fortune” on specialist advice to set up campaigns tied to her business manager account and, for now, had no access to seven years of data, which would ordinarily be used to finely target ads.

Facebook owner Meta did not respond to multiple requests for comment on the Auckland Arts Festival, Razor and Pye’s support struggles.

Earlier this month, the Herald reported on two similar cases, involving Auckland’s Scott Lawrie Gallery and Christchurch tech firm Swiftpoint.

Both had been struggling, without success, to regain control of hijacked Facebook accounts for weeks. They gained access only after the Herald approached Meta’s PR team.

In those cases, Meta did not answer questions about why it had taken so long to act, or the timeframe within which a small business or individual could expect a response.

A spokesman offered a general comment: “Scammers present a challenge in any online environment and social media platforms are no exception. We’re committed to safeguarding the integrity of our services and dedicate substantial resources and technology solutions to protect our community from fake accounts and other inauthentic behaviour.”

Meta works with government-backed agencies in New Zealand to minimise fraudulent activity online.

Facebook has an online help and reporting section for hijacked or fake accounts here. Individuals and small businesses can also report a security breach to Crown agency Cert NZ or the Crown-backed Netsafe or ID Care.

Across the Tasman, the Australian Competition and Consumer Commission has taken legal action against Meta, claiming that it has not been assertive enough in enforcing its own policies against scammers and that Facebook has generated “substantial revenue” from scam ads.

An ACCC spokesperson told the Herald the first Federal Court hearing for the case was scheduled for June.

Meta earlier told the Herald it would not comment on the case while it was before the courts.

NZ’s Commerce Commission says it is keeping a watching brief.

Although there have been cuts to staff at Meta, Twitter and Google, there were still “excellent lines of communications”, NZTech chief executive Graeme Muller told the Herald this week. NZTech is the administrator of the Aotearoa New Zealand Code of Practice for Online Safety and Harms, a self-regulatory code put together by Netsafe.