Angela McNamara's first hint that her Facebook account had been hacked was an early-morning email warning that someone was trying to log into her account.
"If this is not you, don't worry, we're keeping your account safe," she recalls the email from Facebook saying. But her relief only lasted a minute, when another email arrived, saying her password had been changed. Then another, notifying her that a two-factor authentication — an extra layer of security — had been set up for her account.
"And then from there I'm just like, 'OK, it is gone,' " said McNamara, who lives outside Toronto. She tried Facebook's automated process to recover her account: getting a backup code, resetting her password. But nothing worked.
This has been happening to a lot of people lately, and the experience has left many users nearly as frustrated with the social network as they are with the hackers. In July, NPR received 19 emails from listeners complaining that their Facebook accounts had been hacked or disabled. People share similar tales of woe on Reddit forums and Twitter every day.
Some became so desperate that they shelled out hundreds of dollars to buy a virtual reality headset in an attempt to get Facebook to restore their accounts.
When she tried to reach Facebook, "Nobody got back to me, not once"
Before going to extremes, many hacking victims try the usual routes to get customer service but quickly find out it seems impossible to reach someone at Facebook to help fix the problem.
"Facebook didn't have a phone number to call. There was no email to email," said Jessie Marsala, who lives outside Chicago and emailed NPR in early July about her situation.
When Marsala got hacked, she tried dialing Facebook's headquarters in Silicon Valley. But that number yields a recording that says, "Unfortunately, we do not offer phone support at this time."
Instead, Facebook tells users to report hacked accounts through its website. The site instructs them to upload a copy of a driver's license or passport to prove their identities. But the people NPR spoke with said they had trouble with every step of this automated process and wish Facebook would offer a way to reach a real person.
"I sent these forms in morning, noon and night, multiple times a day," Marsala said. "Nobody got back to me, not once."
Victoria Floriani of Jersey City, N.J., only got Facebook's system to accept her driver's license after she covered up everything but her name and photo with a Post-it note — a tip she came across on Reddit. After two weeks of trying, it was the breakthrough she needed to get her account back.
Facebook said that because of the coronavirus pandemic, it has fewer people available to review IDs. It uses artificial intelligence, too, but its help center warns that reviews "may take longer than usual."
Facebook spokesperson Gabby Curtis told NPR in a statement that the company's help center is available 24 hours a day to assist people with problems and report issues. But Curtis acknowledged, "We also know that we need to keep improving in this area and plan to invest more in the future."
A solution for those willing to pay $299
Brandon Sherman of Nevada City, Calif., followed a tip he found on Reddit to get his hacked account back.
"I ultimately broke down and bought a $300 Oculus Quest 2," he said. Oculus is a virtual reality company owned by Facebook but with its own customer support system.
Sherman contacted Oculus with his headset's serial number and heard back right away. He plans to return the unopened device, and while he's glad the strategy worked, he doesn't think it's fair.
"The only way you can get any customer service is if you prove that you've actually purchased something from them," he said.
When McNamara, the Facebook user in Canada, first heard about the Oculus trick, she thought it was a joke. But she said, "Once I started thinking about it, all my memories, I really realized that I wanted to do whatever possible to get it back."
So she, too, ordered an expensive gadget she never planned to use and returned it as soon as she got back into her Facebook account.
(A warning to anyone thinking about trying this — other Reddit users have said they tried contacting Oculus support but were unable to get their Facebook accounts restored. Also, last week, Facebook said it was temporarily halting sales of the Oculus Quest 2, which retails starting at $299, because its foam lining caused skin irritation for some customers.)
Hacking victims fear losing money and memories
Losing Facebook may seem like a minor thing, but it can have real consequences.
"The very first concern, after realizing that I was getting hacked, is that these folks might be able to gain access to my business's bank account," said Ben Coleman in Fall River, Mass. "That would be a disaster."
Coleman's day job is teaching math and technology to kindergarteners through 12th-graders, but he also films videos with drone cameras and writes books about how to fold origami bonsai trees. For both ventures, he relies on Facebook to reach customers.
Coleman managed to lock his Facebook account before the hackers could gain control. But he wasn't able to unlock it — so he lost access to everything.
For Jon Morgan in Shepherd, Mich., it got worse. Hackers used his Facebook account to vandalize the page he helps manage for his town's maple syrup festival. Facebook disabled Morgan's account — so now he has lost access to a lot of family photos, including of his son who passed away this year.
Morgan said the episode has made him realize just how embedded Facebook is in his life.
"We think of it as a kind of like a plaything or something for fun, but people share news on it, people get their news from it, it's a photo album," he said. "I think what I've kind of learned from my experience is, I really need to think about how I'm using it ... and what it means to me to lose it."
After NPR got in touch with Facebook, it sent Coleman and Marsala links to unlock their accounts and is giving Morgan another chance to appeal the disabling of his account.
What's fueling hacking? Financial gain — and even disinformation campaigns
Facebook said it has not seen a recent uptick in hacking, and it's not clear who is behind the hacks people contacted NPR about.
Many attempts to hack social media accounts are financially motivated, said Jon Clay, vice president of threat intelligence at cybersecurity firm Trend Micro.
A hacker may try to scam the user's friends and contacts to give them money, he said, or sell accounts on the black market.
Clay said other hackers want to steal Facebook accounts to spread disinformation, about topics such as the 2020 election or COVID-19.
"The fact that social media is now a big part of everybody's lives [means] it is a major target," he said.
Editor's note: Facebook is among NPR's financial supporters.
MARY LOUISE KELLY, HOST:
Here at ALL THINGS CONSIDERED, we get all kinds of comments from listeners. They tell us they liked a story, or they didn't like a story or we should cover more news about dinosaurs. Recently, though, we started getting a lot of comments like this.
UNIDENTIFIED PERSON #1: I got an email at 5:02 saying somebody was trying to get into my Facebook account.
KELLY: And this.
UNIDENTIFIED PERSON #2: I was desperate. I had no one else to contact because Facebook didn't have a phone number to call. There was no email to email.
KELLY: Their Facebook accounts had been hacked, and they were frustrated. We asked NPR tech correspondent Shannon Bond to investigate. And a note - Facebook is among NPR's financial supporters.
SHANNON BOND, BYLINE: One morning back in May, Angela McNamara woke up in Toronto to a foreboding email from Facebook.
ANGELA MCNAMARA: And it said, Angela, it appears that somebody is trying to log into your account. If this is not you, don't worry - we're keeping your account safe.
BOND: But that wasn't all.
MCNAMARA: So that came at, like, let's say 2:58 - 2:59 it says, your password has been changed. Another email, 3:00 a.m., two-factor authentication has been set up. And then from there, I'm just like, OK, it is gone.
BOND: She'd been hacked. She tried to stay calm and started going through Facebook's process to recover her account. She tried getting a backup code, resetting her password. Nothing worked. This has been happening to a lot of people lately. And when it does happen, good luck trying to call up Facebook to fix it.
(SOUNDBITE OF ARCHIVED RECORDING)
UNIDENTIFIED PERSON #3: (As automated voice) Thank you for calling Facebook user operations. Unfortunately, we do not offer phone support at this time.
BOND: There's no simple way to reach a real person by email, either. Instead, the company tells users to report hacked accounts through its website, where they're asked to upload a copy of a driver's license or passport to prove their identity. And many people who try it say this automated process often just doesn't work, like Jessie Marsala in Chicago.
JESSIE MARSALA: I spent hours and hours filling out these request forms. I sent these forms in morning, noon and night, multiple times a day, and nobody got back to me, not once.
BOND: Another person I talked to only got Facebook's system to accept her ID after she covered up everything but her name and photo with a Post-it note. Facebook says because of the pandemic, it has fewer people available to confirm IDs. It uses artificial intelligence, too, but it says the process is taking longer than usual. Now, losing Facebook may seem like a minor thing, but Marsala has been using the social network since high school. And every morning she likes to look at its memories feature, which highlights old posts.
MARSALA: And that's just a way I used to like to start my day and kind of reflect on, you know, what I did two years ago or what was I thinking seven years ago, just kind of see, you know, are my thoughts still the same? Do I still have the same outlooks on life? Things like that.
BOND: So this is a big deal to her, and she and other people in her situation, since they can't turn to Facebook, they're turning to each other. On websites like Twitter and Reddit, lots of people are sharing stories of being hacked and tips about what to do. One of them is Ben Coleman, a teacher in Massachusetts who has a side hustle writing books that teach you how to fold origami bonsai trees.
BEN COLEMAN: The very first concern after realizing that I was getting hacked is that these folks might be able to gain access to my business's bank account, and that would be a disaster.
BOND: He managed to lock his Facebook account before the hackers could get in, but he wasn't able to unlock it. That is, until after NPR got in touch with Facebook. The company says it has not seen a recent uptick in hacking. And security experts I spoke with say there's lots of reasons hackers target Facebook accounts - selling them on the black market, scamming users' friends for money. Some even use hacked accounts to push out disinformation. But the people I talked to aren't just frustrated with the hackers. They're unhappy with Facebook, too.
COLEMAN: I want Facebook to have a customer service department that some old 86-year-old lady can call up and say, my account has been hacked - please help me get back in. I want a human being on the telephone.
BOND: A Facebook spokesperson says its online help center is available at any time, but the company knows it needs to improve and plans to invest more in customer support. Meanwhile, some people are going to extreme lengths to get their accounts back. It turns out Facebook does offer better customer service, but to get it, you need to buy a virtual reality headset made by Oculus, a company Facebook owns. Brandon Sherman in California did just that.
BRANDON SHERMAN: I ultimately broke down and bought a $300 Oculus Quest 2, have it sitting in the box right here next to me. And as soon as I emailed customer support with the serial number, I got an immediate response.
BOND: Sherman plans to return the unopened Oculus. And while he's glad the strategy worked, he doesn't think it's very fair.
SHERMAN: Unfortunately, what's happening to a lot of people is, like, the only way you can get any customer service is if you prove that you've actually purchased something from them.
BOND: Up in Toronto, Angela McNamara heard about the Oculus trick on Reddit and thought it was a joke, but she figured, why not? So, like Sherman, she ordered an expensive gadget she never planned to use and contacted customer support for Oculus.
MCNAMARA: I did kind of what everybody else did - bought it, didn't open it and returned it.
BOND: And just like that, she was back on Facebook.
Shannon Bond, NPR News.
(SOUNDBITE OF MUSIC) Transcript provided by NPR, Copyright NPR.