‘It haunts you': Hackers, hijackers lock up Facebook pages

Yahoo

a day ago

GRAND RAPIDS, Mich. (WOOD) — If scammers take over your social media account, you're encouraged to with the Michigan attorney general's office.
The A.G.'s Office of Corporate Oversight has had some success helping victims of the increasingly pervasive scam regain control of their pages.
'Happy news!' texted one victim who'd contacted Target 8 investigators for help. 'I got my accounts back today. Attorney General's office made it happen.'
Account takeovers are hardly a new phenomenon, but the problem has grown significantly.
Attorney General Dana Nessel's office told Target 8 it received 50 such complaints in 2022, 185 in 2023, 485 in 2024, and 127 in the first few months of 2025.
In March 2024, attorneys general nationwide penned a letter to Meta requesting the company take 'immediate action to address the… dramatic and persistent spike in complaints … concerning account takeovers…. We refuse to operate as the customer service representatives of your company,' the AGs declared.
Kelly Roper, a Grand Rapids business owner whose Facebook page was hijacked, is hoping Dana Nessel's office will come through for her.
She filed a complaint with the attorney general's office at Target 8's suggestion.
'I didn't know that I could do that,' said Roper in a recent interview with Target 8. 'I reported the fraud to Facebook. Every time you do something, it's a dead-end. You cannot get to anybody. You cannot talk to anybody. It is so frustrating.'
It's been ten months since a criminal took over Roper's personal Facebook page, and she's still unable to access it.
Her personal FB account is tied to her business page, which makes it difficult to market her business.
Roper owns Show Salon in downtown Grand Rapids.
Fake posts selling cars and crypto
'Around August of 2024, I had a friend reach out to me and say, 'I didn't know that you were selling a car on Facebook,' recalled Roper. 'I said, 'I'm not selling a car. I don't know what this is.''
It was the scam that's targeting individuals, businesses, and celebrities everywhere.
In Roper's case, it started with the fake car-selling post.
'I actually reached out to Facebook and told them, 'I've been hacked. This is not me,'' explained Roper, noting that friends and family reported it too.
No response from Meta, the company that owns Facebook, said Roper.
Then, her Facebook page was disabled, so she started up a new one.
That was in January of 2025.
'Around February or March, I get this call from a friend that said, 'I don't know if you know this, but somebody's posting that you are selling crypto,'' Roper told Target 8 in an interview at her salon on Monroe Center NW.
The new post included a picture of a certificate with CyrptoCurrency Certification Consortium across the top.
Roper's name was on it.
'Congratulations to me,' read the fraudulent post. 'So, this just came in today after months and months of endless study and training. I'm happy to announce that I've been certified as an Expert Crypto Trader after undergoing the rigorous training which lasted for over 24 months.'
Fortunately, Roper's Facebook friends were not fooled.
'Everyone who knows me knows that I'm not going to sell crypto,' said Roper. 'I would never get involved in something like that. But it started posting all over Facebook, and, I mean, everywhere. It looked so official with my name on it. So, I was pretty obviously upset. I own a business. I didn't want people thinking that I did this, because I didn't. It was not me.'
Another post featured a picture of a smiling middle-aged couple holding Roper's fake crypto certificate and praising her services.
'Kelly (Roper) is God sent (sic). Our debit are (sic) paid fully. $180k,' read the fraudulent post.
Roper said she followed the steps in the 'Recover your hacked account' section of Facebook's online help center to no avail.
When she tried to set up another Facebook page, she said Meta rejected it.
'It said, 'We reviewed your account and found it still does not follow our community standards on account integrity,'' recalled Roper. 'Not sure what that means because this is a brand-new account. I have not posted anything on it other than a picture of me.'
At one point, Roper scanned her face.
No luck there either.
'(The) Facebook page said, 'scan your picture.' explained Roper. 'So, I scan it, and I still get rejected. (They say) that I'm not me.'
The salon has found a work-around though; employees post on Instagram, and it shows up on the salon's Facebook page.
'It haunts you'
Still, Roper feels personally violated.
'It haunts you,' said the salon owner. 'There are pictures of my kids, my dogs, my family. You know, this is a big deal.'
BlackCloak Digital Executive Protection, a Florida-based cybersecurity firm, told Target 8 that Roper's experience is far from unique.
'It is very difficult,' said Ingrid Gliottone, Chief Experience Officer at BlackCloak, in a Zoom with Target 8. 'We're seeing it across the board trying to get a hold of an individual at any of these platforms to be able to retain access. I would say it's probably about a 50/50 shot that if you have your account compromised… you will be able to regain the account, unfortunately. It's just a flip of the coin what the system will accept or not.'
Gliottone blamed Meta's lack of responsiveness on workforce reductions.
'Prior to COVID, these larger platforms like Meta, for example, had a lot more individual staff to be able to review those requests for when you thought your account was being impersonated, or your account was compromised and locked out,' explained Gliottone. 'What ultimately ended up happening, we saw a lot of those individuals be removed from those positions due to economic conditions.'
Fewer humans, more automation
In 2022, Mark Zuckerberg, founder, chairman and CEO of Meta, announced the company was cutting 11,000 jobs.
'That's why individuals… are having more difficulty trying to retain access to accounts,' explained Gliottone, 'because they're going up against automated systems and workflows, right? They'll go in and they'll submit, and they don't have… the documentation needed, so the system will automatically spit it back out and deny it.'
Gliottone said some BlackCloak clients never regained access to their accounts.
But she urges you to keep trying; report the fraud to Meta repeatedly and have friends and family do the same.
'(It took one client) almost nine months before they were able to regain (control). They just kept trying.'
Gliottone said weak passwords are most often to blame when bad actors gain access to accounts.
Passwords and dual-factor authentication
She urges you to create complex, unique, passwords, get comfortable using password managers, don't use variations of the same password and always enable dual-factor authentication.
Prevention is the best protection.
'Some of the ways we have our clients achieve this in a relatively easy fashion is to think of short phrases or sentences because those are easier to remember,' explained Gliottone, referring to password generation. 'For instance, 'I love to fly.' You start off with capital 'I' and then, 'love' and then instead of 'to', you can use the number '2', and then 'fly' and you end with a period or an exclamation point. Strong passwords, that's the number one most important thing. Then dual-factor authentication is the next piece.'
Facebook's online help center has pages on how to or someone pretending to be you or someone else on messenger.
Target 8 sent emails to Meta and Facebook requesting comment.
We received no response.
Copyright 2025 Nexstar Media, Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.