Your Facebook Account Was Hacked. Getting Help May Take Weeks — Or $299 : NPR

image

Angela McNamara's first hint that her Facebook account had been hacked was an early-morning email warning that someone was trying to log into her account.

"If this is not you, don't worry, we're keeping your account safe," she recalls the email from Facebook saying. But her relief only lasted a minute, when another email arrived, saying her password had been changed. Then another, notifying her that a two-factor authentication — an extra layer of security — had been set up for her account.

"And then from there I'm just like, 'OK, it is gone,' " said McNamara, who lives outside Toronto. She tried Facebook's automated process to recover her account: getting a backup code, resetting her password. But nothing worked.

This has been happening to a lot of people lately, and the experience has left many users nearly as frustrated with the social network as they are with the hackers. In July, NPR received 19 emails from listeners complaining that their Facebook accounts had been hacked or disabled. People share similar tales of woe on Reddit forums and Twitter every day.

Some became so desperate that they shelled out hundreds of dollars to buy a virtual reality headset in an attempt to get Facebook to restore their accounts.

When she tried to reach Facebook, "Nobody got back to me, not once"

Before going to extremes, many hacking victims try the usual routes to get customer service but quickly find out it seems impossible to reach someone at Facebook to help fix the problem.

"Facebook didn't have a phone number to call. There was no email to email," said Jessie Marsala, who lives outside Chicago and emailed NPR in early July about her situation.

When Marsala got hacked, she tried dialing Facebook's headquarters in Silicon Valley. But that number yields a recording that says, "Unfortunately, we do not offer phone support at this time."

Instead, Facebook tells users to report hacked accounts through its website. The site instructs them to upload a copy of a driver's license or passport to prove their identities. But the people NPR spoke with said they had trouble with every step of this automated process and wish Facebook would offer a way to reach a real person.

"I sent these forms in morning, noon and night, multiple times a day," Marsala said. "Nobody got back to me, not once."

Victoria Floriani of Jersey City, N.J., only got Facebook's system to accept her driver's license after she covered up everything but her name and photo with a Post-it note — a tip she came across on Reddit. After two weeks of trying, it was the breakthrough she needed to get her account back.

Facebook said that because of the coronavirus pandemic, it has fewer people available to review IDs. It uses artificial intelligence, too, but its help center warns that reviews "may take longer than usual."

Facebook spokesperson Gabby Curtis told NPR in a statement that the company's help center is available 24 hours a day to assist people with problems and report issues. But Curtis acknowledged, "We also know that we need to keep improving in this area and plan to invest more in the future."

A solution for those willing to pay $299

Brandon Sherman of Nevada City, Calif., followed a tip he found on Reddit to get his hacked account back.

"I ultimately broke down and bought a $300 Oculus Quest 2," he said. Oculus is a virtual reality company owned by Facebook but with its own customer support system.

Sherman contacted Oculus with his headset's serial number and heard back right away. He plans to return the unopened device, and while he's glad the strategy worked, he doesn't think it's fair.

"The only way you can get any customer service is if you prove that you've actually purchased something from them," he said.

When McNamara, the Facebook user in Canada, first heard about the Oculus trick, she thought it was a joke. But she said, "Once I started thinking about it, all my memories, I really realized that I wanted to do whatever possible to get it back."

So she, too, ordered an expensive gadget she never planned to use and returned it as soon as she got back into her Facebook account.

(A warning to anyone thinking about trying this — other Reddit users have said they tried contacting Oculus support but were unable to get their Facebook accounts restored. Also, last week, Facebook said it was temporarily halting sales of the Oculus Quest 2, which retails starting at $299, because its foam lining caused skin irritation for some customers.)

Hacking victims fear losing money and memories

Losing Facebook may seem like a minor thing, but it can have real consequences.

"The very first concern, after realizing that I was getting hacked, is that these folks might be able to gain access to my business's bank account," said Ben Coleman in Fall River, Mass. "That would be a disaster."

Coleman's day job is teaching math and technology to kindergarteners through 12th-graders, but he also films videos with drone cameras and writes books about how to fold origami bonsai trees. For both ventures, he relies on Facebook to reach customers.

Coleman managed to lock his Facebook account before the hackers could gain control. But he wasn't able to unlock it — so he lost access to everything.

For Jon Morgan in Shepherd, Mich., it got worse. Hackers used his Facebook account to vandalize the page he helps manage for his town's maple syrup festival. Facebook disabled Morgan's account — so now he has lost access to a lot of family photos, including of his son who passed away this year.

Morgan said the episode has made him realize just how embedded Facebook is in his life.

"We think of it as a kind of like a plaything or something for fun, but people share news on it, people get their news from it, it's a photo album," he said. "I think what I've kind of learned from my experience is, I really need to think about how I'm using it ... and what it means to me to lose it."

After NPR got in touch with Facebook, it sent Coleman and Marsala links to unlock their accounts and is giving Morgan another chance to appeal the disabling of his account.

What's fueling hacking? Financial gain — and even disinformation campaigns

Facebook said it has not seen a recent uptick in hacking, and it's not clear who is behind the hacks people contacted NPR about.

Many attempts to hack social media accounts are financially motivated, said Jon Clay, vice president of threat intelligence at cybersecurity firm Trend Micro.

A hacker may try to scam the user's friends and contacts to give them money, he said, or sell accounts on the black market.

Clay said other hackers want to steal Facebook accounts to spread disinformation, about topics such as the 2020 election or COVID-19.

"The fact that social media is now a big part of everybody's lives [means] it is a major target," he said.

Editor's note: Facebook is among NPR's financial supporters.

Dr. Anthony Fauci, the chief medical adviser to President Biden, says an additional COVID-19 vaccine dose is needed for people who have compromised immune systems.

Speaking to NPR's Morning Edition on Thursday, Fauci, the director of the National Institute of Allergy and Infectious Diseases, said that for those with compromised immune systems, the need is "so imminent to make sure that we get them boosted so that they would be in a protected zone."

The decision to allow a third dose would come from the Food and Drug Administration, which is expected as early as this week to extend its emergency use authorization on vaccines to allow an additional dose.

About 3% of Americans are immunocompromised

Roughly 3% of Americans have an immune system that has been made weaker due to disease, certain medical treatments or organ transplants. For most people, a booster would mean a third dose of vaccine.

The FDA has been evaluating studies showing that people with a compromised immune system can have a weak response to the standard vaccine regimen. Research indicates that a third dose may boost immunity to the coronavirus in these people and protect them from serious COVID-19 complications.

A committee advising the Centers for Disease Control and Prevention will meet Friday to discuss the data about vaccines in immune-compromised people. If the FDA OKs booster shots, the committee is likely to take a vote on whether to recommend the additional dose and outline who should get it.

Scientists also continue to evaluate whether people with normal immune systems might need an additional dose.

The WHO wants developed nations to wait on boosters

Earlier this month, the World Health Organization called on developed countries, such as the United States, to forgo booster shots until less wealthy countries still struggling to vaccinate their populations are able to catch up.

Asked about that concern, Fauci said, "I believe we can do both."

"I feel very strongly, and I've been very vocal about that, that we have a responsibility as a rich nation — and other rich nations — to make sure that there's equity in the ability to distribute and the accessibility of vaccines," he told NPR. "However, the United States is really doing both. If you look at what we are doing, we are essentially doing more than the rest of the world combined."

Arkansas, among the states hardest-hit by a new wave of coronavirus cases linked to the highly contagious delta variant, says it is down to eight unoccupied ICU beds statewide with which to care for COVID-19 patients.

Gov. Asa Hutchison, in a tweet on Monday, said the latest report highlighted "startling numbers."

"We saw the largest single-day increase in hospitalizations and have eclipsed our previous high of COVID hospitalizations," the governor wrote. "There are currently only eight ICU beds available in the state."

"Vaccinations reduce hospitalizations," he added.

Hospitalization of COVID-19 patients jumped by 103 to 1,376, the report cited by Hutchison shows. It's the biggest daily jump and total in the state since the start of the pandemic.

"This is unlike anything that we experienced before during the COVID-19 pandemic," says Dr. Cam Patterson, who serves as chancellor of the University of Arkansas for Medical Sciences, which includes the UAMS Medical Center hospital in Little Rock.

Hospitals are seeing younger patients than before. A year ago, the average COVID-19 patient was over 60 years old, Patterson tells Morning Edition. Now the average age is 40.

Nearly half of the people in the hospital's ICU are there because of COVID-19. About 20% of COVID-19 patients have been pregnant people, Patterson says, some of whom have lost their babies because of the disease.

A year ago, the health system's children's hospital usually had one or two COVID-19 patients. Now there are 22. Many of these patients are eligible for vaccines but haven't been vaccinated, he says.

Medical staff are overwhelmed and exhausted.

"I heard from a nurse who said that she cries in her car before she comes into work now," Patterson says. "We've had nurses walk off in the middle of shifts because they can't take it anymore."

About 17% of nursing positions at the hospital are vacant, which increases the load on the current staff.

"They're taking care of more patients than they're used to and they're just flat worn out," he says.

Arkansas has among the lowest vaccination rates in the country, with fewer than 43% of adults fully immunized.

"It's difficult to come into work and to deal with these challenges when you know that there was an antidote to this, the vaccine that people have chosen not to take. And it's difficult not to become angry," Patterson says.

In April, Hutchison signed into law a statewide ban on further mask mandates. However, in a news conference last week, the governor said he regretted signing the measure, which has complicated his state's efforts to control the spread of the virus.

"In hindsight, I wish that it had not become law," he said. "But it is the law, and the only chance we have is either to amend it or for the courts to say that it has an unconstitutional foundation."

Last week, a court temporarily blocked the law from being enforced.

Portions of this story originally appeared in the Morning Edition live blog.