I'm very sorry to hear this has happened to you. I, too, had my Facebook account compromised last week. My account of 15 years that I'd grown up with: a coupl

I'm very sorry to hear this has happened to you. I, too, had my Facebook account compromised last week. My account of 15 years that I'd grown up with: a couple thousand friends I'd connected with travelling the world, 90% of my day-to-day comms, a decade and a half of photos and memories etc. The part that hurts the most is that I've lost countless photos of and messages from my father who passed away a few years ago. Pretty heartbreaking. To those who would mock me for being so invested in Facebook, I'd point out that I'm 27: that is to say that I entered my teenage years just as Facebook began to take off. In retrospect, it's obvious that Facebook is evil and doesn't give a shit about their users, but alas, at the time it wasn't so clear to 13 year old me (nor my peers) that we'd risk ending up in a Kafkaesque nightmare. Interestingly, the only conclusion I can point to as to how my account was compromised is that my session data was somehow compromised, allowing the attackers to enter my account without having my password or access to my email which served as 2fa. Apparently Facebook auth related 0days are quite common due to their incentive to keep you logged in and their lackluster security. In my case, they didn't change my password as they didn't have it, instead they were simply able to log in and add a secondary 2fa (a hardware key) which effectively locked me out so I couldn't declare something was wrong. Pretty smart. From there, as I understand from my research, they immediately proceed to get your personal account banned so that you can't recover your Business Manager (advertising) account, which is what they're after. It looks like I was banned within 20 minutes or so of the attackers gaining access. Worryingly, I've read that the way they get you banned so swiftly is through uploading CSAM/terrorist content, which results in an immediate ban and potentially a notification to law enforcement. I'm guessing this is why accounts are seldom recovered when attacked in this way. On the support front, I've had a similarly frustrating experience trying to get help from Facebook — from searching here on HN and across various blogs & forums, there seem to be two methods of recourse: 1) The mysterious 'Oops' internal ticketing system at Facebook/Meta[1] for friends and family. This allows your case to be viewed by a real human, and from what I've read leads to it being restored within 24 hours. 2) You buy an Oculus and use the serial number to raise a ticket with Oculus support, which gives you the ability to submit evidence and have your case viewed by a team at Facebook (hopefully). I own a Rift S, so I was able to go the 2nd route, but it's been close to a week now and I haven't seen any results nor had a response. So yeah, it's pretty bleak. Despite my account being banned, the attackers are still setting up Facebook Ads. I get multiple emails every day that new ads have been approved for their scam stores. Salt in the wounds. Note this article[2] I came across of a similar attack a couple of months ago. I reached out to the author on Twitter[3] to see if she'd had any luck with recovery, but alas she had not, despite raising several tickets at Facebook. So, sadly it looks like we're fucked, although I'd be glad to be wrong. [1] https://www.cnbc.com/2019/03/14/facebook-oops-special-employee-hotline-for-faster-customer-support.html https://www.cnbc.com/2019/03/14/facebook-oops-special-employ... [2] https://www.forbes.com/sites/forbesagencycouncil/2022/03/22/what-i-learned-from-being-targeted-by-a-sophisticated-facebook-hack/?sh=177645d36239 https://www.forbes.com/sites/forbesagencycouncil/2022/03/22/... [3] https://twitter.com/TheCoppinger/status/1529685795270864896 https://twitter.com/TheCoppinger/status/1529685795270864896