First of all, I don't think bad actors are as willing to invest time/work into this as good actors - for them it's not worth the effort in most cases. In this

First of all, I don't think bad actors are as willing to invest time/work into this as good actors - for them it's not worth the effort in most cases. In this specific case, if keeping the account for a longer time had been the goal, the bad actor wouldn't have gotten the account suspended immediately by violating the Terms of Use, nor would they have used a Vietnam IP to do so. Secondly - whenever such a thing does go viral, and Facebook comes under pressure - they all of sudden become very able to tell: - that the person who has been using the account for years without incident, with an US IP address, who can provide 2FA codes, controls the original sign-up email, can produce credit card statements for payments the account made, sent in a copy of their drivers license, is probably the good actor - that the person who (within just a few hours) reset the password, changed the email, disabled 2FA, and caused the suspension - all from a Vietnam IP - is probably the bad actor. Facebook doesn't have that problem because they are unable to differentiate between bad actors and good actors... Facebook has that problem because they don't want to differentiate good and bad actors - because that costs man-hours and thus money. The support teams dealing with that stuff are probably under-staffed, under-paid, lack the tools/knowledge for deeper investigation, and are being pressured to close as many tickets as fast as possible.