Facebook account takeovers are targeting people you know, turning friendship into fraud

For three days, Lesa Lowery says she could do nothing but watch as a fraudster impersonated her on Facebook, swindling her friends out of thousands of dollars for goods that didn't exist.

The entire time Meta — the company behind the social media site that has billions of users worldwide — ignored the crime.

"I just felt helpless," said Lowery, who told Go Public her account was taken over by the fraudster in early March. "I literally sat there and cried," she said.

"I felt really bad for everybody whose money was taken." She'd connected with hundreds of people on Facebook, many of whom she'd lost touch with in person.

A Go Public investigation found Lowery is one of many being targeted by a scam the social media giant is allowing to run rampant on its site.

Here's how it works: After locking a user out of their account, the scammers begin impersonating the user and claiming an elderly parent has moved into long-term care and that they are selling off some belongings.

"It was a multitude of really good things — hot tubs, trucks, tractors and all these people were messaging," Lowery, from Sussex, N.B., said of the post on her Facebook page.

She could see the posts offering items for sale, but wasn't able to access the direct messages people were sending the scammer.

It's called an account takeover. Once the account is hijacked, the attacker can post publicly and access the victim's contacts and private messages.

It's just one example of big social media players, including Meta, making billions from users while failing "to protect them in such a basic way," said cybercrime expert Claudiu Popa, author of The Canadian Cyberfraud Handbook and a cybersecurity expert who advises government and companies.

Meta — which also owns Instagram, Messenger, Threads and WhatsApp — made about $185 billion Cdn in revenue last year, a 16 per cent year-over-year increase, according to its 2023 annual report.

"There is no customer service," Popa said. "And as a result, what starts as a small issue is exacerbated into a massive identity theft or identity fraud."

In an email to Go Public, Meta said it has "over 15,000 reviewers across the globe review potential violations on Facebook and Instagram," noting that they receive "in-depth training."

But it didn't say why its systems are failing to catch the retirement home scam that's all over the site.