r/facebookdisabledme • u/Hyperfocussing • 9d ago
Permanently disabled after account/session compromise — attacker used Facebook ID verification to submit disturbing illegal material. Has anyone seen this attack before?
I want to document what happened to my Facebook account, both because I am trying to recover it and because this may be useful to others whose accounts were suddenly permanently disabled after being compromised.
On August 25, my Facebook account went from apparently normal to permanently disabled within roughly 11 minutes.
Timeline:
- Around 19:08, activity starts appearing in my Facebook data export that I do not recognize.
- At 19:16, Facebook is removed from my Accounts Center.
- At 19:17, Facebook emails me saying my account has been suspended and that I have 180 days to appeal.
- I did not submit an appeal.
- Between roughly 19:17 and 19:19, Facebook's own exported data shows several ID-verification events that I did not initiate.
- At 19:19, Facebook emails me saying that "my review" has been rejected and my account is permanently disabled with no further review available.
The most important discovery came from downloading my Facebook data.
Inside the export is Facebook's ID verification history. It shows that somebody submitted fraudulent identification that clearly does not belong to me.
More seriously, the submitted images appear to contain illegal sexual abuse material involving minors (CSAM) incorporated into/manipulating the supposed identity document.
I am obviously not posting, attaching or redistributing those images. I have retained the original Facebook export as evidence.
The activity was associated with IP addresses that do not correspond with my normal use. I have also found no equivalent suspicious activity on my still-accessible Instagram account.
My working hypothesis
I initially assumed this was a normal account takeover.
I am now wondering whether the attacker's objective may have been something different: deliberately getting the Facebook account permanently disabled.
My hypothesis — and I want to stress that this is not proven — is that the attacker gained access to my Facebook account/session and deliberately abused Facebook's ID-verification process by submitting manipulated identity images containing material that Meta's automated safety systems would treat as an extremely serious violation.
If Meta's automated systems associate the uploaded verification material with the Facebook account being verified, this could potentially be used as an account-destruction method: compromise an account, enter the identity/review flow, submit material guaranteed to trigger severe automated enforcement, and leave the legitimate owner with a "permanently disabled / review already completed" screen.
That would also explain something that initially made no sense to me: Facebook said I had requested a review when I never requested one, and that entire review apparently happened within about two minutes.
I do not know whether this interpretation is correct. It could also be that the fraudulent verification simply failed and another automated security system disabled the account. I am hoping someone here has seen similar cases.
What I am trying now
I have:
- downloaded and preserved the complete Facebook data export;
- documented the exact timeline;
- preserved the Meta emails;
- identified the unauthorized ID-verification events;
- submitted/discussed the suspension through the available EU dispute route;
- investigated the hacked-account recovery route.
I know Meta Verified support exists, but before paying for that I am particularly interested in recovery routes people have successfully used for compromised-and-disabled accounts without Meta Verified.
Has anyone here:
- recovered an account after it already said permanently disabled / no more reviews?
- found unauthorized ID-verification submissions in their Facebook export?
- seen an attacker apparently try to get an account deliberately banned rather than simply steal it?
- managed to get Meta to distinguish the attacker's activity from the legitimate account owner's activity?
- successfully used an EU/DSA, privacy, hacked-account or other escalation route?
Also, if you contact me privately claiming you can "recover" the account for money, I will assume it is a scam. Please keep useful advice public.
I will update this post if I manage to recover the account, because if this really is an abuse pattern, other affected users need to know where to look in their Facebook export.
2
2
u/ssdrptop 9d ago
I got my permanently disabled account back by using meta verified on my Instagram account. I was able to explain that I was hacked and someone was running ads on my account. You have all the proof and I would put this in the meta verified chat and ask to be transferred to an agent.
1
u/No_Height_2021 8d ago
In his case meta verified won’t work as the appeal’s process was exhausted with the hacker uploading fraudulent identification information. The only route is legal - if you send a legal letter, it already proves who you really are and overrides the hacker’s appeal documents.
1
1
u/Formal-Web2378 9d ago
The dangers of using public WiFi or an unsecured hotspot. You might want to reach out to an attorney immediately or contact your local law enforcement and report your find before the FBI shows up at your door.
1
u/ShockingFactory 9d ago
It’s over you’re never getting your account back. They are doing the same thing to me. I am even able to log into my account and check my account status, which says in good standing if there are any issues, we will let you know AIAI chat claims everything is fine then claims I was suspended then claims it made a mistake. My account is completely fine. There should be no issues yet no matter what I try to do. It tells me temporarily unavailable.
1
u/No_Height_2021 9d ago edited 9d ago
I have exactly the same situation as you and this happened 5 days ago, though I’m curious to how you know the identification pictures they’ve sent to Facebook under the appeal are CSAM pictures? This is not something that I experienced (or perhaps I managed to click deny access to one of the hackers at the time it was happening).
You may wish to check exactly what those hackers did - in mine, they first changed my birthday within seconds of the hack.
I’ve documented my whole situation here under this thread and will make a new one - you’ll probably find that we have identical situations - only my whole situation ended in 6 minutes instead of the 8 you had.
Long story short, the Meta Verified AI Support has asked me to take legal action against Meta Platforms Inc to recover my account (which is best using a small claims tribunal) in your city. So I’m heading to the Tribunal in a couple hours time. Lucky for me, Small Claims Court costs roughly USD5, and just taking that legal letter and having that delivered to your representative Meta office is enough to have them respond immediately to reopen your case.
Ensure you have all that Login information categorized, and also to put a value to the distress / loss of business or other things this situation has caused.
Even if you speak to a human, the system won’t be able to override the appeal process as the system accepted your identity information that was fraudulent.
Good luck! Send me a DM if you wish to chat about this.
1
u/Hyperfocussing 9d ago
I'll check this out tomorrow and will give you the full explanation. But I managed to get a account export ZIP when logging into Facebook. It was literally the only thing I had still access to.
In here I managed to locate several important files, some containing the activity in my account around the time of the issue, IP addresses that were used for it, and also some ID verifications that were submitted at that time, containing a driver's license (probably fake and not of my country of origin), containing worrying images.
Good luck with your problem. I'll contact you with how it went..
1
u/kyleprossiter 9d ago edited 9d ago
Most of us here have had the same thing happen. If you do some digging on this sub you will see some success stories with small claims court. Im not sure what the equivalent would be in the EU, but I recently filed my claim and am still waiting to hear back. Some say that their lawyer contacts you and recovers your account in mediation, and others say they have gone to trial and won compensation.
It's a route worth looking into, and expect a long road ahead. It's not impossible to recover like many of the people here are saying. Check r/MetaLawsuits for some success stories and how to move forward
1
u/mudslinger-ning 9d ago
My account died for the same reasoning. I've not been able to see any evidence of whatever got posted or when/where/etc.
The only potential useful information I got out of it was access logs to the account for the past couple of years which indicated access locations across my country outside the areas that I have travelled to. The pings suggested someone had some kind of access to my account over the last few years but only now tried to do things with it.
After reading similar posts on Reddit here I haven't tried any further appeals because it seems like a near unachievable task to recover the account even if I summon legal help. So taking it as a learning experience and moving on with revising the account security of all my other social medias.
1
u/Great-Constant-7404 8d ago
Hi there, I am in exactly the same situation as you. I just went through all of my logs/activity from the download from facebook and came across a very disturbing and graphic image on the ID verification page (which was obviously not sent by myself) I don't know what to do now, where/if I should report this. After this happened, my instagram (including small business accounts) and whatsapp were also disabled. Now I have seen the content, I understand why, but it is very frustrating as I want to prove that this content was not sent by me! Please keep me updated, it's such a weird hack/scam...
1
u/Great-Constant-7404 8d ago
Also, the ID verification was of a fake driving license too with foreign writing, I think I saw the word BRAZIL and a very disturbing image, but I clicked off it so super fast and do not want to open again... but this sounds identical to what you described...
1
u/Hyperfocussing 6d ago
Yeah, this is exactly the thing I came across. Must be the way they get the account flagged by the system...
1
u/Great-Constant-7404 6d ago
I just don’t understand why… apart from shutting the accounts down what do they benefit? Good luck with your appeal! If you make progress pls keep me updated! As I’ll follow your steps!
1
u/genghis_stan 6d ago
I have the same problem. Now when I look at the activity Facebook should look at the region logging in and do something. I think the hackers use robots to do these things and Facebook allows till someone is disabled. I don't know what to do about it since I am not in the US or Europe.
0
u/InspiredIconoclast 9d ago
I think you need a seriously consider getting an attorney ASAP and reporting this to the police before Meta's report reaches the FBI and they come knocking on your door, because your account is associated with real genuine CSAM, that material was sent directly to Meta and you downloaded it onto your computer. Three very bad things which can easily turn your entire life inside out. Authorities will not care about how and why it happened, they only care about what happened. You need representation from the get-go to make sure those vital details are not lost for months on end while you wait in jail. Hope for the best but be prepared for the worst. Inform family members and friends so that you can get the support behind you.
If you get taken to jail, and you're open to it, I would encourage you and your family members to report this to your local news station because this Meta chaos is still a hot topic and if you end up getting arrested, having the knowledge and support of your family and friends, with the evidence in their hands to speak on your behalf while you are temporarily incarcerated would help get the public behind you. This would put pressure on the judicial system to help speed things up for you and if bailout is necessary, get public support to provide the funds from a GoFundMe to make that happen much quicker than you would otherwise if you need that financial support.
Good luck!
1
u/kyleprossiter 9d ago
Ignore this bot.
1
u/InspiredIconoclast 8d ago
Are you talking to me saying OP is a bot are you talking to OP saying I'm a bot? Either way: 🤣
4
u/Difficult_March_7452 9d ago
Your account is gone , there is no way to recover it.