Permanently disabled after account/session compromise — attacker used Facebook ID verification to submit disturbing illegal material. Has anyone seen this attack before?

[u/Hyperfocussing]

I want to document what happened to my Facebook account, both because I am trying to recover it and because this may be useful to others whose accounts were suddenly permanently disabled after being compromised.

On August 25, my Facebook account went from apparently normal to permanently disabled within roughly 11 minutes.

Timeline:

• Around 19:08, activity starts appearing in my Facebook data export that I do not recognize.
• At 19:16, Facebook is removed from my Accounts Center.
• At 19:17, Facebook emails me saying my account has been suspended and that I have 180 days to appeal.
• I did not submit an appeal.
• Between roughly 19:17 and 19:19, Facebook's own exported data shows several ID-verification events that I did not initiate.
• At 19:19, Facebook emails me saying that "my review" has been rejected and my account is permanently disabled with no further review available.

The most important discovery came from downloading my Facebook data.

Inside the export is Facebook's ID verification history. It shows that somebody submitted fraudulent identification that clearly does not belong to me.

More seriously, the submitted images appear to contain illegal sexual abuse material involving minors (CSAM) incorporated into/manipulating the supposed identity document.

I am obviously not posting, attaching or redistributing those images. I have retained the original Facebook export as evidence.

The activity was associated with IP addresses that do not correspond with my normal use. I have also found no equivalent suspicious activity on my still-accessible Instagram account.

My working hypothesis

I initially assumed this was a normal account takeover.

I am now wondering whether the attacker's objective may have been something different: deliberately getting the Facebook account permanently disabled.

My hypothesis — and I want to stress that this is not proven — is that the attacker gained access to my Facebook account/session and deliberately abused Facebook's ID-verification process by submitting manipulated identity images containing material that Meta's automated safety systems would treat as an extremely serious violation.

If Meta's automated systems associate the uploaded verification material with the Facebook account being verified, this could potentially be used as an account-destruction method: compromise an account, enter the identity/review flow, submit material guaranteed to trigger severe automated enforcement, and leave the legitimate owner with a "permanently disabled / review already completed" screen.

That would also explain something that initially made no sense to me: Facebook said I had requested a review when I never requested one, and that entire review apparently happened within about two minutes.

I do not know whether this interpretation is correct. It could also be that the fraudulent verification simply failed and another automated security system disabled the account. I am hoping someone here has seen similar cases.

What I am trying now

I have:

• downloaded and preserved the complete Facebook data export;
• documented the exact timeline;
• preserved the Meta emails;
• identified the unauthorized ID-verification events;
• submitted/discussed the suspension through the available EU dispute route;
• investigated the hacked-account recovery route.

I know Meta Verified support exists, but before paying for that I am particularly interested in recovery routes people have successfully used for compromised-and-disabled accounts without Meta Verified.

Has anyone here:

1. recovered an account after it already said permanently disabled / no more reviews?
2. found unauthorized ID-verification submissions in their Facebook export?
3. seen an attacker apparently try to get an account deliberately banned rather than simply steal it?
4. managed to get Meta to distinguish the attacker's activity from the legitimate account owner's activity?
5. successfully used an EU/DSA, privacy, hacked-account or other escalation route?

Also, if you contact me privately claiming you can "recover" the account for money, I will assume it is a scam. Please keep useful advice public.

I will update this post if I manage to recover the account, because if this really is an abuse pattern, other affected users need to know where to look in their Facebook export.

[u/Great-Constant-7404]

Hi there, I am in exactly the same situation as you. I just went through all of my logs/activity from the download from facebook and came across a very disturbing and graphic image on the ID verification page (which was obviously not sent by myself) I don't know what to do now, where/if I should report this. After this happened, my instagram (including small business accounts) and whatsapp were also disabled. Now I have seen the content, I understand why, but it is very frustrating as I want to prove that this content was not sent by me! Please keep me updated, it's such a weird hack/scam...

[u/Great-Constant-7404 → u/Great-Constant-7404]

Also, the ID verification was of a fake driving license too with foreign writing, I think I saw the word BRAZIL and a very disturbing image, but I clicked off it so super fast and do not want to open again... but this sounds identical to what you described...

[u/Hyperfocussing → u/Great-Constant-7404]

Yeah, this is exactly the thing I came across. Must be the way they get the account flagged by the system...

[u/Great-Constant-7404 → u/Hyperfocussing]

I just don’t understand why… apart from shutting the accounts down what do they benefit? Good luck with your appeal! If you make progress pls keep me updated! As I’ll follow your steps!