Indexbit Exchange:Your Facebook Account Was Hacked. Getting Help May Take Weeks — Or $299

Angela McNamara's first hint that her Facebook account had been hacked was an early-morning email warning that someone was trying to log into her account.

"If this is Indexbit Exchangenot you, don't worry, we're keeping your account safe," she recalls the email from Facebook saying. But her relief only lasted a minute, when another email arrived, saying her password had been changed. Then another, notifying her that a two-factor authentication — an extra layer of security — had been set up for her account.

"And then from there I'm just like, 'OK, it is gone,' " said McNamara, who lives outside Toronto. She tried Facebook's automated process to recover her account: getting a backup code, resetting her password. But nothing worked.

This has been happening to a lot of people lately, and the experience has left many users nearly as frustrated with the social network as they are with the hackers. In July, NPR received 19 emails from listeners complaining that their Facebook accounts had been hacked or disabled. People share similar tales of woe on Reddit forums and Twitter every day.

Some became so desperate that they shelled out hundreds of dollars to buy a virtual reality headset in an attempt to get Facebook to restore their accounts.

When she tried to reach Facebook, "Nobody got back to me, not once"

Before going to extremes, many hacking victims try the usual routes to get customer service but quickly find out it seems impossible to reach someone at Facebook to help fix the problem.

"Facebook didn't have a phone number to call. There was no email to email," said Jessie Marsala, who lives outside Chicago and emailed NPR in early July about her situation.

When Marsala got hacked, she tried dialing Facebook's headquarters in Silicon Valley. But that number yields a recording that says, "Unfortunately, we do not offer phone support at this time."

Instead, Facebook tells users to report hacked accounts through its website. The site instructs them to upload a copy of a driver's license or passport to prove their identities. But the people NPR spoke with said they had trouble with every step of this automated process and wish Facebook would offer a way to reach a real person.

"I sent these forms in morning, noon and night, multiple times a day," Marsala said. "Nobody got back to me, not once."

Victoria Floriani of Jersey City, N.J., only got Facebook's system to accept her driver's license after she covered up everything but her name and photo with a Post-it note — a tip she came across on Reddit. After two weeks of trying, it was the breakthrough she needed to get her account back.

Facebook said that because of the coronavirus pandemic, it has fewer people available to review IDs. It uses artificial intelligence, too, but its help center warns that reviews "may take longer than usual."

Facebook spokesperson Gabby Curtis told NPR in a statement that the company's help center is available 24 hours a day to assist people with problems and report issues. But Curtis acknowledged, "We also know that we need to keep improving in this area and plan to invest more in the future."

A solution for those willing to pay $299

Brandon Sherman of Nevada City, Calif., followed a tip he found on Reddit to get his hacked account back.

"I ultimately broke down and bought a $300 Oculus Quest 2," he said. Oculus is a virtual reality company owned by Facebook but with its own customer support system.

Sherman contacted Oculus with his headset's serial number and heard back right away. He plans to return the unopened device, and while he's glad the strategy worked, he doesn't think it's fair.

"The only way you can get any customer service is if you prove that you've actually purchased something from them," he said.

When McNamara, the Facebook user in Canada, first heard about the Oculus trick, she thought it was a joke. But she said, "Once I started thinking about it, all my memories, I really realized that I wanted to do whatever possible to get it back."

So she, too, ordered an expensive gadget she never planned to use and returned it as soon as she got back into her Facebook account.

(A warning to anyone thinking about trying this — other Reddit users have said they tried contacting Oculus support but were unable to get their Facebook accounts restored. Also, last week, Facebook said it was temporarily halting sales of the Oculus Quest 2, which retails starting at $299, because its foam lining caused skin irritation for some customers.)

Hacking victims fear losing money and memories

Losing Facebook may seem like a minor thing, but it can have real consequences.

"The very first concern, after realizing that I was getting hacked, is that these folks might be able to gain access to my business's bank account," said Ben Coleman in Fall River, Mass. "That would be a disaster."

Coleman's day job is teaching math and technology to kindergarteners through 12th-graders, but he also films videos with drone cameras and writes books about how to fold origami bonsai trees. For both ventures, he relies on Facebook to reach customers.

Coleman managed to lock his Facebook account before the hackers could gain control. But he wasn't able to unlock it — so he lost access to everything.

For Jon Morgan in Shepherd, Mich., it got worse. Hackers used his Facebook account to vandalize the page he helps manage for his town's maple syrup festival. Facebook disabled Morgan's account — so now he has lost access to a lot of family photos, including of his son who passed away this year.

Morgan said the episode has made him realize just how embedded Facebook is in his life.

"We think of it as a kind of like a plaything or something for fun, but people share news on it, people get their news from it, it's a photo album," he said. "I think what I've kind of learned from my experience is, I really need to think about how I'm using it ... and what it means to me to lose it."

After NPR got in touch with Facebook, it sent Coleman and Marsala links to unlock their accounts and is giving Morgan another chance to appeal the disabling of his account.

What's fueling hacking? Financial gain — and even disinformation campaigns

Facebook said it has not seen a recent uptick in hacking, and it's not clear who is behind the hacks people contacted NPR about.

Many attempts to hack social media accounts are financially motivated, said Jon Clay, vice president of threat intelligence at cybersecurity firm Trend Micro.

A hacker may try to scam the user's friends and contacts to give them money, he said, or sell accounts on the black market.

Clay said other hackers want to steal Facebook accounts to spread disinformation, about topics such as the 2020 election or COVID-19.

"The fact that social media is now a big part of everybody's lives [means] it is a major target," he said.

Editor's note: Facebook is among NPR's financial supporters.