There are always scams happening online, but recently, a couple of infamous white-collar scams have been gaining more traction. These scams are targeting people who are in the digital marketing industry. Particularly marketers and business owners who have access to one or more Meta ads accounts, Facebook pages, Instagram shops, and/or a business manager account connected to all of these assets.
Table of Contents
How The Scam is Executed
First, you will start seeing negative comments or messages from one or a few users on your Facebook page, posts, or ads that are running. The bad actor will write comments like “Scam”, “why are you targeting me”, etc. They will comment on a variety of your posts in a short period of time, putting doubt in your mind by making you feel like something is wrong with what you are posting.
Next, after a few days, you will receive a message in your Meta inbox from a user, saying that you are violating Meta’s policy and your page will be disabled. The message then asks you to click on a link to verify if this is an error from Meta’s side. This message is designed to look like one the Meta internal support team would send you but it has an odd link that takes you away from Meta and onto a different site. The message looks something like below:
What happens if you click on the link? The scammer gains access to your Meta properties. They start removing you from your own Meta business manager/ads account, Facebook page, and Instagram shop. By the time you realize what is happening, you’ve already lost all access to your accounts.
The following suspicious activities that take place over the next few hours or days could be:
- The scammer could launch their own fake ads on your ads account with a HUGE daily budget by using the credit card tied to your account.
- Completely deleting your Facebook page or posting their content to it.
- Removing your pixel/catalog and other items.
Upwork & LinkedIn Are Also Used as Avenues for This Scam
Scammers are also using Upwork and LinkedIn to gain access to your Meta accounts. They do this by reaching out and posing as an Upwork client or submitting a connection request on LinkedIn and trying to lure you in by offering a big project or job with handsome pay.
If you accept any such request or contract, you will be taken to download a .PPT, ZIP file, or click on a link that contains “project material”. Once the file or link is clicked, a virus-containing program is installed on your computer that is designed to steal your Meta access and lock you out of your accounts.
Steps to Take if You Fall Victim to One of These Scams
- Immediately attempt to reset your Facebook profile password and click on “Sign out from all devices” post password reset. Ensure two-factor authentication is enabled.
- Immediately block/cancel credit cards and/or PayPal accounts that are connected to hijacked accounts to prevent any unauthorized charges.
- Reach out to Meta support to report your case OR reach out to your agency to report the case on your behalf. Meta will investigate this and help you regain access.
*Unfortunately, Meta support is not the fastest at addressing issues, so it may take days, or weeks, to get this sorted out.
- Run a thorough virus scan on your entire computer and remove any dangerous software/programs the scanner picks up.
- Delete cookies and clear caches from all of your browsers.
- Report the scammer’s profile using the onsite reporting features.
How to Avoid These Scams
- DO NOT click on any link without paying attention to the link URL and who it is from.
- Any authorized link from Meta, Linkedin, or Google will always have its domain name in the link. If the correct domain in the link URL is missing, don’t click it. This is the best way to determine the validity of the link.
- For email, always check the sender’s address before any action is taken, like clicking on a shared link or downloading files.
- Regularly reset your Facebook and Instagram passwords.
- Never save passwords on your browser or use the “Save my login information” feature. Facebook is especially vulnerable to losing sensitive information if that setting is enabled.
- Always use different passwords for your accounts.
- Use at least two different authentication methods for your accounts. Ideally a password method and an authenticator app.
- Regularly scan your computer to remove any suspicious programs.
By learning how to identify and avoid these dangerous and costly phishing scams, you’ll be prepared to catch them before they can do any damage to your business, reputation, or finances.
The experts at Coalition Technologies make security a fundamental pillar of our services and strive to always keep our clients protected, informed, and empowered. Reach out to one of our knowledgeable Digital Strategists and see what we can do to grow your business while keeping it secure.
