Key Highlights

[00:03:56] The gentle intuitive signals that alerted Irena to her Facebook account being hacked

[00:06:02] Why it’s important to be vigilant about friend requests that might be disguised threats to your personal profile security

[00:06:28] The nightmare of a hacker changing Irena’s password and locking her out of her Facebook account

[00:07:40] How Irena discovered hackers planned to spend $50k on ads in her account 

[00:10:19] The important personal details to have correct in your account if your identity has to be validated by Facebook

[00:22:40] The regular security checks you and your team can do on your personal facebook profiles and ad accounts as best practice for yourselves and clients

 

 

Jody: [00:00:00] Hello everybody. Welcome to this episode of Online Confidential, as part of the security series, helping you to keep your Facebook ad account secure as best as you can. 

So today, get ready because we’ve got a story from our special guest, Irena Miller, who has unfortunately gone through being hacked, and just wanting to bring an awareness to you guys so that we can help just make sure you’ve got everything in order.

So [00:00:30] today’s guest, welcome Irena Miller.

Irena: Thank you so much for having me, Jody. I’m so happy to be here and so happy to give any tips or hints or tricks that might help someone else avoid this situation. 

Jody: Absolutely. Irena was just giving me a quick rundown. I’d heard her story before and she was giving me a quick rundown, and I could just feel my heart was racing a bit faster going, ‘oh my gosh, really?’

But while things like this can be scary with our Facebook ad accounts, and especially when we’re talking about [00:01:00] our business as well, our livelihood, our income, and being able to pay team members and market our business on Facebook. We just need to be as aware as possible, so just get whatever we can in place to help protect us and our accounts.

And then just be keeping an eye out for things. It’s like if you’re in your house, and you’ve got security screens it doesn’t mean you’re just going to be oblivious then and not block the screens or not keep an eye out for someone who’s hanging around in the garden outside perhaps. So it’s that matter of also [00:01:30] then just keeping an eye out and watching what’s going on.

So Irena, I’d love you to share. A bit about yourself, first of all what do you do? 

Irena: Sure. Thanks for asking. So what I love to do is connect empathic curious seekers to very unique sacred practices that help them step into the life that they’re really called to live. That they’re born to live. I’ve been studying spiritual practices and ancient traditions and rituals for the last 25 years, and I consider myself a bit of an energy alchemist.

So I love [00:02:00] to connect these very beautiful practices that bring peace and awareness and help you speak the language of intuition so you can avoid situations like this. Because I have to tell you, it did in the end save me $50,000. If I hadn’t paid attention to intuition, because I’m not a Facebook ad specialist at all, I have other people in my world who help me with that. 

If I hadn’t gotten that little nudge, that little inkling that I know to pay attention to, it could have been a lot worse. Which is hard to say [00:02:30] considering even how it was. But for me it’s a joy to be able to share these sacred practices, to bring a peacefulness and equality to people’s lives where they can find their joy.

Jody: Awesome. And I think it’s that peacefulness that’s probably helped you through this process as well, because if there’s anybody that can endure this, I think you certainly are that person to take a breath and always just try and be positive in all of it. And listening to that [00:03:00] intuition, that gut check that we might have. 

You might just get a random thought, ‘hmm, I wonder, or I should check’. That’s what I’m sort of certainly learning myself. 

So, Irena, let’s go down this path. Thank you very much for sharing your story here with us all. So tell us, what happened to you. 

Irena: Yeah, well it was, we all have that wonderful part of life where we say, as a full-time entrepreneur, what’s that T-shirt?

[00:03:30] It’s like, I’m not going to work for the man anymore, those 40 hours a week. I’m going to work 120 for myself. Yeah, well, like anyone else in the entrepreneurial world, trying to find that balance between play and work. Because we’re passionate about our jobs and we love to do this. So I have a tendency to work a lot on weekends just because I don’t consider it work.

But this one particular weekend of all weekends, I decided I am not going to look at my phone. I’m going to have it in the office away [00:04:00] from me. I’m going to spend time with my family. We’re going to sit down and have breakfast and enjoy each other’s company. And as I was there Saturday morning having breakfast with my husband, I started to get this little intuitive nudge.

My brother popped up in my head. I just started thinking memories of him. My brother Tommy, my brother Tommy, passed unexpectedly a few years ago and I thought, oh, Tommy, I miss you and so I’m thinking about him, and then I’m talking with my husband, and then the next thing, a [00:04:30] song, a song pops on the radio that always reminds me of my brother and I thought, ah, Tommy, I’m thinking of you again. 

Because his death was unexpected. I have a hard time remembering his passing. It’s like, boy, is it August 25th or was it September? Which one, and I thought, you know what? You could log into Facebook and just double check because you posted.

And I thought, yeah, why don’t you just log in, just put a memory, a little ‘I miss you Tommy. I’m thinking of you’ but I thought, no, no, I’m going to be with my [00:05:00] family and I hadn’t said anything. And next thing my husband mentioned Tommy out of the blue. I thought, are you kidding me? 

If something pops up three times like that, I thought, you know what? I just have to remind myself when did he transition? When did he pass? I’m thinking of him. I want to look at the pictures. 

So I pull up my phone and I hit the Facebook app. I can’t get in, and it said, you need to enter your password. I thought, well, that’s odd, but sometimes, we get logged out of apps and things.

So I thought, okay, let [00:05:30] me log in my password. Oh, it didn’t work. I thought, oh, okay. I probably fat fingered it. Let me do it again. It didn’t work. And that’s when your stomach drops. Yeah. And that’s when I logged in and I discovered that I didn’t have access to my account. And there’s a very particular pattern that I started to see and experience which I can share with you.

Let me know how much you want me to share. But, it was interesting. 

So the long and the short of it, the high level was, looking back, [00:06:00] hindsight, what had happened was someone was added to my Facebook profile as a friend that I didn’t catch being added as a friend. So that would be a clue to maybe look out for.

Keep an eye on who’s on your friend list, who gets added. I don’t know if there’s a specific place where, I think there is, I think I found it where you can see who is just added as a friend or followed you. Pay attention to that. 

They had been added to my profile, my personal profile as a friend and that day, Saturday morning I [00:06:30] discovered that the night before 11:54 PM Eastern Time when I was asleep, they had posted three inappropriate posts on Facebook and it actually said it was child pornography, and my heart just sank. 

So Facebook notified me and they said, we’ve taken down these three posts. These go against our standard practice rules. You are not allowed access for 30 days. Put in Facebook [00:07:00] jail. Can’t post, can’t go live, can’t run ads, can’t use Facebook Messenger. So my password had been changed. They posted inappropriate things. 

I was in Facebook jail, I could do nothing. I went to my Facebook business page. They had taken me off as an admin. They had taken off all of my assistants, my helpers, my Facebook ads contact. Nobody was on my admin or my personal business account page anymore. I’m sorry, my [00:07:30] business page, but now I’m getting worked up. 

Somehow, I managed to find a backdoor into my ads manager and in there as well they had taken everybody out. I had backups in there. I had two factor authentication on. This is another important piece because I know Jody, you sent out an email recently about SMS for two factor authentication.

I did have two factor authentication set up with SMS. And when I asked for that message to be sent via SMS text, it [00:08:00] never came through. So I think they hijacked my phone number for that text. So that was something that I lost control over. In the ads account, they had kicked everybody out, as I said, but they downgraded me to an employee, thank goodness.

So I could see that they had started an ad for $48,000 and if it hadn’t been for my brother, busting my chops as usual from the other side. And what I love too, about the language of intuition is that when you know to trust your [00:08:30] gut, it’s not going to be this scary like the world is blowing up, it’s the apocalypse, the sky is falling.

It was just my brother saying, ‘Hey, I miss you.’ It was this memory, I was thinking of him, I was missing him, it was sweet, it was gentle, but it was enough to get me to log onto Facebook. 

It wasn’t like, ‘Irena, they are trying to steal $50,000 from you. You have been locked out completely. Your life is falling apart. And guess what? The next four months are going to be a nightmare.’ 

They [00:09:00] didn’t, when I say they, I mean my angels, my guides, my intuition. They could have said that because that’s what has happened and is current happening. But they didn’t. Luckily by Miracle of Miracles, and let me tell you what, I pulled out all of the spiritual practices and sacred tools that I knew and Saturday morning when I discovered it at 8:00 AM I worked tirelessly, nonstop until about 6:30 and I managed to get through to someone at Facebook.

It was [00:09:30] so sad because somehow I got into a chat support with Messenger and I think I was able to type in that I had been locked out and hacked. But when somebody came on to respond to me because I couldn’t get into Facebook Messenger, now this is a clue because they lock you out of Facebook Messenger. So you need another way to get help from Facebook.

I’m in this problem again right now, anyway. You need another way to get through because you can’t talk to the person who comes to you on chat support because you’ve been locked out of Facebook Messenger. So I felt like the person [00:10:00] at the window, like, I’m here, help me, help me. And she couldn’t hear. Thank God she called my phone number.

So another thing I discovered in my research is it’s very important to have your real name, your real phone number, all of those things attached to your account. Nothing cutesy or funny, no lying about your age, birthday, all of that. 

So that was super helpful that I had all of that correct. The woman called me and it was oh, so amazing because she gave me hope and we started an email conversation.

[00:10:30] What I discovered afterwards and something I’m still dealing with that is something, another clue to stay aware of, is sneaking a bad pixel into your ads manager, into your account. Because that’s where I am right now. I still have that bad pixel in there that’s active and other things are going on.

But if I were to kind of sum up the big things to be aware of, watch to make sure that you don’t get any odd friends being added to your account. Definitely use an authenticator app instead of SMS. Although I know [00:11:00] people have their own things going on with authenticator apps. I know backups are great to have in your system for getting hacked.

This is just from my personal experience. Jody’s the expert here, and then the last thing I would say is trust your intuition. Especially if you get a little hit those three times. 

Jody: Yeah. amazing story there.  [00:11:41] And it’s just so sobering in that, it can just happen to anybody because, you look at yourself for example, and you kind of go, why [00:11:30] me?

Well, why am I am I out here as an influencer? And you think, oh, they’re all the ones that are getting hacked or whatever. But it’s just everyday people’s accounts just getting hacked and so while it was you and your business manager, if we’re an ad manager and that happens to our personal profile, they can get in and access all our client accounts.

And then also for team members of yours that have access to your business manager it can come in, happen by theirs. So really having that elevated level of awareness and [00:12:00] security for us and our team members as well, is so essential to help protect our accounts. 

So $50,000 ads were set up and launched, they got $800 spent, so were you able to recover that? 

Irena: Yes, yes. Thank goodness. By being able to report it so quickly, and that’s something that was interesting. Again, tricky, something that I’m learning, this is probably me preaching to the choir. I’m not a Facebook ads expert, so I’ll start [00:12:30] with that.

But by being able to address it as soon as I did when I spoke to the Facebook contact or meta contact, she said, you’re not going to be responsible for any ad spend. And at that point, nothing had been spent. And she’s like, ‘we’ve stopped your account completely. Nothing has to be worried about no ads can be run.’

They still did run though, and they managed to charge almost $800 worth and they had set the limit to about $50,000. And the other, again, rookie mistake, it was attached right to [00:13:00] my business banking account. So you just see that going on and the state of panic as the numbers are going.

And then when I spoke with people afterwards at Meta Facebook, they said, ‘oh, well yeah, we’ll see if that money, I dunno, we gotta do that’. It was a lot of hemming and hawing. So just continuing to pursue and persevere and ask questions. It’s exhausting, but it does work. The money did get refunded by the end of December, so it was September, [00:13:30] October, about four months before it was returned.

And again, thank goodness, after $800, they stopped the ad so it didn’t continue. 

Jody: Wow. A couple of things on that is in Facebook’s ad policies and terms, it does actually say that we’re not liable in case unauthorized spending has happened. So they do say that, but from everything that I’ve heard from people who have had this sort of thing happen, they [00:14:00] have been refunded, which is fabulous.

I guess Facebook just have that in there as a bit of a failsafe for themselves in case someone like yourself doesn’t take action quick enough. They maybe have an out, so, but it’s been good news for everyone that I’ve spoken to who has, had something like this happen. They have been able to get refunded.

Again, just as I just did the episode, ‘What you can do to protect yourself personally’, or is it the next one? I think it’s the next episode maybe for [00:14:30] business manager. If you’ve got dormant accounts or inactive ad accounts and you do have payment methods connected to them, remove payment methods, so you’ve only got one, or one ad account.

Possibly then it’s tricky if you’ve got ad accounts that are doing a higher spend. And you are doing tens of thousands a month. But if you’re not doing that, or if your clients aren’t doing that, then perhaps just have a card that’s just used for Facebook ads and it has a limit.

Your [00:15:00] client would have to be topping it up so that it doesn’t interfere with the accounts. But again, that’s probably something that’s just going to keep you a bit safer. So yes, certainly stressful times. This is all you can do is sort of sit back and watch the nightmare unfolding before you.

So it was great that you were able to get back into your account. That’s what people can do, well at least try to, is that if you go to log in, you click on forgot password, and then you try and get in that way, and you can [00:15:30] say, I don’t have access to this mobile phone, I don’t have access to this email anymore.

There’s also some download codes that you can download as well. But yes, it’s a very tricky thing and thank goodness you found someone useful at Facebook who was calling you, because that’s one of the worst things then, you can’t chat, you can’t get on that Facebook support and there’s certainly no phone number you can ring up, so that’s great.

So what has been ongoing from there? You [00:16:00] mentioned there’s still issues going on for you?

Irena: Yeah, so this is an interesting piece that I feel like I’ll throw the puzzle out to your amazing listeners who are such experts in this field. The pixel that was put into my account, I had one gal who works with Facebook ads take a look, and she said, ‘Oh, no problem. I know it’s a bad pixel, but it’s not active. It should be fine. It won’t affect you.’ 

I had someone else take a look at it for me recently, because I’d love to run ads again. I haven’t been able to run ads since July of last [00:16:30] year. So it’s been a while and they took a look at the pixel and they said, ‘oh, this pixel is very active and it’s attached to 120 other websites. So it’s corrupting your data and they’re continuing to breach your data. So everything that gets experienced by your users, all that data is being collected by them as well.’ The bad guys will, let’s call them.

Anyway, what has occurred recently is that in February and then March inappropriate posts have been [00:17:00] going up on my Facebook page. I don’t know what they are. I don’t know how it’s happening. It’s not me posting them, but I am currently in Facebook ‘timeout’ again and I don’t have access to a lot of the tools to contact Facebook because I can’t run ads.

So I can’t have any of my people who are in my account or myself contact Facebook. I tried to have someone contact [00:17:30] Facebook on my behalf. Facebook wouldn’t talk to them because they’re not an admin in my account. I can’t access any kind of support because I’m in timeout with Facebook. So there’s no chat support in the kind of ‘Siberian cold land’ that I’m in, but that’s okay, I’ve got friends in high places, angels who will help me find a workaround. I do not fear. 

But the thing that does worry me is that these posts are going up. So something’s happening. 

I’m not quite [00:18:00] 100% sure why. And the conundrum or the puzzle to solve is some people, I’ve heard, have been able to have Facebook through chat support remove bad pixels. Facebook chat support, when we spoke to them, the person who was trying to help me recently, they said, ‘oh, we can’t do that, it’s not possible’. And they refused to escalate the case to a dispute, and they wanted to just close out the ticket.

So they came up with, ‘oh, she hasn’t changed her password in a long time. If she does that, she should have access to all this again.’ [00:18:30] Because it says the reason that I’m restricted is two factor authentication isn’t set up, but it is. So it’s just some weird stuff going on.

Jody: Still. Have you gone back, so you were talking about the Facebook page there, and that was part of your business manager. So your personal profile, to be clear for everyone, that your personal profile, which is what we all have, we have our personal profile, that account with Facebook that is personal.

Then we have our business pages, which is all very confusing now because Facebook’s calling them all profiles, [00:19:00] which is not the case. So there’s our personal one and then there’s our business pages. So your personal profile is obviously the one where they first got access to the friend request and then they get into your business manager and everything.

And that’s the one that had the inappropriate posts initially. You got all shut down. Then, they get over into your business manager, rack up the fake ads and the ad spend, and they’re using your business page to run those ads with as well. So your ad account, your business manager, [00:19:30] your business page, and they’ve got access to all of that by coming in through your personal profile.

So it seemed to get resolved for a bit, but you found the pixel, there’s a rogue pixel still in place there, which you’re wanting to get removed, and now your personal profile is sort of in Facebook jail again. Is that right? Or is it your page? 

Irena: The personal profile. 

Jody: So with regards to your business and the business page, are you [00:20:00] still using that or have you decided to, I’m not going be using this anymore, or not that you can do anything at the moment, but you can do organic posts on your page? 

Irena: So I’ve been continuing to post on my page throughout this whole experience.

But what I’ve noticed is that my reach continues to go down, and down. Even in my Facebook group where I have a beautiful community. Over 3,000 people and they were all active and the reach was wonderful last summer, but [00:20:30] it really has been affected by the dings against my personal account.

Not being able to get the reach because they even, I love it how Facebook says ‘Your account is restricted and we are putting all of your posts at the bottom of the feed.’

Jody: Thanks a lot. Yeah, that’s right. Just give me that paper cut. Pour in the lemon juice and rub in some salt while you’re at it.

Irena: Interesting challenge. 

Jody: Oh, Irena so still not resolved. It’s an ongoing thing for you, I’m so sorry to hear that. I’m so grateful that you’ve come on and you’ve shared so openly about your experiences, just to help us not be terrified, but to just be aware. 

I was saying to Irena before, I don’t think it’s on the recording here, we were doing a bit of talking before, but it’s like having security screens all [00:21:30] around your house, but then just leaving the doors unlocked or, not paying attention to a suspicious character that might be lurking around outside.

We can put up whatever security we can as that best practice, but be on guard and keeping an eye out for things like this. So making it a regular practice, to check your business manager, and see what’s going on. So if you haven’t, go and check, are there pixels that have been put in that you don’t know about?

Okay. So if that’s the case, then you might [00:22:00] not want to do something about it, which could be changing your password. And if you’re not changing your password regularly, start changing a password regularly. Don’t make it a password that you have on other places as well. And look at those friend requests that are coming through.

If there’s someone that you don’t particularly know, and I know for those of us who have a business or building a business, we will get friend requests from people that we don’t know, but have a look at who their friends are. Do you have those common connections that could mean that they are legitimate?

[00:22:30] Maybe even send them a message, they may be legitimate, and might be a good connection. So keep an eye on those things. Just maybe don’t accept random requests. 

So, Irena, thank you once again for coming on board, sharing your story, and I’m sure a lot of people have been enlightened and been encouraged to step up their own personal security here.

So if anyone wants to find you, who has good intent? Where do they find you? [00:23:00] 

Irena: They can find me on my website, irenamiller.com, and I have links there, different little goodies and free gifts where they can find ways to stay peaceful and calm, even in the midst of insanity. 

And I want to highlight as well too, because I didn’t have anyone actively working with my Facebook ads account at that point.

And I think if someone who was an expert had been in my world, they would’ve caught these things. These were not things [00:23:30] that I was looking for, or would be even aware of were coming up. Because sometimes you’re just trying to do things on your own and get things going. So I definitely feel, just like what you said, it’s a matter of being alert and aware.

And you can save yourself a lot of heartache, and it doesn’t have to be fearful. 

Jody: I think that’s a relatively new thing. Well, not a new thing, but just something that’s going, hey, maybe this should be something that could be part of our weekly SOPs as we do reporting, or whatever it [00:24:00] may be, just to do a check, a security check on our accounts.

So maybe look at a pixel or look for any unusual things on our business managers. I know a lot of ad managers are busy having all these client accounts, but just having this, okay, here’s our weekly, do the reporting, do this, do a check here, great. Just to cover your bases and hopefully protect ourselves a bit more in this crazy, crazy world. [00:24:30] 

Anyway, good people like us shall endure. So anyway, thanks again Irena. 

Thank you everybody for being here with us today. Go turn on that two-factor authentication. Put it on that third party Authenticator app, and keep those checks going. That’s it for today.

Bye for now. 

 

Irena: Bye.