The Impact of Suspended or Compromised Accounts
I’ve had a couple of experiences lately that have prompted me to consolidate them into something that might help others: I had a compromised Twitter/X account and an Instagram account suspended for a few weeks. Both were frustrating experiences that I hope will improve with time.
Instagram/Facebook
The most recent was the suspension of my Craft Beer Artwork Instagram account. I’ve been posting beer labels for a couple of years now, less frequently in recent months, but I was unprepared for the impact of what a potential suspension of such an account could mean. Because my Instagram and many Facebook pages for various projects are all related to my personal Facebook account, all were suspended by association, including my personal account.
I’d be mildly annoyed about losing my Craft Beer Artwork account, but I would quickly get over it. I have been on Facebook for over a dozen years, and it is my primary connection to many old friends and family members. Further impacting the loss of this account was that I use Facebook as a single-sign-on account for other online services and games I rely upon– all of which were unavailable to me during the suspension period.
Even more frustrating was that I had no idea why, and there was no way to inquire further. It said I had “violated community guidelines.” There was no indication of what guideline, and I’d not done anything I was aware could be construed as potentially offensive.
The only action available to me was to click a button to “Appeal,” and there was no place to ask a question or try to explain (had I even understood an accusation). I went on a hunt for a way to open a ticket, chat with support, send an email, or call a number, but I turned up nothing but a subreddit of people in similar situations.
I tried to log in every couple of days for nearly three weeks to see “you submitted an appeal” on October 14, 2024, and that “it usually takes just a day to review your information. Check back here.” On November 2nd, I woke up to a long list of new email messages advising me that over twenty Facebook pages and some of my Instagram accounts were back. Focused on the couple of things I cared about, I’d forgotten how many pages I had that were also taken down during this period.
Finally, I found the post that triggered this whole fiasco: a craft beer label for a beer in Holland called Crystal Meth. This post had been taken down because “it looks like you tried to buy, sell, promote or exchange illegal or restricted drugs.” The complete lack of understanding of the harmless context makes me suspect this was an AI process that needs more tuning. Reviewing it took weeks instead of days, making me suspect it was making many mistakes, resulting in a large backlog of manual review tasks.
I had an old Facebook account I didn’t care about with a weak and reportedly compromised password. I’ve now updated it, given my new appreciation for how things could go sideways unexpectedly and have a significant impact.
Twitter / X
Whenever I update my phone number, email, or password, I always get an email advising me of the change and to disregard the alert if it was me. That always gave me comfort– but that turned out to be a false sense of comfort.
One morning, I awoke to multiple emails about suspicious activity on my account. Despite being identified as suspicious, the attacker was able to change the account’s email!
- First Message
- We noticed an attempt to log in to your account @audiocraft that seems suspicious. Was this you?
- Suspicious login
- Location* Middletown, PA, USA
- Device 10.5.0 on iPhone
- Second Message
- We noticed an attempt to log in to your account @audiocraft that seems suspicious. Was this you?
- Suspicious login
- Location* Shrewsbury, NJ, USA
- Device ChromeDesktop on Windows
- Third Message
- We noticed a login to your account @audiocraft from a new device. Was this you?
- New login
- Location* Shrewsbury, NJ, USA
- Device ChromeDesktop on Windows
- Fourth Message
- Your email address has been changed
- The email address on your account @audiocraft has been changed to gr****************@y******.***. Based on this change, please be aware that additional changes to your account may be restricted temporarily.
In every case, I was advised that if this wasn’t me, I should change my password and review connected applications. But of course, I could no longer log in. Unlike with Meta, I was at least able to open a ticket and share the details of my experience. However, all responses were automated, and I had no impression that the details I shared were considered.
They needed to know what email I had on the account and unfortunately, I have had dozens of email addresses and was unsure which was associated with this account. I offered a handful of possibilities, and was eventually shut down with the following message.
“We’re writing to let you know that we’re unable to verify you as the account owner. We know this is disappointing to hear, but we can’t assist you further with accessing your account.”
What doesn’t make sense is that I received these emails at a particular email address that was obviously associated with my account, but they did not accept that. I even provided screenshots of the emails that I would not have received had it not been my account.
I wrote asking that the account be deleted to ensure it wasn’t used maliciously with my brand but got no response. There was no ticket workflow available to guide me through such a request, as what they accept for support is very limited. I tried a few ways but never managed even an automated response.
All that said, when I look for the account now, I cannot find it. So, it does seem to have been deleted or suspended. Luckily, the account did not have a real consequence for me.
In Closing
The lesson: protect or delete your accounts and consider a backup plan should an account be mysteriously suspended or deleted. I have tons of accounts I don’t really care about, so I am on a clean-up mission to ensure they don’t cause me problems in the future.
As of now, my BlindBoxes Facebook page is back, but its Instagram account remains suspended. For this one, I don’t even have the option to appeal and again have no way of knowing what rule I’m mistakenly accused of breaking. I’ve done nothing with this account for years but post pictures of customer orders and name the products in the image. I do this to show the store is active and taking regular orders so it is of consequence that this account is disabled with no ability to appeal for a review.
