An account hijacking and bribery scam at Meta has led to the firing or discipline of more than a dozen employees or contractors over the last year, The Wall Street Journal reported.
Workers were allegedly accepting thousands of dollars in bribes from hackers to gain access to accounts on Facebook or Instagram.
Among the fired were security guards contracted at Meta’s offices who had access to the internal network “Oops” that allows employees to help users with their accounts, sources told the Journal.
“Individuals selling fraudulent services are always targeting online platforms, including ours, and adapting their tactics in response to the detection methods that are commonly used across the industry,” Meta spokesman Andy Stone told the paper, adding Meta “will keep taking appropriate action against those involved in these kinds of schemes.”
Allied Universal, Meta’s security contractor, “takes seriously all reports of violations of our standards of conduct,” a spokesman told the Journal.
The “Oops” system, an acronym for Online Operations, allows emails to be listed to be used to reset Facebook or Instagram accounts.
Access to valuable or popular Facebook or Instagram account can be lucrative. Online forums have reportedly been selling handles for tens of thousands of dollars.
“When you take someone’s Instagram account down that they’ve spent years building up, you’re taking away their whole means of generating an income,” according to Nick McCandless of McCandless Group, a platform for content creators.
McCandless says he charges his clients to reset their accounts via a contact at Meta he would not reveal.
“You really have to have someone on the inside who will actually do it,” he told the Journal.
A model with 650,000 Instagram followers, Brooke Millard, paid McCandless $7,000 to unlock her account.
“I knew obviously it wasn’t him that was doing something,” she told the Journal. “He obviously had a connection.”
The allegations are similar to a scam at Twitter that had employees taking thousands from users to give out blue check marks for verified users, new owner Elon Musk said.
Meta sought information from former security contractor Kendel Melbourne, who was fired in 2021 for allegedly helping “third parties to fraudulently take control over Instagram accounts.” Meta demanded the list of accounts the Allied Universal employee helped reset and the money he made for it.
“They didn’t have any set of rules or give you a class on what to expect,” Melbourne told the Journal.
Another Allied Universal employee Reva Mandelowitz was fired in February for allegedly resetting user accounts for hackers, taking thousands of dollars in Bitcoin, according to Journal sources.
Allied has recently issued a warning to its Meta contractors, account to the Journal: “Do not use the Meta Oops platform.”
