Illustration: two people sit on a doorstep in front of a chained door with a big padlock and an “Account locked” sign, cobwebs in the corner, a stack of coffee mugs beside them, and a wall calendar where almost every day of January is crossed out

I worked with security. Lena and I still got phished. Properly, all the way in.

A couple of years ago, on a January day with guests on their way, an email arrived saying all of Lena’s Facebook ads were about to be shut down. She was scaling up her psychotherapy practice at the time, and Facebook was her main channel for finding new clients. So we clicked the link and logged in. Of course we did.

We both knew better. That’s the uncomfortable bit. Phishing doesn’t need you to be stupid. It needs you to be busy.

We even had two-factor switched on. We typed that in too.

How one login became a month

What happened next was almost elegant. In hindsight, it went something like this:

  • We logged in on a fake page, two-factor code and all, and they had the account.
  • They used Lena’s ad account to run ads in Thai for a brand-new Instagram account. We never found out what they were for, only that they were banned within no time.
  • Because her ad account had paid for those ads, her ad account was banned too.
  • Her ad account was now linked to an Instagram account she had no access to and couldn’t unlock. That locked her out of Meta’s business control panel as well.
  • With the control panel gone, so was the way to clean any of it up. Locked out of Facebook and Instagram in one go.

Every step on its own was Meta’s systems doing what they’re built to do. Ban the bad content, ban whoever paid for it, protect the linked accounts. Put together, they kept the real owner out.

There’s no one to call

Then the second lesson. There was no support to reach. No phone number, no form that led anywhere, no human.

In the end I found the answer on Reddit, in several long threads from people who had ended up in exactly the same spot: Meta Verified, Meta’s paid subscription, came with access to a real person. So I bought it on my own account, purely to get someone to talk to. It still took another week or two before they removed the link to the Instagram account and let us back in. From early January to around the start of February. About a month, all in.

If this had been a platform at work

I spend my working days making sure a single mistake can’t take down a whole platform. Looking back at ours from that angle, it’s a bit embarrassing:

  • One login sat on top of everything her business depended on.
  • No second admin, and no way back in that didn’t go through that login.
  • Support was a paid add-on we didn’t know we needed, until we did.

I’d never accept that at work. At home, I hadn’t even noticed.

What we changed

Honestly, not much. We added a fallback account, though I’m not sure it would have helped in this exact situation. At least we know the workaround now.

The bigger change is a habit. We don’t click links in emails like that anymore. If something claims to be from Meta, the bank or anyone else, we go to the source directly and look there.

The bit I keep coming back to

You can know all the right things. You just have to know them on your busiest day too.