My Facebook photography page was hacked and used to scam hundreds of people out of their money

August 5th

I received a message via facebook messenger in my johnwilhelmisaphotoholic-fb-page inbox. A man introducing himself as Adam Torres told me he would like to buy my fb page. I clearly remember how I was laughing about it with my wife (who is actually my girlfriend but it confuses people all the time to have 4 kids with a girlfriend so I call her my wife) and how I wrote him back that I was not interested in money.

August 6th

Adam Torres followed up and wrote that it was a misunderstanding and he’s actually interested to setup an advertising concept for my page. He knew quite a few things about me. He said he would be working for boredpanda (they had posted my work earlier and I was in contact with different people quite a few times) and there was a possibility to combine my posts with adds and earn a little money this way. I asked about references and was sceptical all the time. Finally I agreed on giving it a try for a week. He sent me an invitation to the facebook business manager (I copied the link to a text editor and after that to a google chrome inkognito-session. It was definitely an address that pointed to the facebook business manager but I guess not my own but a prepared one which I was given admin rights for the moment. Strange thing was I checked the roles in the dashboard and I could only see myself as an administrator. He asked me to add my photoholic site and later on he would tell me the source to add for the advertising catalogue.

I added my site because I was absolutely sure this business manager was “my” business manager and as long as I wouldn’t add another source or another person nothing would happen. But it happened already before I guess. In the background another admin was lurking and this admin would drop me off the site a little later as we know.

After adding the site I got a strange feeling somehow. I don’t know exactely why. Adam Torres’s performance was perfect, clearly social engineering at its finest. But something was wrong. I wrote a message to boredpanda and asked, if they knew an Adam Torres and if he’s working for them. The answer was shocking: No it’s scam!

I wanted to return to the chat with Adam to give my soul a little peace and smash him some nasty cusswords in his face. But the chat was gone, Adam Torres not existing anymore. Well, I thought, that was quick. facebook got this guy already and could shutdown his account. How naive that assumption was.

August 7th

I was doing a little workout in my attic when the phone rung. A follower from Zurich (thanks a lot Farid!) told me he’d believe my fb-page had beend hacked. I was shaking. Damn! Adam Torres came to my mind. I jumped to my computer and tried to fix this; tried to delete those videostreams. And it took a while till I became aware, that I had no control anymore over my page. It was like watching a bad TV show of yourself. I could see what happened in my name and I couldn’t do anything.

Of course I wanted to contact facebook. That’s just a few clicks for a friendly supporter and we’re good to go again I thought. But nope. No mailadress, no phonenumber, no form to fill in, no nothing. I think I was really trying all I could to contact facebook and the only success was to get a support-bot (called Horst) “on the line”. Didn’t help at all of course.

During the following days my mood was alternating between sarcastical fun and complete desperation. Luckily I have a really great community and many many of my followers tried to cheer me up (thanks Peter for the Pandas) and showed me their full support. So great!

One person reached out to me and told me he was having a contact within facebook that could help. I was a little sceptical because the name sounded somehow like Adam Torres for my ears. I’m pretty sure meanwhile, that I only got my page back because of this person and I’m really really grateful for what he and his contact did.

August 9th

Nguyễn Minh Tiến contacted me. He told me he was connected to the hackers and could help. He showed me a screenshot of a Vietnamese version of my page. I could see another admin in the role-field.

The messenger chat ended with him asking to have the credentials of my real facebook account. He needed it to help he told me. Argh! Bugger off!

August 12th

I reported the hacking of my page to the local police.

August 13th

I got my page back but facebook did not contact me. I don’t know from an official source what happened I can only guess. It’s great but also not so great. Because I don’t feel safe yet. I’m not sure if there’s still someone in the back who could revoke my admin rights with one click.

After I got my page back I’ve discovered a much greater misery than my own. In my inbox are hundreds of mails of cheated Vietnamese guys who wanted to buy one of those glasses or a watch. Most of them paid for it but will not receive anything. So sad.

The future

So what will I do now? Will I stay here on facebook (and Instagram) or is it better to leave this behind me? I honestly don’t know yet. 3 days ago I was absolutely sure to leave but now after reading all those messages, comments and feebacks I’m not so sure anymore. I guess I have to sleep a few nights over it.

Anyways. I want to thank all of you from the deepest bottom of my heart for your support.

The hack was horrible but how you tried to defend me and my site was absolutely amazing and touched me!

About the Author

John Wilhelm is a Switzerland-based “photoholic.” Although IT is his profession, photography and digital manipulation are his passion. He brings his imagination to life with the help of photography, Photoshop, and 3D software, and the subjects of his amazing photos are often his kids. If you’d like to see more of John’s work, make sure to check out his website and give him a follow on Flickr and 500px. His Facebook page is back, so you can follow him there, too. This article was also published here and shared with permission.