What did I do THIS time?!

I’m posting about this because I’m pretty wise to phishing scams, and y’all, this one took me a minute.

Last night at dinner with some friends, I got an email to my work account titled “Your Facebook Account Will Be Suspended ! Facebook Team.”

Your ad account has been disabled

Hi HaldeCraft ,

To learn more about the current state of your website, kindly click the symbol below.

Everyone ought to be able to utilize Facebook profitably and responsibly, in our opinion. To do this, we categorically prohibit and severely restrict any behavior that violates our Community Standards.

Everyone ought to be able to use Facebook responsibly and economically, in our opinion. To do this, we establish rules for appropriate behavior in public and forbid any activities that deviate from these rules.

To find out more about how your website is currently performing, kindly click the icon below.
Appeal Here

Sincerely,

Facebook Team

Now, at first glance, in Gmail, on my phone, this looked legit. Long but legit looking(ish) email account, legit looking “appeal here” graphic, but it also … felt off. The space between the word “suspended” and the exclamation point? The period after the word “team”? The lack of concrete info in the email could have gone either way – I have gotten in trouble on Facebook before (my recent post about how I was going to have to burn my studio to the ground and two pictures of a giant spider is the most recent thing I’ve gotten in trouble for, for inciting violence) and they’re usually pretty vague with their info. “You’re in trouble.” uh, for what? “trouble.” could you be more specific? “You incited violence.” But… spiders! “You’re in trouble.”

At dinner, I opened up the Business Page app and didn’t see anything about me being in trouble there, so I was like… uh, gonna sit on this until I get home to my computer and can hover over the links to see what the link addy is before clicking. Then I got sidetracked, so didn’t get to it until this morning.

And y’all, it still looked kind of legit.

I won’t post the link I got when I hovered over the “appeal here” button in Thunderbird but it did looked like it went to a Facebook page. But rather than click it, still, I typed in Facebook and logged on as my work account and could find no evidence of being shut down, or not being able to place an ad. All of my Google searches on key words in the email brought up legit info on how to appeal a closing of your account or what your account may have been closed for. OK then. So… off to Google with the email address the email was from, something that started with “meta case report” but ended with “salesforce dot com.” Finally! Reddit came through for me with someone who’d gotten a very similar email.

Apparently the “appeal here” button does in fact go to a public Facebook page, but that page contains a link to keep appealing and that link will take you offsite, to a non-Facebook page that asks for your FB user name and password. And that’s how they get you.

The Reddit thread also led to this TrendMicro blog post from 2021 that describes a similar scam to the one that was sent to me, so I’m writing this blog post in the hopes of saving someone some time and energy should they be searching for the same thing I was and not coming up with anything.

By the way, when I opened up the email on my phone this morning to screenshot it for this post, this is what the top part of the email now looks like – that wasn’t there when I opened it yesterday.

So I’m glad to see that other people have been reporting it, and hopefully soon knowledge of the scam will be making it’s way around.

Also I’m glad I didn’t get in trouble AGAIN for being afraid of spiders.