I need to tell you about the single most incompetent security response I have ever dealt with in my life. It involves Facebook, a hacker, and a system so spectacularly broken that it actually detected the crime, offered to fix the damage, and then refused to because of a rules violation the hacker committed. Let me walk you through it.
Image: Wikimedia Commons, CC BY-SA 3.0
The hack
My Facebook account was hacked. I didn’t click a weird link, I didn’t hand over a password, I didn’t fall for anything. One day I look, and someone else is in my account. That’s not a user error — that’s a security failure on their end, but fine, these things happen to big platforms. What happened next is where it gets insane.
The hacker, the moment they got in, did what hackers do: they used my account to post something. And not just anything — a post that flagged Facebook’s own sweeping content rules. A violation of their terms of service.
The catch-22 that broke Facebook’s brain
Here’s the part that should make any reasonable person laugh out loud. Facebook detected the hack. They noticed unauthorized activity. They flagged it. They offered to help me restore my account. “We’re here to help you get this back.” Wonderful, I thought. Finally, the good guys.
Then came the knife to the gut:
“We can’t restore your account because it has a terms-of-service violation.”
Read that again. Facebook is simultaneously holding both of these thoughts in its head at the exact same time:
- Your account was compromised by an unauthorized third party. (We know.)
- That unauthorized third party posted a TOS violation. (We see it.)
And instead of joining those two dots and concluding “oh, the hacker did the violating,” they blame… me. The victim. And they refuse to give my account back because of content that the hacker posted seconds after breaking in.
They can’t put 2+2 together
This is the part that makes me so angry I could scream. It doesn’t take a forensic investigator. It takes a child. If my account is hacked, and my account immediately posts a TOS violation, the single most obvious explanation on planet Earth is: the hacker posted it to get my account banned. That is, in fact, a time-honored tactic — break into someone’s account, post garbage, and let the platform’s automated enforcement do your destructive work for you. The attacker gets to destroy my account and make the platform do it.
And Facebook walked straight into it. They detected the break-in. They offered help. And then they told me, with a straight face, that I can’t have my account back because of something a stranger did while I wasn’t even in the room.
The result
My account was never recovered. That’s where this story ends. Not with a fix, not with a restoration, not even with a sincere apology. Just… gone. Years of history, messages, photos, connections — vaporized because Facebook’s left hand (security, chasing the hack) doesn’t talk to its right hand (enforcement, banning the TOS violation).
I have no way to even appeal to a human. The support system just bounces me in circles — restore, denied, violation, appeal, denied — each step a closed loop sending me back to the start, a hamster wheel with no prize at the end, just slowly spinning me into resignation.
The absurdity, summed up
Let me put the whole thing in one sentence so you can feel the stupidity the way I feel it:
Facebook detected that my account was hacked by someone else, offered to help me restore it, and then refused to restore it because that same hacker posted something that technically violated Facebook’s terms of service — a violation they are holding against me, the person who was robbed.
Think about what that logic would mean in the real world. If someone breaks into your house and spray-paints your living-room wall, does the city come and say “sorry, we can’t help you — technically, there’s now graffiti on your wall and that’s a code violation”? No. You’d be laughed out of the building.
But that’s Facebook. The platform that “connects the world” can’t connect the two most obvious dots in its entire security history. The hacker is long gone, probably laughing. I’m the one who’s punished. And my account — my account — remains unrecovered, held hostage by a terms-of-service rule that an intruder used as a weapon against me.
If you’ve ever wondered how people lose everything on these platforms through no fault of their own, this is how. Not because they did something wrong. Because the machine detected the crime, saw the criminal, and still chose to punish the victim.
Facebook, if you’re reading this: it’s not hard. An account being hacked and then immediately posting a TOS violation is not a mystery. Put the two facts together. They rhyme. Restore the account, ban the actor, and for the love of everything, hire a human being who can count to two.
