You know there's something fishy going on when a respected martial arts coach suddenly posts child exploitation material on his Facebook page, then buys up big on Vietnamese ads for angler rods.
But Jihad Bekai, who runs the G-Force martial arts school in Melbourne, said convincing Facebook's owner Meta of that has been downright impossible.
Last month, Bekai fell victim to Facebook hackers. They used a common and well-known ploy, previously reported on by 9news.com.au, which involves posting child sexual abuse material on a user's personal Facebook page.
READ MORE: Michael had the 'perfect' Facebook-led business, now under siege
This triggers an automated response from Facebook, banning the user for violating its "community standards".
While the user is busy dealing with the fallout and trying to retrieve access to Facebook, the hackers go after their real target – usually a credit card linked to a business page they run.
Over the course of a month, the hackers have run up more than 50 charges on Bekai's credit card for Facebook ads, totalling more than $1000.
Meanwhile, Bekai said he had been stuck in an infuriating feedback loop with Facebook, whose online customer service forms fail to register the absurdity of his situation.
"Facebook is not contactable but they are happy to charge the credit card linked to my disabled account," Bekai told 9news.com.au.
"Since when do I run Vietnamese advertisements about fishing rods?
"Also, if their artificial intelligence is so fantastic that it can detect child pornography, why can't it put two-and-two together and realise it would be unusual for me to be doing 10 years of videos on martial arts and suddenly decide child pornography is my thing – so much so that I want to display it online for everyone to see in a public post."
From the moment hackers uploaded child exploitation material on Bekai's Facebook page, his entire social media presence was banished in one swoop.
READ MORE: 'I was in love': Tasmanian woman's catfishing nightmare
Bekai lost access to his martial arts school's Facebook page and Instagram account. He also runs a cafe and a Melbourne martial arts tournament. He longer has access to those social media accounts either.
"It's 15 years of work, just gone, all of it taken away," he said.
"My Facebook page often gets 10,000 interactions, so does my Instagram. I've got all these high-quality, professional videos of us doing martial arts demonstrations."
Bekai's martial arts school only advertises on social media. The Facebook page is one of the main ways new customers find out about his business.
"The G-Force page is still there but it has no admin, so it's floating now like a ghost page," he said.
After going around in circles for weeks, Bekai said he finally managed to speak to an online support worker for Meta. But the IT support worker's responses to him, written in poor English, were even more baffling and infuriating, he said.
In one conversation, seen by 9news.com.au, an IT support worker told Bekai he is unable to get a refund on the credit card charges because it had been determined a family member or a friend was using his credit card to buy the advertisements.
In another message thread, an IT support worker calls Bekai by the wrong name, before telling him he won't be able to get his account back, but to "have a sweet night".
"This is where it started to get insane," Bekai said.
"I was almost on the verge of thinking that Facebook itself had been hacked from the replies."
'They watch the damage in real time'
Bekai's case is similar to that of Queensland tradie Michael Meyrick, who found himself and his business besieged by hackers in August this year.
The hackers began buying up Facebook advertisements in Vietnamese for nose hair trimmers on Meyrick's account, before posting them on his business page.
9news.com.au has been inundated with similar complaints from small business owners about Facebook hackers.
Australia's small business ombudsman Bruce Billson said the damage social media hackers wreaked on small businesses could be devastating.
"Some people have built their entire businesses on Facebook or Instagram and we understand that having someone else access and control their account is devastating for their business and their reputation," Billson said.
"They watch the damage to their business occur in real-time with no ability to stop it."
Over the past 12 months, the ombudsman has helped investigate 34 cases of small business owners having their Facebook or Instagram accounts hacked or disabled.
Billson said his office often worked with Meta to help small business owners regain access to their accounts.
"Our office cannot make findings, or compel Meta to give particular outcomes, but we work collaboratively to help people get back to business as soon as possible," Billson said.
The first step people should take is to follow Meta's processes for hacked accounts, Billson said.
If this did not work, they could contact his office for assistance, he added.
"We focus on getting the information that Meta need to resolve the issue, put in front of a real person at Meta," he said.
"We have a very good relationship with Meta and they are helpful and responsive in relation to the issues we raise with them."
Users should secure their accounts by following Meta's advice to turn on multi-factor authentication, pick secure strong passwords and activate login alerts, he said.
"We would also encourage people to keep copies of their account details and URLs in a safe place so if they are hacked they can provide the information without the need to access the platform."
But following those steps doesn't always protect users.
'Facebook let them in'
Bekai said what is most frustrating about falling victim to Facebook hackers is that he seemingly did everything right to safeguard his accounts.
"I'm very savvy with computers – I have two-factor authentication and use very secure, random passwords," he said.
"I never thought there was any way my accounts would be compromised."
Bekai said the hackers appear to have infiltrated his accounts by somehow adding themselves as an admin on his Facebook Commerce account, which links personal and business pages, plus credit cards together in the one place.
"The first notification I got was an email saying someone has been added to my Commerce account," he said.
Bekai initially ignored the email thinking it was spam, but then another came through saying a second person had been added to the account.
"What did I do wrong? I had two-factor authentication. How did they get in?" he asked.
"Normally, if I log in on a new device myself, I can't, it pops up with a notification on my phone.
"I got no notifications. Facebook let them in and now they're punishing me for child pornography. What about my reputation now?"
Desperate for a resolution, Bekai said he had resorted to contacting a lawyer to draft a legal notice to Meta on his behalf.
Bekai said he had also made a report to the Australian Cyber Security Centre (ACSC) but was yet to receive a response.
"It's a disgrace," he said.
"How can Facebook be allowed to destroy people's livelihoods in Australia. Is there no consumer protection? Don't have to meet some guidelines of how they operate."
The ACSC is receiving reports of cybercrime in Australia once every seven minutes as instances continue to climb, a report released Friday found.
After 9news.com.au contacted Meta, a spokesperson said the company was investigating Bekai's case.
"We work hard to protect our community and keep them safe from hackers," a Meta spokesperson said.
"We use a combination of automated systems and people to help review content flagged by our community. We are committed to continuing to invest in AI to improve accuracy and strengthen our review and appeal systems."
Contact reporter Emily McPherson at em********@******om.au.
