Secondary Exploitation: Scam Account Recovery Operations

Documented Example

• A pitch email (June 2026) sent from "Andy Stone Meta" <andystonemeta@gmail.com> — impersonating Meta's real communications director Andy Stone — to a user whose Instagram account had been disabled. The email uses the Meta for Business logo and claims a "professional IT specialist who works part-time with us" has submitted an appeal on the user's behalf. It then requests: (1) a clear selfie, (2) full name, (3) Instagram username, and (4) a $400 "verification fee" paid directly to the IT specialist. The selfie + name + username combination is sufficient for identity theft or account takeover independently of the fee. Source image: assets/resources/scam-account-recovery-pitch-email-meta-2026-06.jpeg. Discovered via @welbackneechi, an account offering account recovery services that was found to be hosting CSAM; reported to X by @vhsdev on June 23, 2026.

Significance

• Platform enforcement opacity creates a direct market for scam operations. Users who receive bare policy citations with no appeal path and no contact information are primed to respond to anyone who claims insider access. The scam is structurally enabled by appeal access failure patterns and enforcement notice policy opacity — the less the platform communicates, the more credible the scammer becomes.
• The identity document + selfie harvest is more damaging than the fee: it enables downstream account takeover, SIM swap attacks, or identity fraud against users who are already in a vulnerable state.

Intake Log

• 2026-06-23 — pattern documented by @vhsdev from a pitch email sample encountered while investigating scam account recovery operations targeting Meta enforcement victims.