Suspended Account Scam Targeting

Evidence

• PA-2026-0001 (@vhsdev): Curator personally experienced scam actors targeting them following public reporting of their Facebook suspension — both reply-piling in enforcement posts recommending restoration services and direct approaches via compromised accounts offering paid restoration.
• PA-2026-0029 (@gerardvanschip): Reporter documents "endless offers to restore access for cash (impossible) and hack attacks from dozens of fake Facebook emails that match my X name but not my actual Facebook name." The phishing emails used the reporter's X handle rather than their Facebook name, confirming the scammers sourced the target from the X post rather than from the Facebook account directly.

Context

• The pattern has two documented vectors: (1) scam accounts replying to or quoting public enforcement posts, recommending paid restoration services; (2) phishing emails or direct messages, sometimes sent via compromised accounts, offering account recovery for payment. The first vector uses the public post as a discovery mechanism. The second suggests that scammers are harvesting contact information or usernames from enforcement posts and running targeted outreach.
• The PA-2026-0029 phishing detail is analytically significant: the scammers used the reporter's X handle (not their Facebook name) in the fake emails, which the reporter identified as a tell. This confirms the X post — not the Facebook account itself — was the source of the targeting. The enforcement post is the attack surface.
• This secondary harm is not captured in the current schema. It is documented here as a structural observation: enforcement actions that drive users to seek help publicly create a predictable exploitation window. The affected users are already in a state of heightened vulnerability (account loss, income disruption, no effective Meta support channel), and the scam ecosystem is adapted to that vulnerability.
• Confidence is medium rather than high: only two records currently document this explicitly. The pattern is likely underreported — most reporters would not mention scam activity in the same post as the enforcement notice, and neither the intake skill nor the enforcement notice itself prompts for it. As the dataset grows, this finding should be revisited for reclassification.

Significance

• This finding documents a secondary harm layer that the dataset's primary schema does not capture: users who seek help publicly after losing account access face an active exploitation window from actors who have operationalized the enforcement complaint ecosystem as a targeting surface. The harm is compounding — users in account-loss situations are already in heightened vulnerability, and the absence of legitimate recovery channels makes fraudulent recovery offers more plausible. The cross-platform identity attribution documented in PA-2026-0029 indicates the scam ecosystem is operationally capable of matching enforcement victims to their other online identities, not merely harvesting names from enforcement posts. Whether platforms bear any obligation to address third-party exploitation of their enforcement complaint ecosystem is not established in current regulatory frameworks — this is a structurally enabled harm that does not fit existing content moderation or platform liability categories. The evidence base is two records; this finding should be treated as a structural observation rather than a quantified pattern until additional records are filed.