March 5, 2024

Menlo Park, CA 94025

Re: Meta Account Takeovers and Lockouts

Dear Ms. Newstead:

We, the undersigned attorneys general (the “State AGs”), write to

request immediate action to address the dramatic increase in user account

takeovers and lockouts on Facebook and Instagram. Our offices have

experienced a dramatic and persistent spike in complaints in recent years

concerning account takeovers that is not only alarming for our constituents

but also a substantial drain on our office resources.

Consumers are reporting their utter panic when they first realize

they have been effectively locked out of their accounts. Users spend years

building their personal and professional lives on your platforms, posting

intimate thoughts, and sharing personal details, locations, and photos of

family and friends. To have it taken away from them through no fault of

their own can be traumatizing. Connections that they made and friendships

that they forged become threatened.

Even more alarming, there is a significant risk of financial harm to

threat actors fraudulently charging thousands of dollars to stored credit cards. Furthermore, we

have received reports of threat actors buying advertisements to run on Meta. In some cases, the

ads violate your terms leading to user accounts getting banned. Finally, there are reports of threat

actors posing as trusted friends and offering products for sale, or posing as a friend in need,

seeking money from their “friends."

they were locked out of their accounts and Meta’s failure to provide help:

and other online accounts as well. However, the frequency and persistence of account takeovers

on Meta-owned platforms puts it in a league of its own.

takeover complaints on Meta platforms. That number rose more than tenfold to 783 complaints

by the end of 2023. In January 2024 alone, the office received 128 complaints.

• Vermont: 740% increase from 2022 to 2023

• North Carolina: 330% increase from 2022 to 2023

• Illinois: 256% increase from 2022 to 2023

• Pennsylvania: 270% increase from 2022 to 2023

threat actors are winning the war and running rampant on Meta. While we may not be

completely certain of any connection, we note that the increase in complaints occurred around

the same time Meta announced a massive layoff of around 11,000 employees in November 2022,

investment in account takeover mitigation tactics, as well as responding to users whose accounts

were taken over. This is crucial not just to protect your users, but to reduce the unnecessary

resource burden being placed on our offices to handle these large numbers of user complaints.

We refuse to operate as the customer service representatives of your company. Proper

investment in response and mitigation is mandatory.

convenience. Additionally, we would like materials related to: the number of account takeovers

over the past five years; suspected causes of the increase in account takeovers; safeguards

currently in place to prevent account takeovers; current policies and procedures related to Meta’s

response to account takeovers; and staffing related to safeguarding the platforms against account

takeovers as well as responding to complaints.

Kathleen Jennings

Brian Schwalb