When AI Replaces Human Support, Who Helps the Small Business That Gets Hacked?

On the first day, I spent seven straight hours talking to Meta AI.  I did not begin that day expecting to spend seven hours with a chatbot. I began because someone had apparently taken control of the administrative machinery behind the Facebook and Instagram assets of our nearly twelve-year-old company, and I needed help.

Seven hours later, something remarkable had happened. Meta AI had helped me diagnose the crime.  We discovered that my business privileges had been suspended on April 17. That date stopped me cold. I went back through my records. On April 17, I had received a phone call from the man presenting himself as “Jeff from the Call Her Daddy team.”

That was the day he told me Meta was backed up. That was the day he told me the proposed LIVE event with Alex Cooper still needed approval. That was the day he walked me through activating the event-management function again. And according to what I was now learning from Meta AI, April 17 was also the day my privileges over my own business were suspended, although I did nothing with ‘Jeff Howard’ to trigger my demotion.  With the help of Meta AI, we had a timeline.

The full story of the fake Call Her Daddy approach is told separately because it deserves its own warning to small businesses and influencers. The short version is that people claiming to represent Alex Cooper’s team had spent months cultivating a plausible media collaboration with us. They offered a compensation fee; they scheduled and had several calls with us about the podcast.  They invoked Meta sponsorship. They explained that certain event-management functions had to be configured so our followers could be notified of a future LIVE appearance.

This was not a stranger asking for my password. I was being guided through what appeared to be legitimate collaboration tools for what appeared to be a legitimate media event and in that whole process, it was only my emails involved.  The process did not include adding ‘Jeff’ in any way, so it was the watching, the coaching, that gave him what he needed?

Two times we had calls with the imposter Alex Cooper team for the express purpose of activating events and doing it with only our own email accounts.  After the first time, nothing bad happened, nothing that we could see.  But the call with Alex Cooper never happened.

Our pages remained up. We continued posting. Our followers continued seeing us. Months later, ‘Jeff’ returned with an explanation: Meta was backed up, the event approval was delayed, and I needed to activate the function again. That second call happened April 17. Now, months later, sitting with Meta AI, April 17 had surfaced again.

For seven hours, the AI and I worked the problem. We went through what had happened. We examined the administrative problem. We discussed the apparent compromise. The AI helped me understand that this was not simply a lost password or a missing Facebook page. The public storefront was still open. We could still post. But behind that storefront sat another layer of permissions, business assets and administrative control.

By the end of the day, Meta AI agreed that the matter warranted a security investigation. It told me an investigation would be opened. It told me to watch my Support Inbox. Further information, I was told, should appear within 24 to 48 hours. I went to bed exhausted, but I also thought Meta was investigating the hack.  Meta is not.

Day Four: The Investigation That Wasn’t There

We waited because Meta AI had told us to wait. Twenty-four hours passed. Then forty-eight.

On the fourth day, I went back. There was nothing in the Support Inbox. I could not find evidence of a security investigation. Meta AI could not produce a case number I could independently track. The investigation I believed had been opened after seven hours of diagnosis had apparently vanished into the same digital fog where so many customer-service promises now go to die.

So we started again.  This time, Meta AI began directing me toward other ways to report the hack. If you have never tried to report an unusual business-account takeover inside a major technology platform, you may imagine there is a button somewhere that says: My business administration has been taken over by criminals.

There is not.  There are categories, help pages, recovery flows, support inboxes, account-status pages, hacked-account routes, compromised-page routes, Business Suite routes, Business Support routes, “Report a Problem” routes, advertising-support routes, administrative-access routes, security escalation routes and links to more links.

Over the next four hours, we tried route after route.  The problem was that our situation did not fit the ordinary boxes. We had not simply forgotten a password. Our Facebook page had not disappeared. We had not merely been locked out of a public account. We could still post. To the outside world, Sisters of the Valley still looked like Sisters of the Valley.

The apparent takeover was behind the page.  That distinction became increasingly horrifying as I understood it. Modern social-media businesses are not controlled by one password attached to one page. Behind the public page can sit an architecture of business portfolios, administrators, permissions, partners, advertising assets, Instagram connections, event functions and other relationships. Most small-business owners do not spend their days studying that architecture. We are busy running businesses.  Criminals have every incentive to study it.

And once that invisible administrative layer is compromised, the ordinary recovery routes may not merely be useless. They may send the victim back into an environment the victim no longer controls.

That is what appeared to be happening to us.  All of the Facebook reporting and recovery links sent me somewhere else, redirected me to pages that were obviously set up by the hackers that give choices like “Create a New Page” or “Create an Ad.”  If I tried from any device that I was ever logged into Facebook on, the redirect happened automatically.  Frighteningly powerful.

Think about that. I was trying to report that someone had apparently taken control of the administrative machinery behind our social-media business, and one of the doors offered to help me create another page. The other offered to let me spend money.

Worse, these routes appeared to return me to pages and business functions inside the very administrative environment I believed had been compromised.  The emergency exits led back into the building.

Four hours later, after trying one reporting route after another, Meta AI again agreed that the matter warranted a security investigation. Again, I was told an investigation would be opened.  Just like last time.

The Criminal Had a Human Strategy. We Had an AI Assistant.

This was the point when I began to understand that our problem was larger than one hacked business.

The people who targeted us appear to have had a human strategy. They studied us. They knew media invitations were normal for us. They used the name of a real and famous podcaster. They understood that younger Sisters in my office would immediately recognize Alex Cooper even if I did not. They offered a plausible amount of money. They scheduled calls. They answered questions. They used Zoom. They waited.

The attacker only needs one path in. The victim has to correctly diagnose what happened, understand which layer of the system was affected, find the correct reporting channel, choose the correct category, satisfy automated eligibility requirements, explain an uncommon attack to AI, persuade the AI that ordinary troubleshooting does not apply and somehow qualify for a human being with enough authority to act. The criminal gets months to study the system. The victim gets a chatbot.

We Tried “Report a Problem”

We kept going. We filed “Report a Problem” submissions. Then we waited.

Nothing happened that restored our administrative control. No human investigator contacted us. No one appeared with the authority to look at the history of our business assets and ask the obvious questions: Who changed what? When? From where? Why did my privileges change on April 17? What happened inside the administrative layer after that call?

This is where AI-driven support creates a peculiar illusion of movement. The AI responds. It acknowledges. It explains. It expresses concern. It suggests another route. It may tell you that your case is serious. It may tell you that something should be escalated. It may even tell you that an investigation is being opened.

The conversation feels active because words keep appearing.  But a beautifully worded response is not an investigation. An assurance that a matter has been escalated is not the same thing as a trackable escalation. Empathy-shaped language is not intervention. And an AI assistant that cannot summon a human being with authority may function less like customer service and more like a wall that talks.

So I Set Up an Expensive Ad Campaign with Meta

I have been doing business online for a long time, and I remembered an old trick. In the past, if I really needed to get someone from Facebook on the phone, one reliable way to improve my chances was to become an advertiser. Money has a remarkable ability to make large companies discover that human beings still exist.

So I set up an advertising campaign. My theory was simple. I would launch the campaign, spend some money, and then cancel it prematurely. Historically, that kind of activity could trigger attention from advertising support. Perhaps I could finally get a person on the phone and explain that someone had apparently taken control of the administrative machinery behind our business. I ran the campaign.  It did not work.  Meta AI told me I still did not qualify for human help.

We Went Outside Meta

On July 6, we stopped waiting for Meta to decide whether our problem deserved to exist.  We filed a formal complaint with the FBI’s Internet Crime Complaint Center, providing the chronology of the months-long impersonation operation and identifying information associated with the people who contacted us. Then we filed a fraud report with the Federal Trade Commission.

There was one moment of dark comedy along the way. When we arrived at the federal Internet Crime Complaint Center to report a months-long impersonation scheme, the first warning on the page informed us that scammers are now impersonating the Internet Crime Complaint Center itself.  I wish I was making this up.  Still, we filed.

And we had a rule at Sisters of the Valley: no surprises.  We were preparing to publish what happened. Before we did that, we decided to give Meta another chance. So, on July 6, after filing with the FBI’s IC3 and the FTC, I went back to Meta AI.  That is when the story became ridiculous.

Then the AI Sent Us to the Bug Bounty Program

I explained the sophistication of the operation. I explained that this was not an ordinary lost-password problem. I explained the apparent takeover of the business-administration layer. I explained the months-long impersonation scheme.

Meta AI recommended the Meta Bug Bounty Program.  At this point, I’m convinced that every day, Meta’s AI takes a new approach to making me go away.  I didn’t know what the program was, but I know what ‘bounty’ means, so I asked, “Do I actually offer a bounty to get my page unhacked?”

No, Meta AI explained.  ‘You don’t offer the bounty, Meta does’.  The program, it explained, rewards security researchers who discover and responsibly report vulnerabilities or bugs in Meta’s systems.  There was a problem. I am not a security researcher. I had not discovered a software bug. I am a 67-year-old business owner trying to report that criminals had impersonated Alex Cooper’s Call Her Daddy team, invoked Meta sponsorship, spent months cultivating our trust and apparently used collaboration tools to get behind the administration of our Facebook and Instagram business assets.

But Meta AI told me the Bug Bounty Program was the best route to get the sophisticated security information I had into the hands of the right experts. So I followed the AI’s advice. At that point, why not?

I went to the Bug Bounty system. I attempted to create or link an account. Meta told me it had sent a six-digit confirmation code to my Sisters of the Valley business email address. The confirmation email did not arrive. I clicked resend. Still nothing.

Perhaps it was delayed. Perhaps a filter caught it. Perhaps there was an account-linking problem. Perhaps there is an entirely innocent technical explanation. We do not know.

What we know is this: after days of trying to report an apparent sophisticated takeover, after two promised security investigations we could not independently verify, after multiple reporting routes, after “Report a Problem” submissions, after an advertising campaign failed to get us a human, after formal reports to the FBI’s IC3 and the FTC, Meta AI sent the victim to a program designed for security researchers who find bugs. And then we could not get through the confirmation-email gate.

This Is Bigger Than Meta

Our experience happened inside Facebook, Instagram and Meta’s business systems, but the larger problem is everywhere.  Representatives are disappearing. AI is becoming the gatekeeper.  Banks do it. Airlines do it. Telecommunications companies do it. Payment processors do it. Software companies do it. Online marketplaces do it. Business platforms do it.

At the same time, the systems governing our money, customers, communications, advertising and identities are becoming more complicated and interconnected.  For routine questions, AI can be enormously useful. I know that firsthand. On Day 1, Meta AI helped me think through the evidence. It helped me understand the significance of April 17. It helped me diagnose that what we were dealing with was not an ordinary public-page problem.

That is what makes this story more troubling, not less.  The AI could reason with me. The AI could help diagnose. The AI could explain. The AI could promise.  But when the problem required institutional action, where was the institution?

That may be the central danger of replacing customer service with artificial intelligence. The machine can create an extraordinarily convincing experience of being helped without necessarily possessing the power to make help happen. AI can tell you it understands.  But can it open the locked door?

Who Helps the Small Business That Gets Hacked?

Small businesses are particularly exposed to this new imbalance. Large corporations have lawyers, security teams, agencies, platform contacts and employees whose entire job is to manage digital infrastructure. Small businesses have whoever is in the office that morning.  In our case, we had Sisters.

We reconstructed months of emails. We matched dates. We found the original fake podcast invitation. We reviewed phone calls. We connected April 17 to the change in business privileges. We preserved evidence. We filed with the FBI. We filed with the FTC. Then we returned to the company holding the keys to the digital assets we were trying to recover.  And we talked to AI.

But there is a profound difference between AI assisting customer service and AI replacing access to customer service. The first can empower people. The second can trap them.

Any company sophisticated enough to build global collaboration systems should be sophisticated enough to understand that criminals will exploit those systems in ways no automated menu can anticipate. Any company using AI as the front door to support should have a functioning emergency exit to human judgment. And any platform that allows one person to grant another person meaningful administrative power should have a rapid, comprehensible and human-accessible process for investigating whether that power was obtained through fraud.

And when the victim finally realizes what happened, increasingly, the victim is asked to explain it to a machine.  The criminal had a human strategy. We have an AI barrier.  And somewhere between those two facts, small businesses have been abandoned.