Frightened and angry, Alana scrambled to ensure GoFundMe canceled the fund-raiser, which it did. “Our fraud protection measures prevented this individual from gaining access to any of the funds raised. This user has been banned and the money has been refunded to donors,” a spokesperson for GoFundMe said in a statement.
But the incident marked only the beginning of what would become a months-long struggle between Alana and a hacker determined to steal her nonprofit’s donations—by weaponizing Facebook.
Americans gave a record-breaking $410 billion to nonprofits last year, according to Giving USA, an annual report from Indiana University researchers. More people are also donating online, either directly through organizations’ websites or via social media platforms.
Facebook entered the game five years ago when it introduced a simple “Donate” button, which allowed users to send funds directly to a select group of major nonprofits. Since then, charitable giving has become a central part of the social network. The company has developed more tools for both nonprofits and regular users interested in raising money for causes; Facebook notifications encourage people to start fund-raisers for their birthdays. Last year, the company stopped charging nonprofits fees to accept donations (though Facebook still collects a small percentage of the money raised via personal fund-raisers).
As Facebook expanded these features, more nonprofits seized the opportunity to connect with a wider audience of potential donors and people who care about their causes. In the US, any registered 501(c)(3) organization with a bank account can sign up to use the social network’s tools. Today, over one million charitable organizations in 19 countries accept donations on Facebook, according to the company. More than 20 million users have either donated or started a fund-raiser themselves. That’s a fraction of Facebook’s over two billion monthly users, but still represents a significant source of funding for many organizations.
Facebook’s nonprofit efforts have also remained a public relations bright spot for the company while it's been embroiled in one scandal after another since the 2016 US presidential election. And they play right into Mark Zuckerberg’s new mission for the company, to “bring the world closer together.” Last week, for example, Facebook announced that users contributed more than $125 million to nonprofits around the world during its annual Giving Tuesday event, over $80 million more than the year before.
But some nonprofit leaders say Facebook’s decision to prioritize charitable giving hasn’t coincided with an appropriate increase in support for the organizations that use its products.
Desperate, Alana reached out to Facebook for help by every method she could imagine. She sent emails, tweets, and even mailed letters to Mark Zuckerberg, Sheryl Sandberg, and the company’s board of directors. She says she also tried contacting the FBI and the Better Business Bureau. Weeks went by before she reached anyone who could help. Finally, on September 29, Alana heard back from someone via Twitter: Guy Rosen, Facebook’s vice president of product management. It was the day after Facebook announced a cybersecurity breach that impacted around 30 million users.
Several days later, the hacker evaporated from the animal shelter’s page for good. He had gained repeated access to Alana’s account using a combination of social engineering and malicious phishing links—traps that can be avoided if you’re trained in how to spot them, but not by changing passwords.
After WIRED reached out to Facebook in early October, an employee from the social network’s communications department also contacted Alana to ensure that her account was secure, according to emails. But Alana’s problems weren't over. Numerous fake Facebook accounts soon began appearing that impersonated people who worked for the shelter, or their friends and family. The harassment was exhausting, and it didn't stop until Alana transferred $1,500 to the hacker via an anonymous PayPal account—the same amount the fake GoFundMe had raised before it was shut down and the money returned to donors. Since then, Alana says, she and the shelter's Facebook page have been left alone.
Facebook says it provides plenty of support.
Amanda Lollar also struggled to reach someone at Facebook who could help her after her nonprofit’s page was abruptly shut down.
Lollar tried creating a new Facebook page for Bat World Sanctuary, but the social network initially barred her from using its fund-raising tools. It took a lucky coincidence and Alana’s involvement for help to arrive. After hearing about Bat World Sanctuary’s plight from a Facebook user who followed both pages, Alana connected Lollar with the same Facebook communications representative who had helped her.
Experts say that charities are uniquely vulnerable targets online. Collectively, they process millions of dollars in donations, but individual organizations often operate on tight budgets, with limited resources if something goes wrong. Almost 60 percent of nonprofits say they don't provide cybersecurity training to staff on a regular basis, according to a recent survey of 250 nonprofits in the US and Canada by Microsoft and the Nonprofit Technology Network, an organization that helps nonprofits use emerging tech. Almost 70 percent say they don't have a plan in the case of a cybersecurity attack.
Even organizations that do have room in their budget might not want to spend it on hiring another employee. Donors tend to avoid nonprofits that spend higher percentages of their budgets on administration and fund-raising costs. “Often the funding support specifically for more efficient technology isn't matched with the donations being sent specifically for the programs or services,” said a spokesperson for Charity Navigator, an organization that evaluates nonprofits in the US.
Before their Facebook pages were targeted, neither Alana nor Lollar’s organizations were using two-factor authentication, a basic security protection recommended by most experts. Neither woman recalls being warned by Facebook about potential security risks, even though both pages had large followings and processed significant amounts of money each month. And while Facebook’s Charitable Giving Playbook for Nonprofits “covers all of Facebook’s Charitable Giving tools, and gives instructions and tips to help you use them,” it doesn’t provide any advice about cybersecurity or warn about social engineering or phishing scams that could put nonprofits at risk.
Despite their negative experiences, however, both Lollar and Alana stress that Facebook has been transformative for their organizations. The platform connected them with a flood of new donors, which translated to far more resources for the animals they are dedicated to helping.