The Media’s Backdoor to Facebook That Scammers Use to Verify Accounts

Jack Robert had an unusual request.

“My supervisor is looking for someone with access to a Facebook media portal who can claim an inactive 3-letter Instagram username,” Robert wrote to a Motherboard editor in an email last week. Robert was willing to pay for the service, he added.

Robert was referring to the Facebook Media Partner Portal, a tool that media organizations, public relations firms, and other companies can get access to and which acts as a streamlined channel for resolving certain issues with Facebook accounts. Media companies can request help if one of their reporters is getting doxed or harassed, to report a bug to Facebook, or to challenge accidental content removals, for example.

But they can also use the portal to request that Facebook verify (give a blue check to, essentially) specific accounts on Facebook or Instagram, or to help them claim inactive usernames. Facebook may or may not approve both of these types of requests; making a verification or username claim request is not a guarantee. In any case, it is this username and verification access that Robert was trying to access. (VICE does not provide access to the portal to anyone outside of the company).

Robert, it turns out, isn't the only person trying to leverage this often overlooked Facebook tool. Various websites and freelance job listings are either advertising access to the portal or looking for someone who can abuse it to verify accounts. The news provides more insight into the shady methods some people may use to verify or obtain certain accounts on social networks. For years, hackers have broken into accounts to steal them to sell sometimes for thousands or tens of thousands of dollars. Other times hackers have stolen names for bragging rights, or they’ve tricked sites into handing the usernames over. With the Facebook Media Partner Portal, people may not even need to be a hacker to get the job done.

“My supervisor could arrange an escrow to handle the transaction to ensure the safety of both parties involved,” Robert added in another email, explaining how he would pay for the abuse of the Facebook portal.

Once logging into the portal itself, users are presented with several different areas they can get help with. Under “Account Security & Access,” users can deal with accounts they have been locked out of or which they need to reset the password for. Another section is for managing advertising and ad accounts, and another is for product support and bugs.

On Upwork, a site where people can hire freelancers, multiple people have created listings looking for others who have access to the Facebook Media Partner Portal and are happy to abuse it.

“I need to hire someone that has a Facebook Media portal account who can guarantee  verification of 3 instagram pages,” one listing posted a few weeks ago reads. “For this I am willing to pay $200 per page that is verified through your media portal.”

The author of another listing on Upwork says that they are a digital advertising agency from Israel, and they need to in turn hire somebody with access to the portal to help with verifications.

“Our budget per clients is about 1000 USD,” the listing reads, and adds that they hope whoever they hire can handle 10-20 clients per month. The Upwork listings indicate that the people seeking access to the portal have hired applicants.

And to potentially fulfill some of the demand, a dedicated website called ‘Media Partner Panel’ is claiming to offer customers access to Facebook’s panel for a fee. The site says customers could then use this access to verify accounts, claim or change usernames, unban copyright suspended pages, and more. An FAQ on the site says that it runs over one hundred “ghost agencies,” and every year over 50 of those that have access to the panel go unclaimed. The site then sells access to those accounts, it claims. The site says it accepts the cryptocurrencies Bitcoin, Ethereum, Tether, and Binance Coin.

“We saw how hard startup agencies and digital marketing freelancers has to go through to get access to the portal, there high demand for access,” an administrator for the site told Motherboard in a Telegram message. “Once the user confirm order payment, we ask for their FB account email address so they can claim access directly from FB.”

The administrator added that some of their clients use the service to verify the profile pages for Play to Earn games. Play to Earn games are games where the player can earn cryptocurrency or other tokens. The administrator said some other customers use access to the portal for pages related to entertainment, sports, and business and startups.

The Media Partner Panel site administrators have made multiple YouTube videos claiming to show their access to the panel, and provided Motherboard with screenshots of their alleged access. Motherboard was unable to independently verify whether the site fulfils its promise of providing access to the panel to paying customers.

Adam Isserlis, director of communications at Facebook’s parent company Meta, told Motherboard in an emailed statement that “The Partner Portal is intended to give trusted partners access to account services such as harassment and impersonation support, username changes, and verification. When access is abused, we take steps to further secure the Portal and ban those who have made improper requests from future access. Our global operations taskforce addresses portal requests and is investigating the claims made in this story.”

Some victims of hacking on Meta platforms, including Instagram, find the process of recovering their account so difficult that they’ve hired experts who understand how to effectively get their account back.

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.