Could Meta do more to protect us from cyber scams?

0:01NPR.

0:11This is The Indicator from Planet Money. I'm Darian Woods, and back with me for a second day in a row is friend of the show, Stephen Visaha from the Gulf States Newsroom. Good to be back with you, Darian. And today I have a very different story for you about small businesses, like the Little House. It's this neighborhood bar in New Orleans, the kind of place where you can sip wine while surrounded by taxidermied alligators and chicken feet. We're swamp chic, if you will. Swamp chic? I hadn't heard that one before. That is the bar's owner, Hilary Hanning. You look around, we've got taxidermy and all kinds of stuff, but it's like encompassed with this very bougie-esque, really cool boutique-y wine selection and fun cocktails and stuff.

0:57It's struggling to death, but we're having fun. Now, the real reason we're here is the source of some of that struggle. Hilary's been dealing with a problem that's harmed thousands of small businesses and caused many to shut down. We're talking about cybercrime. Hacks at big companies like Sony and Equifax get plenty of attention. But small businesses fall victim to cybercrime way more often than big ones. So on today's show, we hear about the scam that threatened this New Orleans neighborhood bar. And the case for why tech giants should take on more of the responsibility for cybersecurity, not mom and pops.

1:39This message comes from Vanguard. Capturing value in the bond market is not easy. That's why Vanguard offers a suite of over 80 institutional quality bond funds, actively managed by a 200-person global team of sector specialists, analysts, and traders. They're designed for financial advisors looking to give their clients consistent results year in and year out. See the record at Vanguard.com slash audio. That's Vanguard.com slash audio. All investing is subject to risk. Vanguard Marketing Corporation Distributor. This message comes from Dell Technologies. Your new Dell PC with Intel Core Ultra helps you handle a lot when your holiday to-dos get to be a lot.

2:24Luckily, the Dell PC helps you get it all done. Get yours at Dell.com slash holiday. Let's zoom back to November last year. Hillary was planning a fundraiser for a winery in North Carolina devastated by Hurricane Helene. On a busy day before opening the bar, Hillary got a Facebook message. It looked to be from Facebook's support team, and it said there was fraudulent activity on her account. Yeah, if you don't think this is correct, you can appeal it, whatever. So, of course, in that knee-jerk moment, I hit appeal, and it all started to fall apart after that. Hillary started getting these unusual calls from friends.

3:02They were asking about these strange products being sold on her Facebook page. Golf carts, televisions, a truck that they were trying to fake sell. Like, and I'm just, like, in Atlanta traffic. I swear I almost died like 20 times. The social accounts for Hillary's bar were stolen. And the fraudster was now trying to use them to defraud others. And again, Hillary is far from the only business owner to get scammed like this. Verizon recently released an analysis of its data on cyber attacks. It found there were about four times as many small businesses that fell victim as large ones. Now, Verizon defines small business as having fewer than a thousand employees.

3:45So it's a pretty big range between that and your neighborhood bar. Verizon also said one reason there are more small business victims is likely due to the fact that there are just more small businesses in general. Still, we are talking about thousands of victims. And this comes with serious consequences. Mastercard did its own survey and found nearly half of the small and medium-sized businesses that they asked also experienced a cyber attack. And nearly 20 % of them either filed for bankruptcy or had to close their doors. Small businesses are often targeted because they have worse security, which, you know, makes sense.

4:24Owners are often stretched pretty thin. They often have to be their own janitors, their own accountants. Michael Daniel is the head of the Cyber Threat Alliance. And he says expecting those owners to also be their own cybersecurity experts is asking a lot. People who are running them are often quite busy wearing 17 hats. So they are more vulnerable often. Yeah, it's hard to add an 18th hat to be your own cybersecurity expert. Absolutely. Frankly, we shouldn't expect them to. I asked a few cybersecurity experts like Michael how small businesses can protect themselves. And honestly, it's probably what you already heard.

5:01Use two-factor authentication. Be careful with who you share your password with. Maybe turn on a firewall. Nothing too fancy or even expensive. Yeah, cybersecurity advice is like the basic of good diet cliches. Eat your veggies. Everything in moderation. Don't reuse passwords. But just like dieting, these things all sound simple, but in the rush of everyday life, they can be hard to follow. Right. And this is what Michael means when he says we shouldn't expect small businesses to have to be their own cybersecurity experts. Instead, Michael says more of that responsibility should be on the tech companies.

5:40We've pushed the cybersecurity burden out to the edge of the network. And that means small businesses. It means individuals. It means your mom, my mom, right? You know, everybody's grandmother is like responsible for their own cybersecurity. And that's kind of crazy when you think about it. Putting that responsibility on tech companies means things like Instagram requiring two-factor authentication, not leaving that choice to an elderly shop owner. Or like those warnings when you access your account from a different location asking if that's really you. Yeah, two-factor authentication, I use it, but it is annoying.

6:18Yeah, and I totally get that. It's probably why these companies aren't actually making that a requirement. But Michael says companies like Meta can be much more assertive about doing these things to protect their users. I will say that I know people at Meta that work on their security programs, and they are actually very concerned about the level of fraud. It's just that we haven't sort of structured the market to really demand that these platforms operate in a certain way that is more secure by default. So when we say the market is not structured for this, a good way to understand this is to compare the tech industry to banking.

6:55A bank is much more likely to be proactive on fraud that targets its customers because the bank is also at risk of losing money, too. Of course, there are also laws in place that require banks to refund you in certain circumstances when you didn't authorize the payment. On Facebook, these accounts are free. So its parent company, Meta, doesn't have a lot to lose that would push it to be more aggressive here. But the rest of us, we still have plenty to lose here. Like last year, more than$16.5 billion in losses were reported to the FBI's Internet Crime Complaint Center for all internet crimes. That same year, 41 state attorneys general demanded Meta take action to protect customer accounts.

7:39We reached out to Meta, and in an email, spokesperson Erin Logan said the company works hard to keep scammers off its platforms and invests in new tech and solutions to stop them. She added that tackling scams requires everyone to do their share, from governments to banks to law enforcement and other tech companies. Now, when it came to Hilary Hanning's hack, she seemed to catch a break about three weeks into the whole ordeal. A friend called her and said he managed to get someone from Meta on the phone. She ended up spending four and a half hours talking and following instructions to download things, all under the hope of getting her accounts back.

8:18He's like, Miss Hanning, this is just a way to verify and work around and whatever. And then you realize that your mother's bank account has been depleted. Yes, it was another scammer. Meta does not have a 1-800 number to call. Her friend likely found a fake account with a number pretending to be with Meta customer service. And this new scammer got about$10 ,000. I mean, the guy even, like, I had to go pick up my three-year-old in the midst of all this, because like I said, I was running errands. oh, that's okay. I don't want you driving while you're talking to me, so I'm going to put you on hold and you just let me know when you come back.

8:58I mean, like, great customer service. You know, you have to laugh at some point. She's keeping her sense of humor in the darkness. Yeah. Hilary covered that by borrowing money, which meant more debt on top of what she already had to keep the bar going. And then you're just humiliated. and you're disappointed in yourself because you fell for it and you put people you love very much in a harder situation than they needed to be in. We asked Michael Daniel about this, and he said business owners like Hillary should not blame themselves for falling for a scam. You know, actually, I started to try to avoid using that terminology, falling for.

9:46It's natural that you would have those feelings, but I don't think that someone should beat themselves up because the entire deck is stacked against you. Hillary spent months trying to get her Facebook and Instagram accounts back. After we reached out to Meta, they said they'd look into her case. And within hours, Hillary's accounts were back. This episode was produced by Julia Ritchie with engineering by Neil Rauch. It was fact-acted by Sarah Juarez. Kate Concanted edits the show, and The Indicator is a production of NPR. This message comes from NPR sponsor, Capella University. Interested in a quality online education?

10:26Capella is accredited by the Higher Learning Commission. A different future is closer than you think with Capella University. Learn more at capella.edu. This message comes from BetterHelp. To mark World Mental Health Day, BetterHelp is thanking the therapists who change people's lives all around the world by providing accessible mental health support. With over 12 years of experience matching clients with therapists and one of the world's largest online therapist networks, BetterHelp can help you find the right therapist. Visit BetterHelp.com slash NPR for 10 % off your first month.