The Indicator from Planet Money

Episode•July 10, 2025•9 min

Could Meta do more to protect us from cyber scams?

Many small businesses are online now, but so are cyber criminals trying to take advantage. On today's show, how one bar owner fell victim to a Facebook scam and if big tech could do more to protect small business owners from increasing cyber attacks. Read Stephan's original piece (https://www.wwno.org/business/2025-06-04/a-new-orleans-restaurant-owners-facebook-was-hacked-it-put-her-business-in-jeopardy). Related: The secret world of those scammy text messages (https://www.npr.org/2025/05/23/1253043749/pig-butchering-scam-crypto-tether) After being scammed, one woman tries to get her money back (https://www.npr.org/2024/07/04/nx-s1-4995557/after-being-scammed-one-woman-tries-to-get-her-money-back) For sponsor-free episodes of The Indicator from Planet Money, subscribe to Planet Money+ via Apple Podcasts or at plus.npr.org (http://plus.npr.org/). Fact-checking by Sierra Juarez (https://www.npr.org/people/g-s1-26724/sierra-juarez). Music by Drop Electric (https://dropelectric.bandcamp.com/). Find us: TikTok (https://www.tiktok.com/@planetmoney), Instagram (https://www.instagram.com/planetmoney/), Facebook (https://www.facebook.com/planetmoney), Newsletter (https://www.npr.org/newsletter/money). To manage podcast ad preferences, review the links below: See pcm.adswizz.com (https://pcm.adswizz.com) for information about our collection and use of personal data for sponsorship and to manage your podcast sponsorship preferences. Learn more about sponsor message choices: podcastchoices.com/adchoices (https://podcastchoices.com/adchoices) NPR Privacy Policy (https://www.npr.org/about-npr/179878450/privacy-policy)

Apple Podcasts Overcast

Transcript

0:01

Npr.

0:11

This is the Indicator from Planet Money. I'm Darrian woods and back with me for a second today in a row is friend of the show, Stephen Vassarha from the Gulf States newsroom.

0:21

Good to be back with you, Darian. And today I have a very different story for you about small businesses like the Little House. It's this neighborhood bar in New Orleans, the kind of place where you can sip wine while surrounded by taxidermied alligators and chicken feet.

0:39

We're swamp chic, if you will.

0:41

Swamp chic. I hadn't heard that one before.

0:43

That is the bar's owner, Hilary Hanning.

0:45

You look around, we've got taxidermy and all kinds of stuff, but it's like encompassed with this very bougie esque, really cool boutique wine selection and fun cocktails and stuff. It's struggling to death, but we're having fun now.

1:00

The real reason we're here is the source of some of that struggle. Hillary's been dealing with a problem that's harmed thousands of small businesses and caused many to shut down.

1:11

We're talking about cybercrime. Hacks at big companies like Sony and Equifax get plenty of attention. But small businesses fall victim to cybercrime way more often than big.

1:25

So on today's show, we hear about the scam that threatened this New Orleans neighborhood bar and the case for why tech giants should take on more of the responsibility for cybersecurity. Not mom and Pops. This message comes from Designer Shoe Warehouse. You know that feeling when you find shoes you love at a great price and want to tell everyone about it? Find something to brag about at Designer Shoe Warehouse, like the latest styles from brands you love, the trends everyone's obsessing over, and shoes that make you feel like you head to a DSW store or dsw.com today for shoes that get you at prices that get your budget dsw. Let us surprise you. Let's zoom back to November last year. Hillary was planning a fundraiser for a winery in North Carolina devastated by Hurricane Helene.

2:18

On a busy day, before opening the bar, Hillary got a Facebook message. It looked to be from Facebook's support team and it said there was fraudulent activity on her account.

2:27

Yeah, if you don't think this is correct, you can appeal it, whatever. So of course, in that knee jerk moment, I hit appeal and it all started to fall apart.

2:36

After that, Hillary started getting these unusual calls from friends. They were asking about these strange products being sold on her Facebook page.

2:46

Golf carts, televisions, a truck that they were trying to fake, sell like, and I'm just like, in Atlanta traffic. I'm sorry. I swear I almost died, like, 20 times.

2:56

The social accounts for Hillary's bar were stolen, and the fraudster was now trying to use them to defraud others.

3:04

And again, Hillary is far from the only business owner to get scammed like this. Verizon recently released an analysis of its data on cyber attacks. It found there were about four times as many small businesses that fell victim as large ones.

3:19

Now, Verizon defines small business as having fewer than a thousand employees. So it's a pretty big, big range between that and your neighborhood bar. Verizon also said one reason there are more small business victims is likely due to the fact that there are just more small businesses in general.

3:36

Still. We are talking about thousands of victims, and this comes with serious consequences. MasterCard did its own survey and found nearly half of the small and medium sized businesses that they asked also experienced a cyber attack. And nearly 20% of them either filed for bankruptcy or had to close their doors.

3:56

Small businesses are often targeted because they have worse security, which, you know, makes sense. Owners are often stretched pretty thin. They often have to be their own janitors, their own accountants.

4:08

Michael Daniel is the head of the Cyber Threat alliance, and he says expecting those owners to also be their own cybersecurity experts is. Is asking a lot.

4:18

People who are running them are often quite busy wearing 17 hats. So they are more vulnerable. Often.

4:25

Yeah.

4:25

It's hard to add an 18th hat to be your own cybersecurity expert.

4:29

Absolutely. Frankly, we shouldn't expect them to.

4:32

I asked a few cybersecurity experts like Michael how small businesses can protect themselves. And honestly, it's probably what you already heard. Use two factor authentication. Be careful with who you share your password with. Maybe turn on a firewall. Nothing too fancy or even expensive. Yeah.

4:49

Cybersecurity advice is like the basic of good diet cliches. Eat your veggies, everything in moderation, don't reuse passwords. But just like dieting, these things all sound simple, but in the rush of everyday life, they can be hard to follow.

5:05

Right. And this is what Michael means when he says we shouldn't expect small businesses to have to be their own cybersecurity experts. Instead, Michael says more of that responsibility should be on the tech companies.

5:18

We've pushed the cybersecurity burden out to the edge of the network. And that means small businesses. It means individuals. It means your mom. My mom. Right. You know, everybody's grandmother is like, responsible for their own Cybersecurity. And that's kind of crazy when you think about it.

5:38

Putting that responsibility on tech companies means things like Instagram requiring Two Factor authentication, not leaving that choice to an elderly shop owner. Or like those warnings when you access your account from a different location, asking if that's really you.

5:52

Yeah, Two Factor Authentication. I use it, but it is annoying.

5:57

Yeah. And I totally get that. It's probably why these companies aren't actually making that a requirement. But Michael says companies like Meta can be much more assertive about doing these things to protect their users.

6:09

I will say that I know people at Meta that work on their security programs and they are actually very concerned about the level of fraud. It's just that we haven't sort of structured the market to really demand that these platforms operate in a certain way that is more secure by default.

6:27

So when we say the market is not structured for this, a good way to understand this is to compare the tech industry to banking. A bank is much more likely to be proactive on fraud that targets its customers. And because the bank is also at risk of losing money, too. Of course, there are also laws in place that require banks to refund you in certain circumstances when you didn't authorise the payment.

6:50

On Facebook, these accounts are free. So its parent company, Meta, doesn't have a lot to lose that would push it to be more aggressive here.

6:58

But the rest of us, we still have plenty to lose here. Like last year, more than $16.5 billion in losses were reported to the FBI's Internet Crime Complaint center for All Internet crime.

7:11

That same year, 41 state attorneys general demanded Meta take action to protect customer accounts.

7:18

We reached out to Meta and in an email, spokesperson Aaron Logan said the company works hard to keep scammers off its platforms and invests in new tech and solutions to stop them. She added that tackling scams requires everyone to do their share, from governments to banks to law enforcement and other tech companies.

7:37

Now, when it came to Hilary Hanning's hack, she seemed to catch a break. About three weeks into the whole ordeal, a friend called her and said he managed to get someone from Meta on the phone. She ended up spending four and a half hours talking and following instructions to download things, all under the hope of getting her accounts back.

7:57

He's like, Ms. Hanning, this is just a way to verify and work around and whatever, and then. And then you realize that your mother's bank account has been depleted.

8:09

Yes, it was another scammer. Meta does not have a 1-800-number to call her friend likely found a fake account with a number pretending to be with Meta Customer Service.

8:20

And this new Scammer got about $10,000.

8:23

I mean, the guy even, like, I had to go pick up my 3 year old in the midst of all this. Cause like I said, I was running errands. Oh, that's okay. I don't want you driving while you're talking to me. So I'm gonna put you on hold, and you just let me know when you come back. I mean, like, great customer service, you know, you have to laugh at some point.

8:44

She's keeping her sense of humor in the darkness. Yeah, Hillary covered that by borrowing money, which meant more debt on top of what she already had to keep the bar going.

8:55

And then you're just humiliated

8:58

and you're

8:59

disappointed in yourself because you fell for it. And you put people you love very much in a harder situation than they needed to be in.

9:12

We asked Michael Daniel about this, and he said business owners like Hillary should not blame themselves for falling for a scam.

9:19

You know, actually, I started to try to avoid using that. Using that terminology, falling for. It's natural that you would have those feelings, but I don't think that someone should beat themselves up because the entire deck is stacked against you.

9:34

Hillary spent months trying to get her Facebook and Instagram accounts back. After we reached out to Meta, they said they'd look into her case, and within hours, Hillary's accounts were back.

9:47

This episode was produced by Julia Ritchie with engineering by Neil Rauch. It was Fact act by Sarah Juarez. Cake and Cannon edits the show and the indicator is a production of npr.

Could Meta do more to protect us from cyber scams?

0:00

0:00

Related Episodes

Who's financing Meta's massive AI data center?

Who's financing Meta's massive AI data center?

Nov 25, 20259 min

MetaHyperionBlue Owl Capital

Pay transparency. The WhatsApp and Instagram decision. Our beef with screwworms.

Pay transparency. The WhatsApp and Instagram decision. Our beef with screwworms.

Nov 21, 20259 min

Pay TransparencyWage IncreaseColorado

OpenAI's deals are looking a little frothy

OpenAI's deals are looking a little frothy

Oct 16, 202510 min

OpenAINvidiaOracle

What’s supercharging data breaches?

What’s supercharging data breaches?

Oct 7, 20259 min

Data BreachesRansomwareDark Web