For a small animal shelter, a Facebook page isn’t a marketing extra. It’s the whole storefront: where adoptable pets get seen, where donations come in, where volunteers find out they’re needed. Take it away and the lights start going out. That’s exactly what happened to one Oregon nonprofit in the summer of 2024, and the way it unfolded is a warning for every rescue running on a shoestring and a social feed.
How a routine-looking email did the damage
In July 2024, staff at the Columbia Gorge Humane Society in The Dalles, Oregon, opened an email that appeared to come from Petfinder, the adoption database they used to list animals. The message asked them to confirm the shelter’s Facebook username and password so the two accounts could be linked. It looked ordinary. It was not from Petfinder at all.
This is phishing, the con where a scammer poses as a company or person you trust to trick you into handing over login details. It is staggeringly common. The FBI logged more than 298,000 phishing-related complaints in 2023 alone, making it one of the most-reported forms of online crime in the country. The reason it keeps working is that it doesn’t rely on any technical break-in. It relies on a believable request landing in a busy inbox.
Once the scammers were inside the shelter’s account, they went to work fast. They posted photos of dogs the shelter didn’t actually have, paired with a Google form instructing hopeful adopters to send a $150 “deposit” over Zelle or Apple Pay. The form even warned applicants not to ask questions before paying, or their application would be tossed. At least one person sent the money before anyone realized what was happening.
Meta made it worse
The shelter did everything right on its end, reporting the breach to Meta within about two hours. Meta briefly handed the page back, then dropped the ball in a way that turned a bad day into a crisis: it didn’t strip the hackers of their administrator access to the account. So the scammers simply locked staff out again and kept posting fake dogs. The second time around, Meta grew far less responsive, reportedly closing the shelter’s complaint ticket while saying it was working on a longer-term fix.
An animal-law attorney stepped in to try to help the shelter claw back control, and described Meta as essentially unreachable, uninterested and unresponsive for weeks on end. Anyone who has tried to reach a human at a giant platform after an account takeover knows the feeling. For a two-person nonprofit, that wall is not an annoyance. It’s an existential threat.
What it actually costs a shelter
Before the hack, the humane society’s page reached thousands of local followers who kept the operation alive. With that channel gone, adoptions and donations cratered. The scammers had also wiped out the shelter’s Amazon wish list, choking off the flow of food and supplies for the roughly 60 dogs and cats in its care. Leadership said openly that they feared having to close for good if things didn’t turn around.
The shelter did what it could: spun up a brand-new Facebook group, which drew only a few hundred followers against the thousands it had lost, and launched a GoFundMe to try to cover the damage. Rebuilding an audience from scratch, though, is slow, and slow is expensive when animals need feeding today.
How to keep it from happening to you (or your local rescue)
The uncomfortable lesson is that this can hit anyone, but a few habits make the door much harder to open:
- Turn on two-factor authentication for every social and email account, so a stolen password alone isn’t enough to get in.
- Treat any “confirm your login” email as guilty until proven innocent. Real platforms don’t ask for your password by email. When in doubt, don’t click the link; go to the site directly and log in the normal way.
- Check the sender’s actual address, not just the display name, and hover over links to see where they really lead before clicking.
- Limit who has admin access to a page, and review that list regularly, so one compromised person can’t hand over the keys to everything.
- Keep a backup channel, an email newsletter, a second platform, a website donation page, so your whole operation doesn’t live and die on one account you don’t control.
What’s new since this was written
Account-takeover scams aimed at nonprofits and small businesses have only grown, and platform support for the victims remains thin. The bright spot in stories like this one is almost always the community: local coverage, word of mouth, and small recurring donors are what pull a shelter back from the edge when a platform won’t. If a rescue near you loses its page to a scam, the most useful things you can do are share their new, verified channels, give directly through a link you’ve confirmed is really theirs, and be skeptical of any “adoption deposit” demanded through a payment app. The animals depend on an audience the shelter can’t easily rebuild alone.
References
- Columbia Gorge News. “Columbia Gorge Humane Society Social Media Hacked.” columbiagorgenews.com
- The Bulletin. “Facebook Scam Leaves Humane Society in The Dalles ‘Paralyzed’ as Meta Does Nothing.” bendbulletin.com
- FBI Internet Crime Complaint Center. “2023 Internet Crime Report.” ic3.gov
- Federal Trade Commission. “How to Recognize and Avoid Phishing Scams.” consumer.ftc.gov
