Facebook Phishing: How to Spot Fake Emails, Links and Login Pages

Meta says to look for misspelled words, bad grammar or design mistakes, and to pay close attention to certain kinds of message.

1. Be wary of threats or urgent demands, such as “Do this now or we’ll close your account.”
2. Be wary of requests for money or promises of gifts.
3. Be wary of anything asking for passwords, account details or other personal information.
4. Be wary of language urging you to click a link, messages from people you don’t personally know, and emails from unfamiliar senders.
5. Check the email address or phone number closely. Meta says scammers often use addresses that closely resemble official support accounts.

Meta says its emails only come from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com or metamail.com, or their subdomains (such as support.facebook.com or business.fb.com). Meta also says it will never ask for your username or password by email, send a password to verify in an attachment, or ask for money, payment details or other sensitive information over chat or email. More detail: is this message really from Meta?.

Meta’s example: a post from someone you know says a famous person has died, the link leads to a fake Facebook login page, and scammers then take over your account. Meta says even friends may unknowingly send malicious links or attachments if their account was compromised.

1. Don’t click links in posts, messages, emails or texts that seem off, even from a friend or a company you know.
2. Our advice: contact your friend another way to check, and point them to Facebook posting spam on its own.
3. Report the post or message: see how to report content.

Meta says it has seen malicious Business Manager partner requests containing phishing links, sent through a genuine Meta domain (facebookmail.com).

1. If you don’t know the person or business in the partner request, don’t click any links.
2. Separately, Meta’s general tip for businesses is to use Meta Business Support Home to review account status and support issues.

Meta says to protect your account as soon as possible. If you entered your username or password on a malicious link, someone else might be able to log in. Meta also says one phishing click can lead to several accounts being taken over, including email and WhatsApp.

1. Report your account as compromised at facebook.com/hacked. Meta says you can do this whether or not you can log in, even if you can still log in but worry someone else can too. See hacked account recovery.
2. If you can still log in, reset your password (external site, opens in a new tab) and remove any logins or devices you don’t recognize.
3. Review your Activity Log (external site, opens in a new tab) for posts, interactions or connections you didn’t make, and check recent emails sent by Facebook (external site, opens in a new tab) for problems with your account.
4. Check your Feed and delete any posts you didn’t make (cleaning up spam).
5. Then make it harder next time: turn on two-factor authentication, or create a passkey, which Meta says is less vulnerable to phishing. Meta also says don’t use your Facebook password anywhere else. Meta’s Security Checkup (Accounts Center > Password and security) walks you through these.

Phished outside Facebook too? Meta says: if someone accessed your financial accounts or made payments you didn’t authorize, contact your bank immediately; report phishing emails to [email protected] and your email provider; report suspicious Messenger messages (external site, opens in a new tab); and if you believe a crime was committed, report it to local law enforcement. Our advice: change the password for your email and any account that used the same password.

Meta says to report phishing rather than clicking, and to report links on Facebook that you suspect.

1. Report phishing to [email protected], the address Meta gives, and to your email provider.
2. Report suspicious posts, profiles or messages on Facebook: see how to report content.
3. Don’t forward genuine emails from Meta to other people: Meta says they may contain sensitive information about your account.