Common scams on Facebook and Messenger
On Facebook, scammers pose as friends, giveaways, customer support or buyers. The goal is almost always the same: the password, a login code or payment card details. The most common tricks can be spotted from a few telltale signs.
In this article
“Is this you in the video?” – a link from a friend
A friend sends a short, surprised-sounding message with a link on Messenger, for example: “Is this you in this video?” The link leads to a page imitating the Facebook login, or to a malicious download. By this point the friend's account has already been hacked, and the attacker sends the same message to all of their contacts. Do not open the link; let the friend know through another channel.
Fake giveaways
- A gift that is too good: a gift box, voucher or “clearance giveaway” in the name of a well-known store, car brand or airline, and all it takes is a share and a comment.
- A suspicious Page: new, with few posts, a name slightly different from the original, and a link that does not lead to the company's own website.
- A “small” fee: the winner has to pay a shipping fee by card; this often signs them up for a subscription with recurring charges.
Fake support: “Your account will be disabled”
A profile called “Meta Support” or something similar claims that the account will be shut down within 24 hours because of a rule violation or a copyright complaint, and that this can only be avoided via a link. Behind the link, the password and the login code are requested.
- Facebook shows warnings about the account in the notifications and in the account settings, not in a Messenger message, and it never asks for a password in a message.
- Genuine Facebook emails can be checked under “Recent emails” in the “Password and security” section of Accounts Center.
- If the account really has been restricted: My Facebook account was disabled or locked.
Marketplace scams
- A shipping-company link for the seller: the “buyer” sends a link where card details or online banking login would be needed to receive the money. To receive money, a name and account number are enough; anyone who asks for more is a scammer.
- Paying in advance for an item that does not exist: a strikingly low price, pressure to hurry and refusal to meet in person are warning signs.
- Asking for a code: the buyer asks for a code received by text message “for verification”; in reality, this is how they take over an account.
- Moving off Facebook: if the other person immediately wants to continue on WhatsApp or by email, reporting becomes harder later.
Other telltale signs
- A friend urgently asks for money: or a phone top-up, or a code. Their account has probably been hacked; call them to check.
- Investment ads featuring celebrities: “guaranteed return” investments advertised with photos of famous people are almost always scams.
- A strange web address: the Facebook login page is always on facebook.com. Any other address (for example, a free website named “facebook-support”) points to a scam.
Reporting and what to do
- On a post, ad or profile, choose the report option from the “…” menu and select the type of scam.
- In Messenger, tap the other person's name to find the “Report” and “Block” options.
- If the password or a login code got into the wrong hands: My Facebook account was hacked.
- If payment card details or an online banking login got into the wrong hands, call the bank immediately to block the card, and consider reporting the fraud to the police.
If it doesn't work
I clicked the link but did not enter anything
If no password or code was entered and nothing was installed, the account is usually not at risk. It is worth checking the logged-in devices: Where am I logged in?
How can I tell if a Page is official?
Pages of large companies usually have a verified badge and many older posts. The badge is not a full guarantee either, since it can also appear on a stolen Page; a genuine giveaway, however, never asks for a password, a code or card details.
Will the person I report find out who reported them?
No, reports are anonymous. Facebook reviews them, and if the content breaks the rules, it removes it or restricts the profile.
How can the account be protected if I gave away the password?
Change the password immediately and turn on two-factor authentication: it also blocks logins with a phished password.