What are the red flags of this scam?

An unsolicited message says your account will be suspended or disabled for policy violations or fraudulent activity • The message includes a button labeled 'Appeal,' 'Verify Account,' or 'Secure Your Account' that links to an external site • Real Facebook/Meta policy notices appear as banners inside your actual account — never as external messages with login links • The fake login page looks identical to Facebook's but has a URL that is not facebook.com • After you enter your password the site asks for your two-factor authentication code — scammers use it in real time to bypass 2FA • You receive the scam through Messenger, email, or another social platform rather than through an in-app notification

What should I do if this happened to me?

Never click 'Appeal' or 'Verify' links in unsolicited messages — go directly to facebook.com or open the Facebook app and look for any real notices there • If you entered your password on a suspicious site, change your Facebook password immediately from a clean device • Enable Facebook's 'Login Alerts' so you are notified of any new sign-in from an unfamiliar device • Check Settings → Security → Where You're Logged In and log out any unrecognized sessions • If your account has been taken over, use Meta's compromised-account recovery page at facebook.com/hacked • Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

HIGH phishing Last reported: Oct 26, 2026 Share

Fake "your account will be suspended" message tricks you into handing your Facebook login to scammers

Q: Is this a scam?

Yes. This is a documented scam pattern. A message claiming your Facebook account violated policy or will be permanently disabled sends you to a fake login page that harvests your password and two-factor code. Scammers then take over your account to impersonate you or run Marketplace fraud.

A message claiming your Facebook account violated policy or will be permanently disabled sends you to a fake login page that harvests your password and two-factor code. Scammers then take over your account to impersonate you or run Marketplace fraud.

Also known as: fake Facebook suspension warning, Meta account disabled phishing, Facebook policy violation scam, fake Facebook account closure message, Facebook credential theft

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Never click 'Appeal' or 'Verify' links in unsolicited messages — go directly to facebook.com or open the Facebook app and look for any real notices there
2 If you entered your password on a suspicious site, change your Facebook password immediately from a clean device
3 Enable Facebook's 'Login Alerts' so you are notified of any new sign-in from an unfamiliar device
4 Check Settings → Security → Where You're Logged In and log out any unrecognized sessions
5 If your account has been taken over, use Meta's compromised-account recovery page at facebook.com/hacked
6 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

Red flags

⚠ An unsolicited message says your account will be suspended or disabled for policy violations or fraudulent activity
⚠ The message includes a button labeled 'Appeal,' 'Verify Account,' or 'Secure Your Account' that links to an external site
⚠ Real Facebook/Meta policy notices appear as banners inside your actual account — never as external messages with login links
⚠ The fake login page looks identical to Facebook's but has a URL that is not facebook.com
⚠ After you enter your password the site asks for your two-factor authentication code — scammers use it in real time to bypass 2FA
⚠ You receive the scam through Messenger, email, or another social platform rather than through an in-app notification

Known variants

A Messenger DM from an account named 'Meta Verrified' (note double r) claims your account has unusual activity and will be disabled in 24 hours, then attaches a PDF containing a phishing link disguised as an official appeal form. Fox News/CyberGuy and WFMD reported this variant in July 2026; WEAU (Aug 8, 2026) confirmed it spreading further.

Last seen: 8/31/2026
Attackers abuse Meta Business Manager partner-request emails from real @facebookmail.com servers. Links lead to credential-harvest pages on Vercel or Cloudflare Pages (/facebook-ads-sync, /meta-support). Victims enter Meta credentials and 2FA; attackers seize the ad account and run fraudulent ads. 40,000+ emails to 5,000+ US orgs (Check Point, Aug 2026).

Last seen: 9/30/2026
Fake Instagram password-reset or account-suspended emails surge in early 2026 (17.5M accounts leaked). Links lead to Vercel-hosted lookalike Instagram login pages that harvest passwords and 2FA codes in real time; hijacked accounts spread the same phishing to followers. Malwarebytes/Paubox Jan–Sep 2026.

Last seen: 9/21/2026
Blogspot-hosted Facebook login clones (Oct 12–13, 2026): scammers host fake Facebook login pages on Blogspot subdomains (e.g., ww-facebook.blogspot.com) to evade URL reputation filters. Victims arrive via a phishing DM or email claiming an account security issue, enter their credentials, and lose account access. 13 signals detected in 2 days.

Last seen: 10/13/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources