Sections on this page
- What Are Facebook Phishing Emails?
- How to Beat and Avoid a Facebook Phishing Email Scam
- Examples of Facebook Phishing Emails
- Fallen for a Facebook Phishing Email Scam?
- Frequently Asked Questions
If you receive an email that asks you to log into your Facebook account, be on the lookout for red flags, like:
- Misspellings and grammatical issues
- A sender's address that doesn't match Facebook's official email address
- A Facebook logo that doesn't look quite right
- Links to non-Facebook websites
What Are Facebook Phishing Emails?
The goal of Facebook phishing emails is to get inside and control your Facebook account. In some cases, it may start as an email that appears to come from someone you know or trust. Some scammers like to make it look like you’re getting an email from a friendly or reliable source to get you to drop your guard.
Here's how the scam works.
You Get an Email Saying You Need to Log Into Facebook
You receive an email that looks like it comes from Facebook—it may use the Facebook logo and look like the real deal. The email directs you to log into your Facebook account to:
- Read an important message
- Secure your account
- Save your messages
In some cases, scammers will use a fear tactic, for example, threatening to delete all of your messages (due to your inactivity on the platform) unless you log in.
Example Email from ScammerA user just logged into your Facebook account from a new device iphone 11 pro. We are sending you this email to verify it's really you.
>> Report the user
>> Yes, meThanks,
The Facebook Team
You Click on a Link to “Go to Facebook” or “Log In”
After you click the link in the scam email, you land on a website other than Facebook. However, you may not realize it’s not the actual Facebook site. Here, you will be asked to enter your login credentials. (In some cases, the scammer will provide a phone number for you to call.)
It’s important to carefully check the URL of any link you click on within an email. If necessary, compare it to the actual Facebook URL to see if they match. The site takes you to is designed to steal your information, not take you to Facebook.
After you put in your credentials, the scammer can then use them to log in to your Facebook account, make changes, steal information, or pretend to be you.
The first thing some attackers will do is change your password. This buys them some time so they can try to take information, modify information in your account, or impersonate you.
The Scammer Steals Your Identity
Once they have access to your Facebook account, the scammer can send messages to your connections containing additional phishing scams or even viruses and malware. Since the messages are coming from you, your friends won’t be cautious since they trust you and aren’t suspicious of the messages being sent from your account.
If you use the same password on Facebook as you do with other accounts the hacker will also be able to access those. This can include your bank accounts, emails, and other social media profiles.
How to Beat and Avoid a Facebook Phishing Email Scam
There are a few different ways of both beating and avoiding Facebook phishing. You can take the steps below to protect yourself.
To beat this scam, you should:
- Never click on Facebook links sent to you via email. Instead, log into your account directly via the Facebook app or by typing in the URL into your browser.
- Always check the URL to make sure you’re on a legitimate Facebook page. If the URL doesn’t include “facebook.com,” do not enter any information.
- Don’t trust Facebook emails that don’t come from “[email protected].”
It's important to verify links and contact details to beat imposters.
Red Flags of Facebook Phishing Email Scams
When you receive an email from Facebook, look for tell-tale signs of a scam. Some of the most common red flags include:
- An email from a non-Facebook email (i.e., doesn’t come from an @facebook.com or @facebookmail.com address)
- Typos, grammatical errors, and spelling mistakes
- Weird spacing within the copy and design
- A request for your Facebook login credentials
- A link to a non-Facebook page (e.g., not Facebook.com)
Examples of Facebook Phishing Emails
There are various versions of Facebook phishing emails, from ones telling you someone else has logged into your account to those saying you've changed your password recently when you didn't.
In the following example, the scammers use fear tactics to get you to call the scam phone number, but you can spot some red flags:
- The sender's email address, although the name is from "Facebook," the email address is from an @facebookhelpline.org address, which isn't an official Facebook address.
- There are a few typos (e.g., extra spaces, un-needed capitalizations, misspellings) in the email that you wouldn't see on a legitimate Facebook email.
In the following example, the Facebook phishing email looks legitimate. In this case, check the sender's email address to make sure it's from an @facebookmail.com email address and check the link goes to a facebook.com URL before clicking on it.
If you do click on the link in the email, not all is lost immediately. You'll likely be sent to a page that looks like the below example, which looks almost exactly like the actual Facebook login page. When you get to this point, it's crucial that you check the URL to make sure you're on the actual Facebook website.
Fallen for a Facebook Phishing Email Scam?
If you’ve fallen for this scam, you should quickly lock the scammer out of your Facebook account and prevent further damage.
Change Your Facebook Password
If you think you’ve been phished, the first thing you should do is log into your Facebook account and change your password. Switch it to something extremely hard to guess, preferably something completely unlike your previous one. If you’re able to change your password, you have regained control of your account.
If you use the same password for any of your other accounts, be sure to change those immediately also.
Check Your Account for Changes
You will want to check your Facebook account for any activity that you didn’t make, such as:
- Status updates
- Profile information
- Comments on posts, pictures, and other content
- Sent messages
To view your Facebook activity log:
- Click the small down arrow in the upper right of Facebook.
- Choose Settings & Privacy, then Activity Log.
- Filter your activity by date to see if there was any activity since you last logged in. Then delete any unwanted posts, likes, comments, connections, or profile information.
Also, if you use Facebook advertising, you should check your advertising account. The attacker may have launched a campaign that benefits a company other than yours.
You will also want to go into your app settings by clicking the icon with the three lines in the top corner of Facebook and log out of any devices you don’t physically have in front of you.
If You Can’t Log In, You Can Recover Your Account
To recover your account and follow the instructions online. Find the account you want to recover, and then reset your password.
Report the Scam
Report any emails that look strange or like a scam to [email protected]. This will help Facebook address future attacks and protect other users.
Additionally, you can report the scam to the authorities (e.g., the Federal Trade Commission and the FBI).
Comments