In short
Most common fake: Direct messages claiming your account will be banned or has broken copyright rules.
Safest check: On Instagram, check the Emails from Instagram section in your settings, which is the only place for genuine account messages from Instagram.
Where to report it: Report the message, post or profile inside Instagram (tap the three dots, or press and hold a message) and block the account.
What Meta (Facebook and Instagram) says
Meta says it will never ask for your password in an email or Facebook message, and Instagram says it will never send you a direct message about your account. Instagram contacts you about your account through the Emails from Instagram section in your settings. Source: Meta
Common fake Meta (Facebook and Instagram) messages
These are the 5 shapes a fake Meta (Facebook and Instagram) message usually takes. They are listed in the order we see them most often, and none of them is something Meta (Facebook and Instagram) itself does.
- Direct messages claiming your account will be banned or has broken copyright rules
- Messages saying your photos are being shared elsewhere, with a link to log in
- Fake celebrity endorsements and giveaways in ads that lead to scam websites
- Fake customer support pages pretending to represent well known companies
- Suspicious job offers and cryptocurrency investment pitches in messages
Meta (Facebook and Instagram)'s real web addresses
Genuine Meta (Facebook and Instagram) links and emails use these domains. Look at the part just before the first single slash: facebook.com is real, but facebook-support-center.com or facebook.com.account-check.top are not.
- facebook.com
- instagram.com
- facebookmail.com
Scammers can also hide a fake link behind real-looking text. Learn how to read a web address.
How to check a Meta (Facebook and Instagram) message safely
- On Instagram, check the Emails from Instagram section in your settings, which is the only place for genuine account messages from Instagram
- For Facebook, check that an email came from facebookmail.com and compare it with the recent emails listed in your Security and Login settings
- Open the Facebook or Instagram app yourself instead of tapping links in messages
How to report a fake Meta (Facebook and Instagram) message
- Report the message, post or profile inside Instagram (tap the three dots, or press and hold a message) and block the account. Official details on about.fb.com
- Report suspicious ads and scam content with the in-app reporting tools on Facebook and Instagram. Official details on about.fb.com
Also report it to the official fraud service in your country. See the worldwide list.
If you clicked, paid or shared details
Act quickly. It makes a difference.
- If you entered card or bank details, call your bank now using the number on your card, and ask them to block the card.
- If you entered a password, change it at facebook.com, typed into your browser yourself, and turn on two-step verification. Do not use any link from the message.
- Expect follow-up calls or messages pretending to help, sometimes claiming to be from Meta (Facebook and Instagram) security. Never share one-time codes and never move money to a "safe account".
- Report the message, post or profile inside Instagram (tap the three dots, or press and hold a message) and block the account, then delete the message.
More help: Phishing links and fake login pages and what to do after a scam.
How to protect yourself next time
Use a password manager
It only fills in your password on the real website, so a look-alike login page gets nothing. It also makes a different password for every account, so one leak doesn't open the rest.
Free: Bitwarden has a free plan, and even the password manager built into your phone or browser beats reusing one password everywhere.
- NordPass Partner link Password manager with a free plan and a family plan for up to six people.
Turn on two-step verification, ideally with a security key
With two-step verification, a stolen password isn't enough on its own. A hardware security key goes further: it simply doesn't work on a fake site, so it can't be phished.
Free: Two-step verification is free. Switch it on in the security settings of your email, bank, WhatsApp and social media accounts today.
- YubiKey (Yubico) Partner link A small USB or NFC key you tap when you log in. It will not work on a fake site.
Compare the tools that help, and what each costs
Links marked Partner link may earn us a commission, at no cost to you. It never changes our advice, and the free option always comes first. Affiliate disclosure.
Questions people ask
Does Meta (Facebook and Instagram) send messages asking for payment or personal details?
Meta says it will never ask for your password in an email or Facebook message, and Instagram says it will never send you a direct message about your account. Instagram contacts you about your account through the Emails from Instagram section in your settings.
How can I check if a Meta (Facebook and Instagram) message is real?
On Instagram, check the Emails from Instagram section in your settings, which is the only place for genuine account messages from Instagram. For Facebook, check that an email came from facebookmail.com and compare it with the recent emails listed in your Security and Login settings. Open the Facebook or Instagram app yourself instead of tapping links in messages.
How do I report a fake Meta (Facebook and Instagram) message?
Report the message, post or profile inside Instagram (tap the three dots, or press and hold a message) and block the account. Report suspicious ads and scam content with the in-app reporting tools on Facebook and Instagram.
I clicked a link in a fake Meta (Facebook and Instagram) message but did not enter anything. Am I at risk?
Opening a link is far less serious than filling one in. Close it, and if you need your account, reach it by typing facebook.com yourself. Clicking does tell the sender your number is live, so expect more messages for a while: report the message, post or profile inside instagram (tap the three dots, or press and hold a message) and block the account.
Have you had this one?
Tell other people what the message said and how it reached you. It helps someone recognise it before they tap.
No stories yet. Yours could be the one that warns someone.
Official sources and further reading
We check our pages against official advice from the organisations themselves and from government agencies.