Phishing

At the beginning of 2024, a phishing campaign targeting Facebook business page administrators began spreading rapidly, both globally and in the Lithuanian corner of Facebook. Scammers, or more precisely bots, send misleading messages directly to business accounts, claiming that the Facebook business page has supposedly violated certain Meta rules and policies. These messages cite a variety of alleged violations, from copyright infringement to identity impersonation or failure to comply with privacy rules. An important detail: all messages of this kind are sent through the Facebook Messenger app.

How the scam works

Using AI tools and automated bots, scammers exploit fake Facebook accounts to distribute messages that some users may take for official Meta notifications. These messages often use threatening language, stating that your Facebook business account will be suspended or deleted unless you carry out a required sequence of steps. They claim that the business page has violated Meta’s policies and urge you to click a link leading to a “resolution” process. Clicking such a link can have fairly serious consequences: a) The business account gets blocked; b) Your management rights are removed; c) Financial losses, if payment cards are linked to the account; d) Damage to your brand’s reputation.

Challenges and consequences

Although this scam is not new, it still poses a serious threat to business page owners and administrators, for several reasons:
  1. Fear and urgency: Building and maintaining an organic follower base on Facebook has become very difficult in recent years. The thought of losing years of work over an alleged rule violation can push users to act impulsively and without thinking.
  2. Official appearance: Scammers try to imitate messages supposedly sent from the Meta Support account, using an official tone and visual elements.
  3. Loss of control: If you click the link, you may give scammers access to your page. That could mean losing your content and followers, and possibly even suffering financial harm if your ad account is used to run ads unrelated to your business.

How to protect yourself

To keep your business account running and avoid unpleasant consequences, you should follow these tips:
  1. Verify the source: Always make sure a message really comes from the official Meta Support account. You can only contact this account through Business Suite, by submitting a support request and choosing “live support”, a direct chat channel. From personal experience, I can say that when you submit a request, Meta Support immediately sends a message with a unique request ID. The official Meta Support account never sends links that would direct a user to other websites. All information about business accounts is sent by email.
  2. Don’t click suspicious links: Before clicking any link attached to a message, make sure the profile that sent it is legitimate.
  3. Educate your team: Make sure everyone on your team who has access to your Facebook business account messages is aware of this type of scam and its possible consequences.
  4. Report suspicious activity: If you receive messages that look suspicious, be sure to report them to Meta. Although slowly, the platform does try to take fraud cases seriously and investigate them.
  5. Enable two-factor authentication (2FA): This adds an extra layer of security to your Meta account.

Conclusion

A few weeks ago I had to rescue a business account whose administrator had clicked one of these links. The consequences were fairly sad: a new “partner” had been added to the main ad account and, within two days, spent almost 11,000 EUR creating fake ads that sent users’ traffic to their own e-commerce website. This is yet another reminder of how important it is to stay informed and vigilant online. Although scammers are becoming more sophisticated, with proper preparation and precautions you can keep your business page safe. Remember: Meta will never contact you through Messenger about policy violations or page problems. Be careful, avoid suspicious links and report suspicious activity. It will help keep your Facebook business account safe.

Related reading