Is this account alert from Facebook a scam?

Genuine messages from Facebook link to facebook.com, meta.com. Treat a link to any other address as a warning sign.

• Genuine Facebook or Instagram messages about account security appear only inside the official Facebook or Instagram mobile apps or at facebook.com after you log in yourself.
• Meta never sends emails or SMS asking you to click a link to verify your account or prevent it being disabled.
• Real notifications from Facebook about login attempts or password changes arrive as in-app alerts or emails sent only from addresses ending in @facebookmail.com.
• Friend messages on Facebook Messenger that ask for money or gift cards are never initiated by Meta; the company does not facilitate person-to-person payments this way.
• Any password reset or two-factor code is sent only to the phone number or email address you have already saved in your Facebook settings.

What Facebook will never do

• Send an email or SMS demanding you click a link to verify your account or stop it being disabled; genuine security notices appear inside the app or at facebook.com after you log in yourself
• Email you about logins or password changes from any address that does not end in @facebookmail.com
• Ask you to pay for 'Meta Verified' or any upgrade outside the official app or website
• Ask for your password or a two-factor code; no legitimate platform asks you to hand over a login code
• Threaten to delete your account within hours unless you act on a link; no legitimate social network operates that way

• Scammers send emails claiming your Facebook account will be disabled unless you click a link and log in, directing you to a lookalike domain such as facebook-secure-login[.]example.
• Hacked Facebook accounts are used to message Australian friends with urgent stories about being stranded overseas and needing iTunes or bank transfer help.
• Fake Meta support emails arrive with subjects like 'Action required: unusual login detected' and contain links to harvest Facebook passwords on spoofed pages.
• Scam ads on Facebook itself promote fake 'Meta Verified' upgrades that ask users to pay outside the official app or website.

• Any message that asks for your Facebook password or directs you to enter login details on a site that is not facebook.com.
• Urgent language about immediate account suspension or legal consequences that pressures you to click right now.
• Requests arriving via email or SMS rather than inside the Facebook or Instagram apps.
• Links that use domains other than facebook.com or meta.com, even if the text looks official.
• Messages supposedly from a friend asking for money or gift cards without any prior conversation about travel or trouble.

These composed examples show how scams impersonating Facebook typically read, with the tells that give each one away. Compare them against anything you've received.

Facebook's real website is facebook.com and the official app is the Facebook app. Reach Facebook through those channels, never through the details inside a message you're unsure about.

1. 1Don't click the link, reply, or act on the message in any way
2. 2Open the official Facebook app, or type facebook.com into your browser yourself, and check your notifications and security settings; a genuine account issue will be visible there
3. 3If you need help, sign in first and use the Help Centre links at meta.com or inside the app, never a link supplied by the message
4. 4Report the suspicious message using the Report feature inside Facebook or Messenger so Meta can act on it

Clicked the link, paid, or shared details? Act now. The first hour matters more than anything else you do later.

1. 1If you entered your password on a fake page, change it immediately at facebook.com from a trusted device, turn on two-factor authentication, and change the same password anywhere else you reused it
2. 2If you sent money or gift-card codes to a hijacked 'friend', call your bank straight away to try to stop or dispute the transfer, and warn the real friend that their account is compromised
3. 3If you shared card details, ask your bank to block the card and dispute any charges
4. 4If you handed over identity documents such as a licence or passport, contact IDCARE (idcare.org) for free identity support
5. 5Report the scam to Scamwatch and ReportCyber using the links below, and forward any scam SMS to 7226 so carriers can block the sender

Received — or fell for — a message impersonating Facebook? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.

• Scamwatch — Report the scam to the ACCC's national scam service.
• ReportCyber — Report cybercrime and financial loss to the police.
• ACMA — Complain about scam texts and spam SMS, email or calls.
• Forward to 7226 (SCAM) — Forward the scam SMS to short code 7226 so carriers can block the source.
• IDCARE — Free identity and cyber support if your details were taken.

Campaigns in Facebook's name currently run on two engines. The first is fear for your account: 'your page will be disabled', 'Community Standards violation', 'unusual login detected', all pointing to lookalike login pages that harvest passwords. The second is borrowed trust: hijacked profiles messaging friends for urgent transfers or gift cards, and sponsored posts selling fake 'Meta Verified' upgrades. The wrapping changes constantly; the mechanics never do. Every version needs you to act through the message instead of the platform. The habit that defeats all of them is refusing that shortcut: open the Facebook app or type facebook.com yourself, and confirm any 'friend in trouble' by calling their known number.

• Social media scams (Scamwatch (National Anti-Scam Centre))
• Account or identity takeover scams (Scamwatch (National Anti-Scam Centre))
• Phishing scams: how scammers pose as trusted organisations (Scamwatch (National Anti-Scam Centre))