Facebook users need to be on their guard for bogus emails claiming to be from Facebook, that tell users their account has been disabled.
The emails make use of the classic “apply some pressure” tactics so beloved of scammers everywhere. A missive that makes you shrug won’t get you clicking bogus links, but mails that say you’ve done something wrong, violated a rule, or at imminent risk of financial peril, are more likely to work.
The scam
The mail reads as follows:
Recently, we discovered a breach of our Facebook Community Standards on your page. Your page has been disabled for violating Facebook Terms. If you believe the decision is incorrect, you can request a review and file an appeal at the link below.
The Better Business Bureau says that some of these emails claim you need to take action within 24 hours or your account will be deleted permanently. This is the pressure hook at work.
This will be more than enough to encourage folks to click the link to a bogus Facebook page. From there, site visitors will be asked for a range of personal details including but not limited to:
- Login email
- Name
- Phone number
Passwords are confirmed once the submit button is clicked. At this point, the phish recipient has likely lost control of their account, unless they have additional security in place such as two-factor authentication (2FA).
What to do
While messages like this can be worrying, it’s worth taking a deep breath and examining the facts regardless of what the email is claiming. In this case, the mail campaign states that your Faceboook account has been disabled. Well, this is an easy one to disprove.
Just open Facebook and check, instead of clicking on the links in the email.
If your account has been disabled you won’t be allowed to login, instead you’ll be directed to a message telling you what’s happened. If you feel that your account should not have been disabled, then this can be contested by sending Facebook a message.
One way or another, you’ll definitely know at a glance if the message in the email is genuine or not, because your account either will or will not be functional.
As the Better Business Bureau mentions, other potential tell-tale signs of a scam—such as misspellings, senders who aren’t using a Facebook address, and links to sites that aren’t Facebook—can be useful here, but nothing says “my account is fine, actually” like actually opening it up to check.
Avoiding “urgent” phishing scams
Here’s some other things you can do to keep yourself safe from phishing attempts:
- Don’t take emails at face value, especially if they are about logins, suspensions, disabled accounts, or anything urgent.
- Ignore links, navigate to sites directly and log in the way you usually do.
- Use a password manager, it won’t enter your credentails into a fake site.
- Use hardware keys or FIDO2 devices for two-factor authentication—they won’t authenticate you on a fake site.
- Use a tool like Malwarebytes Premium that blocks malicious and fake websites.
We don’t just report on threats—we remove them
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
