Fake Meta and Facebook page violation emails: how to spot them

"Your Page has been scheduled for permanent deletion due to a violation of our Community Standards. Submit an appeal within 24 hours." Emails like this hit anyone who manages a Facebook Page, and small businesses are prime targets because the Page and its ad account are worth money. This guide shows what the scam looks like, how to check a notice in under a minute, and what to do if someone on your team already filled in the form.

What is a fake Meta page violation email?

A fake Meta page violation email is a phishing message that pretends to come from Meta, Facebook or "Meta Business Support" and says your business Page, Instagram account or ad account broke a policy. It threatens removal within a short deadline unless you "appeal" through a link. The link leads to a fake appeal form that asks for your Facebook login, your two-factor code and often your business email and phone number.

The goal is your Page, not your email. Meta's own security team says financially motivated groups "often first go after the personal accounts of people who manage or are connected to business pages." Once inside, they "add themselves as business admins" and "run unauthorized ads from the compromised business accounts."

Common versions of the lure

Copyright versions are covered in more depth in our guide to fake copyright infringement phishing.

Example of a fake Meta page violation email

This is an example written for this guide, based on the patterns above. It is not a real Meta message.

From: Meta Business Support <no-reply@meta-pages-review.com>
Subject: Final warning: Page policy violation [Case #4471-0928]

Your Page "Riverside Dental Care" has been reported for violating
our Community Standards and Intellectual Property policy.

If you believe this is a mistake, you must submit an appeal within
24 hours. After this period your Page will be permanently removed
and this decision cannot be reversed.

[ Request review ]

Meta Platforms, Inc. Policy Enforcement Team

The warning signs: a sender domain Meta doesn't use, a countdown, a case number to look official, a button instead of an instruction to check your account, and a threat that the decision "cannot be reversed."

How do I check if a Meta or Facebook email is real?

Check from inside Facebook, never from the email. Meta gives you two tools that settle the question in under a minute.

1. Look at Account Status. In Facebook, click your profile picture, then select Help & support > Account Status (Facebook Help). It shows the "Status of the things you manage (example: Pages and groups)", including restrictions and violations. If the Page shows no problem there, treat the email as fake.
2. Check Recent emails. Go to facebook.com/recent_emails/security by typing it, or click your profile picture, select Settings & privacy > Settings > Accounts Center > Password and security, then under Security checks select Recent emails (Facebook Help). Security emails from the last year appear in the main tab and other emails from the last two days in a second tab. If the message isn't listed, Meta didn't send it.
3. Check the sender domain. Facebook's phishing page says "Any correspondence from Facebook or Meta will only come from one of these email domains": fb.com, facebook.com, facebookmail.com, instagram.com, meta.com and metamail.com, plus their subdomains.
4. Read the headers if you're unsure. Paste the full headers into the Email Header Analyzer and look at the real sending domain and the SPF, DKIM and DMARC results. Our guide to how to read email headers explains each field.

The display name is meaningless. "Meta Support" can sit in front of any address, a trick explained in our guide to display name spoofing.

Can a scam come from a real Meta address?

Yes, so a correct sender domain is not enough on its own. Attackers can use genuine Meta features to deliver the lure. Facebook's own phished account guidance warns that malicious actors have sent Business Manager partner requests containing phishing links, and that these come from a legitimate Meta domain. The notification is real; the business that sent it is not.

The same applies to Messenger messages, Page comments and tags from accounts called "Meta Support" or "Page Policy Team." These sit on Meta's real platform but are ordinary accounts. Treat any appeal link that reaches you, by any channel, the same way: ignore it and check Account Status yourself.

Why do businesses fall for fake Meta violation notices?

The scam works because it hits a real fear. For many small businesses, the Facebook Page is the main way customers find them, and losing it overnight would hurt. Several details make it convincing:

• Real enforcement exists. Meta does restrict Pages and ad accounts, so a violation notice isn't absurd on its face.
• Shared inboxes. Page and ad notices often go to a shared marketing or info@ mailbox, read by whoever is on shift.
• Agencies and freelancers. Outside marketers manage Pages for many clients and get many notices, so one more seems routine.
• The deadline. "24 hours" and "cannot be reversed" push people to act before they think. CISA lists "Urgent or emotionally appealing language, especially messages that claim dire consequences for not responding immediately" as a sign of phishing (CISA).

For a wider list of red flags that apply to every brand, see how to spot a phishing email.

What should I do if someone clicked a fake Meta appeal link?

Act within minutes, because attackers move quickly to add their own admins. If only the link was opened and nothing was typed, close the page and run a malware scan on the device. If a login or code was entered, follow these steps.

1. Report the account as compromised. Type facebook.com/hacked yourself. Facebook says to "First, report your account as compromised", and you can do it whether or not you can still log in (Facebook Help).
2. Change the Facebook password from a trusted device, and change it anywhere else the same password was used.
3. Remove unknown logins and devices and check the activity log for posts, messages or connections you didn't make.
4. Check Page and Business Manager access. Remove any admin, partner or person you don't recognize, and check ad accounts and payment methods for new spending.
5. Turn on two-factor authentication for every person with access to the Page. Meta says "Two-factor authentication is one of the most effective tools for combating account compromise attempts" (Meta).
6. If you downloaded a file, treat it as a malware incident: disconnect the device and tell IT. Meta's May 2023 report describes malware campaigns aimed at people who manage business accounts.
7. If the same password unlocks your work email, reset that too and check for new forwarding rules. Our guide on what to do after clicking a phishing link covers the full checklist.

If a card was entered, call the bank. Report the email to phish@fb.com and to your own email provider (report phishing email shows how for Outlook and Gmail).

How can a business stop fake Meta emails?

Lock down who can lose the Page

• Keep at least two trusted people with full control of the Page, both with two-factor authentication. Avoid giving full control to anyone who doesn't need it.
• Prefer a security key or an authentication app to text message codes where you can. Facebook offers all three methods (Facebook Help), and CISA says "The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication," which is what security keys use (CISA).
• Turn on login alerts and business notifications, which Meta recommends so you notice unauthorized access or changes quickly (Meta).
• Don't reuse the Facebook password anywhere else. Meta's advice is to "Never reuse your password across multiple websites."

Set one rule for staff and agencies

Tell everyone who touches the Page: we never appeal from an email or chat link; we check Account Status. Put it in your onboarding and your security awareness training. Agencies should agree to the same rule in writing.

Filter the email before anyone sees it

Most fake Meta notices arrive by email from domains Meta doesn't use, often freshly registered lookalikes. Your mail platform's built-in filtering catches many of them, and for some businesses that is enough. If they still reach your marketing or info@ mailbox, an MX-level filter adds a second check before mail reaches your server: iBlockSpam filters inbound mail for spam, phishing and spoofing, with a personal quarantine for every user. See email protection for small businesses for how it fits in front of Microsoft 365, Google Workspace or cPanel.

Fake Meta notice checklist

Next steps

1. Check Account Status for every Page you manage today, so you know what a clean status looks like.
2. Confirm every person with full control of your Page has two-factor authentication turned on, and remove anyone who no longer needs access.
3. Send staff and agencies a one-line rule: no appeals from links, check Account Status.
4. Run the free Email Health Check on your domain, and if fake notices keep reaching your shared inboxes, see how iBlockSpam protects small businesses.

Browse our other phishing and threat guides.