CONSUMER ALERT - ACCOUNT TAKEOVER PHISHING

The "Facebook has suspended your account" message is a scam, and it wants your 2FA code too

Facebook did not send that warning. A phishing wave reported by ConsumerAffairs on July 13, 2026 pushes fake suspension notices by email, Messenger, and DM, claiming your account will be closed for "fraudulent activity" or policy violations unless you verify immediately. The link opens a counterfeit Facebook login page that captures your username, your password, and even the two-factor authentication code you type, which is everything an attacker needs to take the account outright.

SB

SafeBrowz Threat Research Security ResearchJuly 20, 20268 min read

What the fake warning looks like

The message wears Facebook's or Meta's name and arrives through more than one door: a plain email, a Facebook Messenger message, or a direct message on another platform. ConsumerAffairs, which reported the wave on July 13, 2026, describes the recurring script: your account "has violated Facebook's policies," "has been involved in suspicious activity," or is flagged for "fraudulent activity," and it "will be permanently disabled" unless you immediately verify your identity.

Every version leans on the same lever, manufactured urgency. Act now or lose the account, the photos, the Marketplace history, the business Page, the years of contacts. That pressure is the tell. It exists so you click before you think, because the entire scheme collapses the moment you slow down and look at where the link actually goes.

If the wording feels familiar, it should. The same "account suspended" template gets reskinned for one brand after another. We have documented near-identical campaigns wearing Instagram's name in the Instagram "Community Standards violation" email scam, plus Spotify and Coinbase versions of the same suspension lure. Same skeleton, different logo.

The counterfeit login page wants three things, not two

This is the detail that makes the 2026 wave nastier than the old password-phishing runs. The link opens a page that copies Facebook's logo, layout, and login form closely enough to pass a glance. You type your username and password. Then the page asks for the next thing a real login would ask for: the two-factor authentication code from your SMS or authenticator app.

That third field is the whole point. For years, security advice has been "even if they phish your password, 2FA saves you." Modern phishing kits answer that by harvesting the code as well. The attacker feeds your credentials into the real Facebook as you type, triggers the genuine 2FA prompt, and your freshly typed code, valid for about thirty seconds from an authenticator app and a few minutes by SMS, lets them finish the login as you. We covered the mechanics of this real-time relay in our AiTM 2FA-bypass explainer; the Facebook suspension wave is that technique aimed at 3 billion ordinary users instead of corporate targets.

Once the attacker is in, they can change the password and recovery details and lock you out. Per the ConsumerAffairs report, hijacked accounts get put to work: impersonating you to solicit money from friends and family, running fraudulent Marketplace listings, and, where the victim manages one, using business accounts to push unauthorized ads. Your friends trust messages from your face and name, which is exactly why a stolen account is worth more than a stolen password. It is the same friend-by-friend spread we documented in the WhatsApp 6-digit code takeover scam.

The money behind this is not small. The FTC reported in April 2026 that people lost $2.1 billion to scams that started on social media in 2025, and that more of that money was lost to scams starting on Facebook than on any other platform. A compromised account is the beachhead for much of it.

The 30-second check before you touch that message

You do not need to analyze headers or know security jargon. Three quick looks settle it.

1. Seconds 1-10: check where the link really goes. Press and hold the link on a phone, or hover it on a computer, and read the domain that appears. Facebook only lives at facebook.com and meta.com, and its genuine emails come from facebookmail.com. Phishing pages hide behind addresses assembled from convincing fragments, strings like fb-support or account-facebook bolted onto domains Meta has never owned (both are patterns named in reported campaigns, shown here as plain text, not links). The words look right; the domain is the lie.
2. Seconds 11-20: read the message like an editor. Generic greetings ("Dear user") where Facebook would use your name, grammatical stumbles, awkward phrasing, odd formatting. ConsumerAffairs flags all of these as recurring marks of the current wave. One clumsy sentence in a "official" enforcement notice is disqualifying.
3. Seconds 21-30: go look at the real account. Close the message entirely. Open the Facebook app or type facebook.com into the address bar yourself and check your notifications and Support Inbox. A genuine enforcement action against your account appears inside Facebook, not only in an outside message. You can also see every email Facebook has actually sent you at facebook.com/recent_emails/security; if the scary email is not listed there, Facebook did not send it.

If the message fails any one of the three, it fails. Delete it, or report it first: forward phishing emails to [email protected], Facebook's dedicated reporting address.

If you already typed your password, or your 2FA code

Move fast, in this order.

If you can still log in: change your Facebook password immediately from the app or from facebook.com, not from any link. Then review where you are logged in (Settings, then Password and security, then "Where you're logged in") and log out every session you do not recognize. Re-check that two-factor authentication is on and that no recovery email or phone number you do not recognize has been added. If you reuse that password anywhere else, change it there too, because the attacker now has it.

If you are locked out: go straight to facebook.com/hacked, Facebook's official recovery flow for compromised accounts, and follow it from a device and network you have used with Facebook before, which makes identity confirmation easier. Recovery can take days, so start now.

Either way: warn your friends and family off-platform that messages from your account may not be you, especially anything asking for money, gift cards, or codes. In the US, report the scam to the FTC at reportfraud.ftc.gov. If you manage Pages or ad accounts, audit them for changes; and note that attackers who land on a profile with business assets attached often pivot straight into the Meta Business Manager phishing playbook, which is its own, more targeted campaign against advertisers.

How SafeBrowz reads the fake Facebook login page

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI. The suspension message itself lives in your inbox or Messenger thread, but the theft happens in the browser, on the counterfeit login page, and that is the step SafeBrowz sits in front of.

• Layer 1 - Local detection: 60+ URL patterns and a 550+ brand database run inside the extension before the page renders. Facebook and Meta are tracked brands, so their names appearing in a hostname that is not an official Meta domain trips the brand-impersonation signal immediately, with no network call needed.
• Layer 2 - API checks: the domain is checked server-side against Google Safe Browsing, PhishTank, URLhaus, ScamAdviser feeds, and a 30+ scam TLD watchlist. Mass credential-harvesting campaigns like this one surface on those feeds quickly, and a days-old domain asking for logins is itself a weighted signal.
• Layer 3 - AI deep scan (Premium): AI content analysis via our proxy reads the page the way a human investigator would: a Facebook-branded login form, plus urgency copy about suspension and verification, sitting on a domain with no relationship to Meta. That combination of form, brand, wrong domain, and pressure language is what earns a danger verdict in seconds, even for a page registered this morning that no blocklist has seen yet.

The honest limit: SafeBrowz flags the counterfeit login page when you open the link. It cannot stop the fake email or Messenger message from arriving in the first place, so the 30-second check above still matters every time. What the extension buys you is a hard warning at the exact moment that matters, the second before you type.

Detection signatures are derived from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

Frequently asked questions

Is Facebook really suspending my account?

Almost certainly not. If a message told you your account will be closed for fraudulent activity or policy violations unless you verify through a link, it is a phishing scam, a wave of which was reported by ConsumerAffairs in July 2026. Real Facebook enforcement appears inside the product: check your notifications and Support Inbox by opening the app or typing facebook.com yourself. You can also verify any email at facebook.com/recent_emails/security, which lists every email Facebook actually sent you. If the warning is not reflected in any of those places, Facebook did not send it.

Can scammers really get past two-factor authentication?

Yes, if you type the code into their page. The counterfeit login page in this campaign asks for your username, password, and then your 2FA code, exactly like a real login would. The attacker relays your credentials into the real Facebook in real time, which triggers a genuine 2FA prompt, and the code you type on the fake page completes their login before it expires. 2FA still matters, it defeats attackers who only have your password, but it cannot protect a code you hand over. The defense is refusing to log in through links in warning messages at all.

I entered my password and 2FA code on the fake page. What should I do?

Act immediately, because the attacker may already be inside. If you can still log in, change your password right away from the app or facebook.com, log out all unrecognized sessions under Settings, Password and security, and confirm no new recovery email or phone was added. If you are locked out, use facebook.com/hacked, Facebook's official recovery flow, from a device you have used with Facebook before. Then warn friends and family off-platform not to trust money or code requests from your account, change that password anywhere you reused it, and report the scam to reportfraud.ftc.gov in the US.

How do I check whether an email from Facebook is genuine?

Do not judge it by its looks; judge it by Facebook's own records. Log in normally and open facebook.com/recent_emails/security, which shows the security emails Facebook really sent to your account. If your suspicious email is not there, it is fake. Genuine Facebook email comes from facebookmail.com, but sender addresses can be spoofed, so the recent-emails list is the stronger check. Never use the email's own links or buttons to "verify" anything, and forward confirmed phishing to [email protected] so Facebook can act on the campaign.

Last updated 2026-07-20