The most common Facebook scams are lottery, romance, loan, job, investment, inheritance, donation and fake shop scams, plus phishing messages that try to steal your login. They nearly all want one of two things: a payment up front, or your password, codes and personal details. Meta's own three-word rule for any message that feels off is slow down, spot check, don't send.
One fact cuts through most of the fakes. Meta says any email from Facebook or Meta will only come from a short list of domains, and that its staff will never ask for your password, payment details or a payment over chat or email. If a message breaks either rule, you don't need to work out whether it's real. It isn't.
The scam types Meta lists, and what each one wants
| Scam | What the scammer says | What they're after |
|---|---|---|
| Lottery | You're one of the few winners of a prize, often from an account that looks like someone you know or a government agency | A small advance fee, your address or bank details |
| Romance | They're divorced, widowed or unhappily married and want a relationship. It can run for weeks or months first | Funds for a flight or a visa |
| Loan | An instant loan at a low interest rate, offered in posts, comments or messages | An advance fee, then more |
| Job | A role that sounds too good to be true, sometimes linking to an unrelated site | An upfront payment or your government ID |
| Investment | Turn a small amount into a large one, cash flipping or a get-rich-quick scheme | Your payment, after which they disappear |
| Inheritance | A lawyer or state representative says you're owed an estate | Your address and bank details |
| Donation | A charity, an orphanage or a religious figure needs help | Donations to a fake cause |
| Commerce | Goods at a price that's too good, with a better deal if you move to email or a chat app | Payment, sometimes in crypto, for goods that never arrive |
| Subscription | Lifetime access to a popular subscription for one payment | A payment for something that's never delivered |
The warning signs Meta tells you to look for
Meta's Help Center lists the behaviour to watch for when you're deciding whether to accept a friend request or answer a message:
- Someone you don't know, or a famous person, asking you for funds.
- Requests for an advance fee before you receive a loan, prize or other winnings.
- Someone claiming to be a friend or relative in an emergency.
- Requests to move the conversation off Facebook.
- A quick romantic connection followed by a request for funds.
- Poor spelling and grammar.
- An urgent message saying something is wrong with your account, or asking you to log in to read an important message.
- Accounts with no friends, no profile photo and no real-looking activity.
Phishing: the scam that takes over your account
Phishing is the one that does the most damage, because it doesn't stop at Facebook. Meta's example is a post from someone you think you know, claiming a famous person has died. The link leads to a fake Facebook login page, you type your details, and the scammers take over the account. From there they can hold it hostage or spam your friends and family. Meta warns that one bad click can lead to several accounts being taken over, including email and WhatsApp.
The signs your account may have been phished, according to Meta:
- You can't get into your Facebook account.
- Friends or family say they're getting strange messages, videos or images from you.
- You're suddenly following people or Pages you didn't choose.
- Other accounts, like your email or bank, have been compromised too.
If it's Messenger where things look wrong, my walkthrough on checking whether your Messenger has been hacked covers the session and login checks.
The only email domains Meta sends from
This is the check I'd use every time. Meta says any email from Facebook or Meta will only come from these domains, or their subdomains such as support.facebook.com or business.fb.com:
| Real Meta email domains |
|---|
| fb.com |
| facebook.com |
| facebookmail.com |
| instagram.com |
| meta.com |
| metamail.com |
Scammers use addresses that look close to these but aren't. Meta also says it'll never ask for your username or password in an email, never send a password to verify in an attachment, and that its representatives won't ask for payments, passwords or payment details over chat or email. You can also check in your Facebook settings which emails Facebook has really sent you.
How to protect your account
- Turn on two-factor authentication. Meta calls it one of the most effective tools against account takeovers.
- Turn on login alerts and review where you're logged in, so you can spot a device you don't recognise.
- Use a password you don't use anywhere else. Meta says never to reuse passwords across websites.
- Be careful with browser extensions and apps that ask you to log in with Facebook before you've even used them.
- Run the Security Checkup tool in your settings.
- Report it. Meta says don't respond to a scam and report it instead. For phishing emails, Meta's address is [email protected].
If the scam reached you in a chat, here's how to report a scam on Messenger so the account gets looked at.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Scams around payments and Marketplace
Meta adds a note that matters if you buy or sell on Facebook. Eligible items bought with onsite checkout on Facebook or Instagram are covered by Purchase Protection, but Meta doesn't refund person-to-person or off-site transactions. That's why so many shop scams try to pull you onto email or a chat app: it takes you outside the one route that's protected. Marketplace has its own set of payment tricks, from fake payment screenshots to overpayment refunds, and they're worth knowing if you sell there.
My advice
Don't try to judge whether a message sounds convincing. Check the facts that can't be faked: which domain the email came from, whether you're being asked for a password, code or payment, and whether someone wants to move you off Facebook. If any of those is a yes, stop, don't click, and report it. And switch on two-factor authentication today, before anyone tests your password for you.
Frequently asked questions
What are the most common scams on Facebook?
Meta lists lottery, romance, loan, job, investment, inheritance, donation, commerce and paid subscription scams, along with phishing messages designed to steal your login.
How do I know if an email is really from Facebook?
Meta says real emails only come from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com or metamail.com, or their subdomains. You can also check recent emails from Facebook in your settings.
Will Facebook ever ask for my password?
No. Meta says it'll never ask for your username or password in an email, and its representatives won't ask for passwords or payment details over chat or email.
What should I do if I clicked a phishing link?
Change your password, check where you're logged in, turn on two-factor authentication and warn friends if your account sent messages. If you can't log in, use Facebook's account recovery steps.
Where do I report a Facebook scam?
Report the post, message or profile through Facebook's report options. Meta says not to respond to the scammer. Phishing emails can be reported to [email protected].
