Before opening a suspicious link sent through Facebook — whether in Messenger, a comment, or a post — check three things: whether the sender’s account looks genuinely like the person or page it claims to be, whether the message matches how that contact normally communicates, and where the link actually leads once previewed. Facebook phishing commonly relies on compromised or impersonated accounts rather than technical exploits, so evaluating the account itself is just as important as evaluating the link.
Why Facebook is a common target
Meta has described phishing attacks that create fake login pages impersonating Facebook, Messenger, Instagram, and WhatsApp specifically to steal account credentials. Once an account is compromised, it can be used to send convincing-looking messages to that person’s real friends and contacts — which is why a message “from” someone you know is not automatically safe.
Step-by-step: evaluating a Facebook link
- Check the account, not just the message. Does the profile have a normal history, or was it created recently with little activity? Compromised accounts sometimes show a sudden change in posting behavior.
- Ask whether the tone matches the person. Meta’s own guidance on business impersonation scams describes messages using urgent language and threats about account deletion — this pressure tactic looks the same whether the message claims to be from Meta itself or from a friend.
- Preview the link before clicking, using the method in How to Tell Whether a Link Is Safe Before You Click, and read the domain using How to Read a URL: Every Part Explained in Plain English.
- Verify through a separate channel if the message claims to be from a friend and asks for money, login details, or a verification code — a text or phone call to that person directly is more reliable than replying in the same compromised thread.
- Avoid entering your Facebook login on a page you reached by clicking a link claiming your account has a problem. Navigate to facebook.com directly instead and check your account’s actual notifications there.
Common Facebook link scam patterns
- A message claiming a policy violation or copyright strike with a link to “appeal,” leading to a fake login page
- A “is this you in this video?” message with a link, often sent from a compromised friend’s account
- Fake giveaways requiring you to click a link and log in to “claim” a prize — see Fake Giveaways on Instagram, TikTok, and Facebook
- Marketplace scams where a buyer or seller sends a link outside the normal Marketplace flow
A worked example
A friend’s account messages you: “OMG is this you?? [link]” — a message you have never received from them before, sent with unusual urgency and no other context. Applying the steps above: the tone does not match how this friend normally messages you, and the message pressures a quick reaction. Rather than clicking, message the friend through a separate channel (text, a call, or a different app) to ask if their account sent that message intentionally.
Marketplace and Business-specific patterns
Facebook Marketplace transactions add a specific risk: a buyer or seller who quickly tries to move the conversation to a different app, or who sends a link claiming to be a shipping label, payment confirmation, or verification step outside Marketplace’s own messaging and payment flow. Legitimate Marketplace transactions generally do not require visiting an external link to “confirm” a payment. For anyone managing a Facebook Page or ad account, Meta has also flagged phishing attempts sent as Business Manager partner requests — unexpected requests to grant business access should be treated the same as any other unsolicited link, verified independently before accepting.
Recognizing fake giveaway comments
A specific pattern worth naming: an account replying to your own post claiming you have won something, often with a profile picture resembling a real brand’s logo. Genuine brands typically run giveaways through their own posts with public rules, not by replying individually to random accounts claiming a win. See Fake Giveaways on Instagram, TikTok, and Facebook for the fuller pattern, which applies identically on Facebook.
Limitations
Not every unusual message is a compromised account, and not every normal-sounding message is safe — well-crafted scams can mimic a contact’s tone convincingly, particularly if the scammer has access to that person’s past messages. Use these checks as strong signals rather than absolute proof, and rely on independent verification (a separate message or call) whenever a request involves money, credentials, or a code.
Frequently asked questions
What should I do if I think my own account sent a suspicious link?
Meta’s help center describes securing a compromised account by resetting your password and logging out of devices you do not recognize. Do this immediately, and warn your contacts separately that messages from your account around that time may not be genuine.
How do I report a scam on Facebook?
Facebook’s Help Center provides tools to report a scam directly from the message, post, or profile in question — use the platform’s built-in reporting option rather than replying to the sender.
Are links in Facebook ads held to the same scrutiny?
The same domain-checking habits apply to ads. See How to Check an Online Store Before Entering Payment Details if the ad leads to a store asking for payment information.
