Originally published on WarnScams: https://warnscams.com/facebook-scams-explained/

Your cousin texts you at 10:15 on a Tuesday night: "Did you just message me on Facebook asking for $500?" You didn't. You open Messenger and see it — your account, your name, your photo, has been sending messages all evening to people you know, telling them you're stranded and need money wired fast.

That sinking feeling? Thousands of Americans get it every week. Facebook scams don't usually start with a stranger. They start with someone you trust — except it isn't really them.

The scale of the problem

Facebook is now the single biggest starting point for fraud in America. The FTC's April 2026 Data Spotlight found that scams beginning on social media cost victims $2.1 billion in 2025 — eight times the 2020 figure — and more reported fraud losses began on Facebook than on any other single platform, more than email and text messages combined.

Researchers citing FTC data put Facebook-linked losses at roughly $749 million, with WhatsApp ($425 million) and Instagram ($234 million) trailing behind. Investment scams alone accounted for about $1.1 billion of the social media total.

This guide covers the Facebook scams that don't get enough attention: hacked accounts messaging your friends for money, cloned profiles sending fake friend requests, Messenger phishing links, and phony Facebook "security alert" pages. Buyer-and-seller Marketplace fraud is covered separately in our dedicated Marketplace guide on WarnScams.

The short version: most Facebook scams are not technical hacks — they are hijacked or cloned accounts borrowing a friend's name to rush you into sending money, sharing a code, or logging in on a fake page. Never send money or a login code because a message asked, verify any urgent request with a phone call, and never log in to Facebook through a link in a message. If you already clicked, change your password and turn on two-factor authentication right away.

How Facebook scams unfold, step by step

Nearly every one of these scams follows the same four-act script, and knowing it gives you a real advantage.

Step 1: Borrow trust. The scammer takes over a real account or builds a fake one that looks real. Either way, the message lands in your inbox carrying the credibility of a friend's name and photo. Your guard is down before you read a word.

Step 2: Manufacture urgency. The message needs you to act before you think. A stranded friend. An account about to be deleted. A video of you that you need to see right now. Urgency is the engine of the whole thing — remove it, and the scam stalls.

Step 3: Move you off the platform. You'll be pushed to click a link, open a fake login page, send money through a payment app, or share a code. Facebook's own protections can't follow you once you leave.

Step 4: Harvest and spread. If you hand over a password, your account becomes Step 1 for the next victim. If you send money, it's gone in seconds through channels that don't reverse. Every victim is also a potential carrier.

Notice what's missing from that script: sophistication. None of this requires hacking skills. It requires your password, your sympathy, or your panic — and usually just one of the three.

"Hey, it's me — I need money": hacked accounts messaging friends

This is the most common Facebook scam in circulation, and it works precisely because the request comes from a real account. A scammer gets into someone's Facebook account — through phishing, a reused password from another breached site, or malware — and then messages that person's friends with an emergency: stuck at the airport, car broke down, hospital bill, phone died. They ask for money via wire transfer, payment app, or gift cards.

Here's the part most people miss: the scammer doesn't need to impersonate your friend's voice or personality very well. They count on the fact that you rarely scrutinize a friend's messages. Every compromised account gets used to message more friends, which is why these scams keep returning year after year — each victim seeds the next round.

The single biggest tell is a request for money or codes through an unusual channel. If your aunt has never once used Messenger to talk to you and suddenly she needs $800 through a payment app, that's not your aunt. Real emergencies reach people by phone call, and real friends accept being verified. My rule: any money request from a messaging app gets a phone call back on a number I already have. Every time. No exceptions.

Another dead giveaway: they ask you to keep it secret ("don't tell anyone, I'm embarrassed"). Secrecy is a scammer's best friend. A genuine person in trouble doesn't need you silent — a scammer does.

Cloned profiles and fake friend requests

Cloning is simpler than hacking, which is why scammers use it so often. They copy someone's name, profile photo, and cover photo, then send friend requests to that person's friends. Once you accept, the "friend" starts a conversation — often after a week or two of looking normal — and eventually steers toward money, an investment opportunity, or a link.

How to spot a clone in about ten seconds: open the profile. Clones are usually thin — a recently created account, a handful of photos (often just one or two), almost no posts, few or no mutual friends, and friends who are all strangers. The original account often already exists on your friends list, which is the real giveaway. Two accounts with the same name and photo, one of which just sent you a request? The new one is the clone.

Never accept a duplicate friend request without checking with the person through another channel first. A thirty-second text — "hey, did you make a new Facebook account?" — kills this scam completely. And don't "helpfully" message the clone to ask if it's really them. You'll just confirm you're an active, responsive target.

The "Is this you in this video?" Messenger lure

Security researchers still list this as one of the most common Facebook scams on Messenger, active since at least 2017 and still circulating in 2026. A message arrives from a friend — usually a hacked friend — saying "Is this you in this video?" or "Look who died," followed by a link. The link opens a page that looks like a video player but is really a fake Facebook login page or a site that pushes malware.

It works because curiosity is nearly impossible to resist. A video allegedly showing you? You have to look. The scammer knows that.

Here's the thing, though: there is no legitimate reason for anyone to send you a video of yourself through a link in Messenger. Facebook doesn't work that way. If a friend really wanted you to see something, they'd say what it is in plain words. The moment the "video" asks you to log in to Facebook again to watch it, you're looking at a credential-harvesting page — Facebook doesn't make you re-log in to view a video link.

In one large-scale campaign documented in 2022, phishing pages in this family reached millions of users in a matter of weeks. Every person who entered their password handed the scammer their account, which was then used to send the same message to their friends.

The "Look who died" Facebook post scam

The newest wave doesn't arrive as a private message — it shows up as a post on your feed. A hacked or cloned account posts something like "Look who died, I think you know them" or "I can't believe he's gone, I'm gonna miss him so much," often tagging several friends at once, with a link to a supposed news article or video about the death.

The link is the trap. It opens a page that looks like a Facebook login screen — sometimes dressed up with a fake news headline or a video thumbnail of a car accident — and asks you to log in to see the story. Enter your credentials and the scammer owns your account, then uses it to post the same message to your friends. Some versions skip the login page entirely and push malware instead.

The tell is the same as the Messenger version: a real death announcement never arrives as a link that demands a login. If a post like this tags you, don't click — contact the person through another channel, and report the post so Facebook can take it down before your friends see it.

Fake Facebook security alerts and login pages

The other big phishing variant doesn't pretend to be your friend — it pretends to be Facebook itself. Messages or emails warn that your page will be deleted, your account violated "community standards," or someone tried to log in from another country. To "appeal" or "verify," you click a link and land on a page that looks exactly like Facebook's login.

Real talk: Facebook does not send you login links through Messenger messages or sketchy emails asking for your password. Account notices appear inside your account — under Settings, or in the Support Inbox — when you're already logged in through the app or site you opened yourself. Any message that wants you to log in through the message itself is phishing. Full stop.

Check the address bar if you ever doubt a login page. The real Facebook lives at facebook.com — not facebook-security-alert.com, not facebo0k.com, not a string of random characters ending in ".top" or ".xyz".

Red flags: spotting Facebook scams in seconds

Run any suspicious message past this list — it catches most of these scams. Two or more hits and you should stop engaging entirely:

  • A friend suddenly needs money urgently — especially through wire transfers, payment apps, gift cards, or crypto.
  • "Don't tell anyone" — any request for secrecy around money or account access is a blaring alarm.
  • A duplicate friend request from someone already on your friends list.
  • A thin, brand-new profile — one or two photos, no posts, almost no friends, created weeks ago.
  • Links you didn't ask for, especially "videos" of you or "shocking" content. Real friends describe what they're sending.
  • Login pages reached through a message — Facebook never asks you to log in via a link in Messenger or email.
  • "Security alerts" about your page or account with a link to appeal, verify, or confirm your password.
  • Requests for login codes or 2FA codes. A six-digit code sent to your phone or email is a key. Handing it to anyone — even someone who sounds like support — gives them your account. Facebook's real support never asks for it.
  • Investment or crypto "opportunities" from a friend who has never discussed investing with you before.
  • Odd phrasing or timing — messages at strange hours, a friend who never uses Messenger suddenly living in it, or English that doesn't sound like them.

How to verify a suspicious message: 5 steps

  1. Don't reply in the same thread. If the account is hacked, replying just tells the scammer you're reading. Pause first.
  2. Call or text the person on a number you already have. Not the number in their Facebook profile (that can be changed by the intruder) — a number from your own phone's contacts. "Hey, are you messaging me about money on Facebook?" One question ends the mystery.
  3. Check the profile yourself. Look at the account's age, post history, and friends. Compare it against the person you know.
  4. Open Facebook directly — never through the message's link. Type facebook.com yourself or open the app, then check notifications and the Support Inbox there. Real warnings live inside your account.
  5. Ask a verifier question only the real person knows. Something recent and specific — "what did we talk about at dinner last month?" — that a stranger couldn't guess from a public profile.

If you already clicked or paid

Don't sit in shame — act. Speed matters more than embarrassment ever will.

If you clicked a link but entered nothing: close the page, run a security scan on your device, and watch your accounts for odd activity over the next few weeks. No password entered means the scammer most likely got nothing — but stay alert.

If you entered your Facebook password: change it immediately from a device you trust, turn on two-factor authentication, and review "Where you're logged in" under Settings to kick out any unfamiliar sessions. Then warn your friends — your account may already be messaging them. Facebook's recovery hub is at facebook.com/hacked.

If you sent money: contact your bank or the payment app immediately and report the transfer as fraud. Wire transfers and gift cards are rarely recoverable, but payment apps sometimes can reverse a transfer if you report fast. File a report with the FTC at ReportFraud.ftc.gov and the FBI's Internet Crime Complaint Center at ic3.gov — and keep every screenshot and receipt.

If you shared a login code: treat it like a password compromise. Change the password, enable two-factor authentication, and check that your recovery email and phone number haven't been changed by the intruder.

How to report Facebook scams

  • Inside Facebook: report the message, the fake profile, or the hacked account directly — long-press a message or use the "..." menu on a profile.
  • FTC: file at ReportFraud.ftc.gov. Your report feeds the Consumer Sentinel database that law enforcement uses to track fraud patterns.
  • FBI: file at ic3.gov, especially if you lost money or the scam involved interstate or international actors.
  • Warn the circle: tell the real person their account is compromised, and post a brief heads-up so mutual friends don't fall for messages already in flight.

The bottom line

Facebook scams are almost never about Facebook being "hacked" in some technical sense. They're about trust being borrowed — your friend's name, a familiar face, the platform's own logo — and aimed at your wallet. The defense is refreshingly low-tech: verify money requests by phone, never log in through a message link, and treat urgency as a warning sign rather than a call to action. Do those three things and you've neutralized the vast majority of what's out there.

The FTC's numbers are sobering — $2.1 billion in social media-originated fraud losses in 2025 — but every one of those losses needed a human to click, type, or send. Make sure that human isn't you.

Read the full guide on WarnScams: https://warnscams.com/facebook-scams-explained/

This article is for education only and is not financial or legal advice. Last reviewed: 13 November 2026.