Your cousin texts you at 10:15 on a Tuesday night: “Did you just message me on Facebook asking for $500?” You didn’t. You open Messenger and see it — your account, your name, your photo, has been sending messages all evening to people you know, telling them you’re stranded and need money wired fast. That sinking feeling? Thousands of Americans get it every week. A Facebook scam doesn’t usually start with a stranger. It starts with someone you trust — except it isn’t really them.
Facebook is now the single biggest starting point for fraud in America. The FTC’s April 2026 Data Spotlight found that scams beginning on social media cost victims $2.1 billion in 2025 — eight times the 2020 figure — and more reported fraud losses began on Facebook than on any other single platform, more than email and text messages combined. Researchers citing FTC data put Facebook-linked losses at roughly $749 million, with WhatsApp ($425 million) and Instagram ($234 million) trailing behind. Investment scams alone accounted for about $1.1 billion of the social media total.
This guide covers the Facebook scams that don’t get enough attention: hacked accounts messaging your friends for money, cloned profiles sending fake friend requests, Messenger phishing links, and phony Facebook “security alert” pages. (Buyer-and-seller Marketplace fraud is covered separately in our dedicated Marketplace guide.) The pattern underneath them all is the same — borrowed trust — and once you can see it, these schemes get much easier to dodge.
How a Facebook Scam Unfolds, Step by Step
Nearly every Facebook scam follows the same four-act script, and knowing it gives you an unfair advantage:
Step 1: Borrow trust. The scammer takes over a real account or builds a fake one that looks real. Either way, the message lands in your inbox carrying the credibility of a friend’s name and photo. Your guard is down before you read a word.
Step 2: Manufacture urgency. The message needs you to act before you think. A stranded friend. An account about to be deleted. A video of you that you need to see right now. Urgency is the engine of the whole thing — remove it, and the scam stalls.
Step 3: Move you off the platform. You’ll be pushed to click a link, open a fake login page, send money through a payment app, or share a code. Facebook’s own protections can’t follow you once you leave.
Step 4: Harvest and spread. If you hand over a password, your account becomes Step 1 for the next victim. If you send money, it’s gone in seconds through channels that don’t reverse. Every victim is also a potential carrier.
Notice what’s missing from that script: sophistication. None of this requires hacking skills. It requires your password, your sympathy, or your panic — and usually just one of the three.
“Hey, It’s Me — I Need Money”: Hacked Accounts Messaging Friends
This is the most common Facebook scam in circulation, and it works precisely because the request comes from a real account. A scammer gets into someone’s Facebook account — through phishing, a reused password from another breached site, or malware — and then messages that person’s friends with an emergency: stuck at the airport, car broke down, hospital bill, phone died. They ask for money via wire transfer, payment app, or gift cards.
Here’s the part most people miss: the scammer doesn’t need to impersonate your friend’s voice or personality very well. They count on the fact that you rarely scrutinize a friend’s messages. One security analysis of Messenger attacks notes that every compromised account gets used to message more friends, which is why these waves keep returning year after year — each victim seeds the next round.
The single biggest tell is a request for money or codes through an unusual channel. If your aunt has never once used Messenger to talk to you and suddenly she needs $800 through a payment app, that’s not your aunt. Real emergencies reach people by phone call, and real friends accept being verified. My rule: any money request from a messaging app gets a phone call back on a number I already have. Every time. No exceptions.
Another dead giveaway: they ask you to keep it secret (“don’t tell anyone, I’m embarrassed”). Secrecy is a scammer’s best friend. A genuine person in trouble doesn’t need you silent — a scammer does.
Cloned Profiles and Fake Friend Requests
Cloning is simpler than hacking, and scammers love it because it’s fast. They copy someone’s name, profile photo, and cover photo, then send friend requests to that person’s friends. Once you accept, the “friend” starts a conversation — often after a week or two of looking normal — and eventually steers toward money, an investment opportunity, or a link.
How to spot a clone in about ten seconds: open the profile. Clones are usually thin — a recently created account, a handful of photos (often just one or two), almost no posts, few or no mutual friends, and friends who are all strangers. The original account often already exists on your friends list, which is the real giveaway. Two accounts with the same name and photo, one of which just sent you a request? The new one is the clone.
Never accept a duplicate friend request without checking with the person through another channel first. A thirty-second text — “hey, did you make a new Facebook account?” — kills this scam completely. And don’t “helpfully” message the clone to ask if it’s really them. You’ll just confirm you’re an active, responsive target.
The “Is This You in This Video?” Messenger Lure
Security researchers still list this as one of the most common Messenger scams, active since at least 2017 and still circulating in 2026. A message arrives from a friend — usually a hacked friend — saying “Is this you in this video?” or “Look who died,” followed by a link. The link opens a page that looks like a video player but is really a fake Facebook login page or a site that pushes malware.
It works because curiosity is nearly impossible to resist. A video allegedly showing you? You have to look. The scammer knows that.
Here’s the thing, though: there is no legitimate reason for anyone to send you a video of yourself through a link in Messenger. Facebook doesn’t work that way. If a friend really wanted you to see something, they’d say what it is in plain words. The moment the “video” asks you to log in to Facebook again to watch it, you’re looking at a credential-harvesting page — Facebook doesn’t make you re-log-in to view a video link.
In one large-scale campaign documented in 2022, phishing pages in this family reached millions of users in a matter of weeks. Every person who entered their password handed the scammer their account, which was then used to send the same message to their friends. That’s the viral loop that keeps this scam alive nearly a decade after it first appeared.
Fake Facebook Security Alerts and Login Pages
The other big phishing variant doesn’t pretend to be your friend — it pretends to be Facebook itself. Messages or emails warn that your page will be deleted, your account violated “community standards,” or someone tried to log in from another country. To “appeal” or “verify,” you click a link and land on a page that looks exactly like Facebook’s login.
Real talk: Facebook does not send you login links through Messenger messages or sketchy emails asking for your password. Account notices appear inside your account — under Settings, or in the Support Inbox — when you’re already logged in through the app or site you opened yourself. Any message that wants you to log in through the message itself is phishing. Full stop.
Check the address bar if you ever doubt a login page. The real Facebook lives at facebook.com — not facebook-security-alert.com, not facebo0k.com, not a string of random characters ending in “.top” or “.xyz”. Scammers register lookalike domains by the thousands, and they’re cheap. Your eyes are the firewall here.
Red Flags: Spotting a Facebook Scam in Seconds
Run any suspicious message past this list. Two or more hits and you should stop engaging entirely:
- A friend suddenly needs money urgently — especially through wire transfers, payment apps, gift cards, or crypto. Emergency + unusual payment method is the classic combo.
- “Don’t tell anyone” — any request for secrecy around money or account access is a blaring alarm.
- A duplicate friend request from someone already on your friends list.
- A thin, brand-new profile — one or two photos, no posts, almost no friends, created weeks ago.
- Links you didn’t ask for, especially “videos” of you or “shocking” content. Real friends describe what they’re sending.
- Login pages reached through a message — Facebook never asks you to log in via a link in Messenger or email.
- “Security alerts” about your page or account with a link to appeal, verify, or confirm your password.
- Requests for login codes or 2FA codes. A six-digit code sent to your phone or email is a key. Handing it to anyone — even someone who sounds like support — gives them your account. Facebook’s real support never asks for it.
- Investment or crypto “opportunities” from a friend who has never discussed investing with you before.
- Odd phrasing or timing — messages at strange hours, a friend who never uses Messenger suddenly living in it, or English that doesn’t sound like them.
How to Verify a Suspicious Message: 5 Steps
- Don’t reply in the same thread. If the account is hacked, replying just tells the scammer you’re reading. Pause first.
- Call or text the person on a number you already have. Not the number in their Facebook profile (that can be changed by the intruder) — a number from your own phone’s contacts. “Hey, are you messaging me about money on Facebook?” One question ends the mystery.
- Check the profile yourself. Look at the account’s age, post history, and friends. Compare it against the person you know.
- Open Facebook directly — never through the message’s link. Type facebook.com yourself or open the app, then check notifications and the Support Inbox there. Real warnings live inside your account.
- Ask a verifier question only the real person knows. Something recent and specific — “what did we talk about at dinner last month?” — that a stranger couldn’t guess from a public profile.
If You Already Clicked or Paid
Don’t sit in shame — act. Speed matters more than embarrassment ever will.
If you clicked a link but entered nothing: close the page, run a security scan on your device, and watch your accounts for odd activity over the next few weeks. No password entered means the scammer most likely got nothing — but stay alert.
If you entered your Facebook password: change it immediately from a device you trust, turn on two-factor authentication, and review “Where you’re logged in” under Settings to kick out any unfamiliar sessions. Then warn your friends — your account may already be messaging them. Facebook’s recovery hub is at facebook.com/hacked.
If you sent money: contact your bank or the payment app immediately and report the transfer as fraud. Wire transfers and gift cards are rarely recoverable, but payment apps sometimes can reverse a transfer if you report fast. File a report with the FTC at ReportFraud.ftc.gov and the FBI’s Internet Crime Complaint Center at ic3.gov — and keep every screenshot and receipt.
If you shared a login code: treat it like a password compromise. Change the password, enable two-factor authentication, and check that your recovery email and phone number haven’t been changed by the intruder.
How to Report a Facebook Scam
- Inside Facebook: report the message, the fake profile, or the hacked account directly — long-press a message or use the “…” menu on a profile. This helps Facebook shut the account down and protect others.
- FTC: file at ReportFraud.ftc.gov. Your report feeds the Consumer Sentinel database that law enforcement uses to track fraud patterns.
- FBI: file at ic3.gov, especially if you lost money or the scam involved interstate or international actors.
- Warn the circle: tell the real person their account is compromised, and post a brief heads-up so mutual friends don’t fall for messages already in flight.
The Bottom Line
A Facebook scam is almost never about Facebook being “hacked” in some technical sense. It’s about trust being borrowed — your friend’s name, a familiar face, the platform’s own logo — and aimed at your wallet. The defense is refreshingly low-tech: verify money requests by phone, never log in through a message link, and treat urgency as a warning sign rather than a call to action. Do those three things and you’ve neutralized the vast majority of what’s out there. The FTC’s numbers are sobering — $2.1 billion in social media-originated fraud losses in 2025 — but every one of those losses needed a human to click, type, or send. Make sure that human isn’t you.
Sources
- FTC data via CCStartup, “Social media scams cost Americans $2.1 billion in 2025” (April 2026) — https://ccstartup.com/blog/2026/04/28/social-media-scams-cost-americans-2-1-billion-in-2025/
- Cybernews, “FTC says imposter scams cost Americans $3.5bn in 2025” — https://cybernews.com/cybercrime/ftc-americans-record-3-5-billion-impersonation-scams/
- 2-Spyware, “Large-scale Facebook Messenger phishing attack lures millions of people” — https://www.2-spyware.com/large-scale-facebook-messenger-phishing-attack-lures-millions-of-people
- Lemon Bay Computer Service, “Scam Safety Manual” — Facebook and Messenger guidance (2026) — https://lemonbaycomputerservice.com/downloads/scam-prevention-guide.pdf
- Lilach Bullock, “Can Someone Hack Your Messenger? Here’s Exactly How to Check” — https://www.lilachbullock.com/messenger-hacked-how-to-check/
- Facebook Help Center — account recovery at facebook.com/hacked
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.