The “your Meta ad account is restricted” email — real, or a scam?

This one starts with a perfectly ordinary decision: a small business signs up for Meta ads. A friend of this service did exactly that — and within days, an email arrived that looked precisely like Meta’s own: the logo, the layout, the calm corporate tone, and one urgent problem to fix. They followed it. Some time later, a large sum was noticed on their credit card. Their bank recovered it — because they moved fast — but the email deserves a closer look, because it is very, very good.

How they make it look exactly like Meta

Four techniques, usually in combination. First, display-name dressing: the sender shows as “Meta for Business” or “Meta Security” while the actual address is something unrelated — campaigns have been documented arriving from generic bulk-mail addresses like a stray salesforce.com noreply. Second, lookalike domains: meta-support.co, metasupport, metabusiness-appeal — close enough to pass a glance. Third, real mailing infrastructure: sending through legitimate email platforms so basic technical checks pass. And fourth, the nastiest: genuine Meta mail carrying the scam. Attackers have abused Meta’s own notification and invitation features so the phish arrives from real facebookmail.com — the email is authentic; the thing named inside it links somewhere malicious.

Meta’s genuine mail does come from domains like facebookmail.com, facebook.com, fb.com, meta.com and mail.instagram.com — but that last technique is why the domain check is necessary and not sufficient. The domain proves the postmark, not the sender’s intent. Which is why the only reliable habit lives outside the email entirely.

Why it arrived days after you signed up

The timing feels like surveillance. It mostly isn’t. A new Page and a new advertising presence are publicly visible, business contact details are scraped and traded, and these campaigns run constantly — so new advertisers get hit early and often. And new advertisers are the softest targets for a policy-violation email, because every word of it sounds plausible to someone who just started and doesn’t yet know what Meta’s real mail looks like.

Where the money goes

Two roads, both starting at the fake login page. The simpler one harvests whatever you type — password, card details — and uses them directly. The worse one is a Business Manager takeover: with your login (and sometimes a two-factor code they talk you into sharing), the attacker adds themselves to your business assets and runs their ads on your saved payment method, at daily budgets you would never set. That is how a large sum lands on a credit card before anyone notices — which is exactly what happened here. It was spotted on the statement, the bank was called quickly, and the money came back. Speed decided that.

What to do

1. Don’t tap anything. Open the app or type the address yourself and check Account Quality. Nothing there? The email was the scam — forward it to phish@facebook.com, then delete it.
2. If you logged in through the link: change your password now, turn on two-factor authentication, and log out of all sessions from security settings.
3. Check who’s inside: in Business settings, review People and Partners and remove anyone you don’t recognise — do this before anything else financial, or new charges keep coming.
4. Check the money: review your ad account’s payment activity and your card statement for charges you didn’t make.
5. If your card was hit: ring your bank on the number on your card, immediately. Banks reverse card fraud regularly when you move fast — in this story, every dollar came back.
6. Report it to Scamwatch, and to ReportCyber if money was lost.

Common questions