# Facebook Advanced Protection Required: Turn It On in Time > Facebook says you must turn on Advanced Protection, formerly Facebook Protect? See who must, the two-week rule, setup path and what to do if locked out. - URL: https://www.awarexone.com/research/facebook-advanced-protection-required-turn-on-locked-out - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-29 - Topics: Facebook, Account security, Two-factor authentication - Related service: account security help: https://www.awarexone.com/services/account-security ## Short answer If Facebook says Advanced Protection is required, open Settings and privacy, then Accounts Centre or Meta Account, then Password and security, then Advanced Protection, and follow the prompts to Fix now. Meta says required users must finish within two weeks of notification or may be locked out. You need two-factor authentication or a passkey, set up on your own device. ## Summary - Advanced Protection is the current name for Facebook Protect, and Meta says it is mandatory for notified accounts in every country except Canada. - Meta's blog says required users need to finish setup within two weeks of notification and may be locked out until they complete the steps. - Facebook's help page says required accounts must turn on two-factor authentication or create a passkey, and that required accounts cannot unenrol. - Real emails about Advanced Protection come from security@facebookmail.com, and Facebook says it never asks for your password by email or message. - One wrong step can cost you the account, so know what you are doing before you start, especially before you remove a passkey or change a login method. A banner or an email says your Facebook account is required to turn on Advanced Protection. Maybe you saw it, meant to deal with it later, and now Facebook will not let you in until you finish. Or a teammate invited you, and you are not sure the message is real. You run a Page, manage ads or have a big following, so losing this account would hurt. The short answer: it is a real Meta security programme, formerly called Facebook Protect, and if you were notified you need to finish setup with two-factor authentication or a passkey. This guide covers who Meta requires, the two-week rule, the exact setup path, how to read each notice, how to spot a fake, and what to do if you are already stuck. One wrong step can cost you the account, so know what you are doing before you start. Last checked: 29 October 2026. ## Quick Answer: Is the Advanced Protection Notice Real, and What Do I Do? Usually yes, if it appears inside Facebook or comes from security@facebookmail.com. Facebook's help page [How to enable Advanced Protection on Facebook](https://www.facebook.com/help/1052552578831700) says some accounts are required to turn it on, that they will receive notifications by email and on Facebook, and that a required account needs to "either turn on two-factor authentication or create a passkey". Meta's [Advanced Protection blog for civic leaders](https://www.facebook.com/government-nonprofits/blog/advanced-protection) says that as of December 2025 Facebook Protect is now called Advanced Protection, that in all countries other than Canada it is mandatory, and that "Users need to complete the setup steps within two weeks of notification. Users may be locked out of their account until they complete the steps." That is Meta's current wording, not a countdown we can verify for your account. ## Who Meta Requires The help page lists required accounts as: - Civic actors, such as politicians and journalists. - Accounts added to business portfolios that advertise with Meta. - Accounts added to business portfolios with access to monthly invoicing. - Accounts connected to Pages or profiles with a large number of followers and the potential to reach many people. The same page says creators and businesses subscribed to Meta Verified are among the higher risk groups the programme is built for. Meta's [About Meta passkeys](https://www.meta.com/help/meta-account/1991801474748071/) page gives a similar list, including accounts with access to advertising or business tools. In Canada, the blog says, the programme remains optional and accounts will not be locked out for non-compliance. Malaysia is not on that exception list, so if you are in Malaysia and you are notified, the blog's mandatory wording applies to you. The blog also says that if you do not receive a notification, no action is required. ## Notice to Action Table *Built from Facebook's Advanced Protection help page, Meta's Advanced Protection blog and Meta's passkey help, read 29 October 2026.* | What you see | What it means | What to do | | --- | --- | --- | | An invitation from someone on your team | The blog says you may be invited via another user on your team | Check inside Facebook under Password and security rather than through a link, then enrol if it is there | | "Required" notice in Feed, in the app or by email | Your account has been identified as needing stronger security | Follow the setup path below now. Meta's blog gives two weeks from notification | | Locked out until you finish setup | The help page says if you do not complete setup you may lose access to certain features or your account | Finish the on-screen steps, using a passkey or two-factor authentication on your own device | | The notice disappeared before you acted | The help page says an account may fall out of eligibility and stop seeing it | Nothing is required. You can still turn it on voluntarily | | You cannot see any way to turn it on | The help page points you to creating a passkey instead | Create a passkey on your own device ([Meta passkey help](https://www.meta.com/help/meta-account/1991801474748071/)) | | An email, DM or text asking for your password or a login code to "activate" protection | A phishing attempt | Do not click or reply. Facebook says it never asks for your password by email or message | ## Turn On Advanced Protection: The Setup Path The help page gives these steps on a computer. Labels can differ between Accounts Centre and the newer Meta Account settings, because Meta says it is gradually moving people over. 1. Click your profile picture in the top right of Facebook. 2. Click Settings and privacy, then Accounts Centre or Meta Account. 3. Click Password and security. 4. Click Advanced Protection. 5. Follow the on-screen instructions. Facebook says it will scan your account for potential vulnerabilities and suggest what to fix, which may include creating a passkey, choosing a stronger password or turning on two-factor authentication. 6. Click Fix now and follow the prompts to finish turning on Advanced Protection. Do this on your own phone or computer, not a shared or public device. Meta's passkey page says not to create a passkey on a shared or public device. ## Passkey or Two-Factor Authentication? The pages do not use identical wording. The help page says a required account needs two-factor authentication or a passkey. The passkey page says "If your account is enrolled in Advanced Protection, you're required to create a passkey" and "If you're required to create a passkey and don't, you will be locked out of your account until you create one." Follow what your own screen asks for. If it asks for a passkey, our guide on [the Meta passkey required lockout](https://www.awarexone.com/research/meta-passkey-required-locked-out) walks through it. The passkey page lists device requirements: iPhone 8 or later on iOS 16 or later with iCloud and two-factor authentication on, Android 9 or later with a device lock, Windows 10 or later, or macOS Ventura or later, with Chrome 109, Safari 16 or Edge 109 or later. It says passkeys may not work in Incognito mode and that you can create up to 5 passkeys per Meta Account. For two-factor authentication, Facebook's page [How two-factor authentication works on Facebook](https://www.facebook.com/help/148233965247823) lists three methods: a security key, login codes from a third-party authentication app, or text message codes. It says you can get 10 recovery login codes for when you cannot use your phone. Save those somewhere safe and offline, and never share them with anyone. ## Already Locked Out: What the Pages Offer If you are stuck at the two-factor code screen, Facebook's [two-factor troubleshooting page](https://www.facebook.com/help/147926301947841) suggests these, in order: 1. Wait for a delayed text message code, and check your signal and message inbox. 2. Approve the login from another device where you are already signed in, if you see a prompt there. 3. Use one of your saved recovery codes. Each code works once. 4. If none work, continue to the code screen and, on a computer, click Need another way to authenticate?, then Other options, then Get more help. On Android or mobile web, tap Having trouble? On iPhone or iPad, tap Need help? 5. Facebook will ask you to confirm your identity, which the page says may involve a photo of government ID, security questions or trusted contacts, depending on what you set up. Once you are back in, finish Advanced Protection straight away and add a second method, so one lost phone does not lock you out again. ## Spot a Fake Advanced Protection Message The help page says you can confirm an email about Advanced Protection by checking it came from security@facebookmail.com, and that Facebook will never ask for your password in an email or Facebook message. Facebook's [phishing help page](https://www.facebook.com/help/166863010078512) adds a caution: it has seen Business Manager partner requests that include phishing links and come from the legitimate facebookmail.com domain. So the safest habit is to ignore links in any message and open Password and security yourself. The phishing page also says Meta representatives will never request money or ask for passwords, payment details or other sensitive information over chat or by email. If you handle business assets, our guide on [the Meta business partner request scam](https://www.awarexone.com/research/meta-business-partner-request-scam) shows a common version. ## What the Pages Do Not Say - They do not say how Meta counts the two weeks on your account, so act as soon as you see the notice. - The two-factor troubleshooting page gives only a typical time for Facebook to send instructions after an identity confirmation, which is not a promise for your case. - They do not offer a way for required accounts to opt out. The help page says required accounts cannot unenrol. - They do not promise that every locked account is restored. Meta decides. ## When It Is Safer to Get Expert Help Setting this up is simple for many people, and the official steps come first. The risks are specific. Meta's passkey page warns that removing a passkey is permanent and, for an account that needs one, may cause you to lose access until you create a new one. Letting the two-week window pass may lock the account. Required accounts cannot unenrol, so trying to undo it is not an option. And Facebook's phishing page warns that some phishing has even come from a real Meta domain, so a security notice is easy for scammers to imitate. If you are unsure about any step, if the account runs ads, holds a business portfolio or carries your income, or if you are already locked out, having an experienced team handle it is the safer choice. AwareXone does this. We walk you through the official setup on your own device, check your recovery methods and help with the identity route if you are stuck. See our [account security help](https://www.awarexone.com/services/account-security) page, and use the Apply for Case Review button at the end of this guide. ## When a Case Review Makes Sense A review helps when several admins on a business portfolio all got the notice, when the person who set up the Page has left, or when your only login method was a lost phone. SocialSafe by AwareXone is a Malaysia-based service, independent of Meta, that uses only official channels. We never ask for your password, login codes or recovery codes, and we cannot promise what Meta will decide. See how we work on our [trust page](https://www.awarexone.com/trust). ## Frequently Asked Questions ### What is Facebook Advanced Protection? It is Meta's security programme for higher risk accounts, formerly called Facebook Protect. Facebook says it requires stronger login methods such as passkeys or two-factor authentication and adds monitoring for potential hacking threats. ### What happens if I do not turn on Advanced Protection? Meta's blog says required users need to finish within two weeks of notification and may be locked out until they do. The help page says you may lose access to certain features or your account. ### Can I turn off Advanced Protection? Facebook's help page says required accounts cannot unenrol. Only people who turned it on voluntarily can unenrol. ### Is an email about Facebook Advanced Protection real? Facebook says real emails come from security@facebookmail.com and never ask for your password. Open your settings yourself rather than using a link. ### Is Advanced Protection required in Malaysia? Meta's blog says it is mandatory in all countries except Canada, for accounts that are notified. If you were not notified, it says no action is required. ## Official sources - [Official: How to enable Advanced Protection on Facebook (read 29 October 2026)](https://www.facebook.com/help/1052552578831700) - [Official: Advanced Protection, strengthening account security for civic leaders and campaigns - Meta for Government and Nonprofits (read 29 October 2026)](https://www.facebook.com/government-nonprofits/blog/advanced-protection) - [Official: About Meta passkeys (read 29 October 2026)](https://www.meta.com/help/meta-account/1991801474748071/) - [Official: How two-factor authentication works on Facebook (read 29 October 2026)](https://www.facebook.com/help/148233965247823) - [Official: Troubleshoot login with two-factor authentication on Facebook (read 29 October 2026)](https://www.facebook.com/help/147926301947841) - [Official: Protect yourself from phishing on Facebook (read 29 October 2026)](https://www.facebook.com/help/166863010078512) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.