Clicked a Facebook free ad credits email and now the account acts strange? Learn how the lure works, which apps to remove and how to lock it down.
A Facebook free ad credits email is a phishing lure if it sends you to log in or connect an app to claim the credit. If you clicked, change your password, remove unknown apps under Settings and privacy, Apps and websites, check your business portfolio, and use facebook.com/hacked if you lost access.
SummaryThe email says you have been selected for free Facebook ad credits. It has the Meta logo, a value in your currency, and a button to claim the credit before it expires. You run a small business, ads cost money, and the offer feels like luck. You tap, log in, maybe approve an app, and a few days later the Page posts things you did not write and the ad account is spending on campaigns you did not make.
This guide is about the free ad credits lure specifically. It explains how it works, what Meta says about its own emails, and the checklist for removing app access and securing the account after a click. An agency has written up a takeover that started this way, in this write up by Rough and Ready Media. It uses Meta's phishing help page and its remove an app page. One wrong step can cost you the account, so know what you are doing before you start.
Last checked: 3 November 2026.
A Facebook free ad credits email is a phishing lure if it sends you to log in or connect an app to claim the credit. If you clicked, change your password, remove unknown apps under Settings and privacy, Apps and websites, check your business portfolio, and use facebook.com/hacked if you lost access.
Three paths follow the click. This is our summary of the pattern, not a Meta description.
| Path | What happens | What it gives the scammer |
|---|---|---|
| Fake login page | The button opens a page that looks like Facebook and asks you to log in | Your password, and sometimes your login code |
| App connection | The page asks you to continue with Facebook and approve an app | Access granted to the app through your account |
| Fake form | The page asks for card or business details to apply the credit | Your payment and business information |
Meta's phishing page describes phishing as an attempt to trick you into giving out personal information such as passwords or credit card numbers, through communications designed to look legitimate. It warns that clicking one fraudulent link can lead to bad actors taking over multiple accounts.
Meta's phishing page says correspondence from Facebook or Meta will only come from these domains, or subdomains of them such as support.facebook.com or business.fb.com:
The same page says:
Meta representatives will never request money or ask for passwords, payment details or other sensitive information over chat or by email.
Check the sender's full address, not only the display name. A free ad credits email from a free email service or a lookalike domain is not from Meta. Note that Meta also warns that some phishing partner requests come through its own facebookmail.com domain, so a real domain alone does not make a link safe. That case is covered in our guide on the Meta business partner request scam.
The app removal steps are from Meta's remove an app page. Meta's hacked business portfolio page lists signs such as new users added without approval, ad accounts or campaigns you did not create, and unexplained increases in spend, and says to contact Meta Support immediately if you think the portfolio was hacked.
Meta's phishing page gives a phishing report address on its fb.com domain, and says businesses should go to Meta Business Support Home to review account status. Report the email there, then delete it. Do not forward it to colleagues as a warning with the link still live.
Malaysian SMEs that run Facebook and Instagram ads can be tempted by fake credit offers, because ad budgets are tight and real promotions do exist. Treat any credit offer as real only if it shows inside Meta Ads Manager or Business Support Home when you open them yourself. Other lures with a similar shape include fake Page policy violation messages and fake Meta support.
Free credit emails rarely target one person. They go to whoever reads the shared inbox, the marketing assistant, or the agency that runs your ads. A short team rule stops a lot of the damage before it starts. Write it down and share it with everyone who has access to your Page or business portfolio.
Keep a short record of who has which level of access, and review it every few months. If an agency manages your ads, ask them how they check offers and partner requests, and agree who will act first if something goes wrong. A clear plan saves hours on the day an account is taken.
Meta decides whether a hacked account or business portfolio is restored and whether disputed ad spend is reviewed. Acting fast and following Meta's routes gives you the best footing, but it cannot force a result.
Getting help is safer when the ad account is spending without your approval, when you have been removed as an admin, or when the Page is your main sales channel. Each wrong turn can lock you out further, and fake helpers target business owners right after a takeover.
If you are unsure about any step, or the account matters to your income, having an experienced team handle it is the safer choice. AwareXone does this work. See our account security page.
A case review helps when you need a clear order of steps after a click, or several assets were affected. We are a Malaysia-based team, independent of Meta, and we use only the official routes. We do not ask for your password or codes, and we cannot promise a result. See our trust page.
More free guides on the same kind of problem.
