# Facebook Page Appeal Asks for c_user and xs Cookies? > A Facebook Page appeal form asks for c_user and xs cookies? That cookie ask is a scam tell. Close it, secure sessions, and audit Page admins. - URL: https://www.awarexone.com/research/facebook-page-appeal-asks-for-c-user-and-xs-cookies - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-11-07 - Topics: Facebook, Page, Phishing, Malaysia - Related service: Facebook Page recovery: https://www.awarexone.com/facebook-page-recovery ## Short answer If a Facebook Page appeal page asks for c_user and xs cookies, treat it as a scam. Close the tab, use Account Status inside Facebook you open yourself, sign out other sessions, and audit Page admins. Meta does not need those cookies in an appeal form. ## Summary - Facebook phishing help warns about deceptive pages that steal credentials and sessions. - Account Status and hacked account help cover official restriction checks without cookie harvest forms. - c_user and xs are session cookies; Meta does not need you to paste them into an appeal form. - Distinct from page-policy violation message scams that push password pages; this decoder is the cookie bait tell. - One wrong step can cost you the account, so know what you are doing before you start. A restriction banner on your Facebook Page points to an appeal site. The form wants c_user and xs values from your browser. That is not how Meta reviews Pages. You need a cookie bait decoder before the session walks out the door. Facebook's [phishing help](https://www.facebook.com/help/www/166863010078512) warns about deceptive pages that steal credentials. Facebook's [Account Status help](https://www.facebook.com/help/1392616391875085) shows how to check restrictions inside Facebook. This evergreen guide is about cookie harvest appeals. For fake Page policy deletion messages that push password pages see [Facebook Page policy violation message scam](https://www.awarexone.com/research/facebook-page-policy-violation-message-scam). One wrong step can cost you the account, so know what you are doing before you start. Last checked: 7 November 2026. ## Quick Answer If a Facebook Page appeal page asks for c_user and xs cookies, treat it as a scam. Close the tab, use Account Status inside Facebook you open yourself, sign out other sessions, and audit Page admins. Meta does not need those cookies in an appeal form. ## Cookie Bait Decoder *Cookie bait decoder by AwareXone, based on Facebook phishing and Account Status help (read 7 November 2026).* | Ask on the form | What it really is | Your move | | --- | --- | --- | | Paste c_user | User id cookie for the Facebook session | Refuse; close the tab | | Paste xs | Session cookie that proves you are logged in | Refuse; close the tab | | Upload a cookie export file | Bulk session theft | Refuse | | Disable 2FA to continue appeal | Makes takeover easier | Keep 2FA on | | Open Account Status inside facebook.com yourself | Official restriction view | Use Help & support paths Meta documents | ## Why Meta Does Not Need Those Cookies When you are already logged into Facebook, Meta can show Account Status and appeal buttons in product. A third party site that demands raw cookies is trying to clone your session even if you did not type the password there. Malaysian Page admins who rush Malay or English banners are frequent targets. ## After You Submitted Cookies 1. Change your Facebook password from a device you trust. 2. Use Where you are logged in style session lists to sign out other sessions. 3. Turn on two factor authentication if it was off. 4. Audit Page admins and remove strangers. 5. Review business integrations tied to the Page. Facebook's [recover a hacked account](https://www.facebook.com/help/1216349518398524) help covers personal account compromise. Facebook's [About Page access](https://www.facebook.com/help/1101781386943864) help covers how Page roles and access work for admins. If admins were removed during the incident see [Facebook Page hacked admin removed](https://www.awarexone.com/research/facebook-page-hacked-admin-removed). If email or phone changed see [Facebook hacked email or phone changed](https://www.awarexone.com/research/facebook-hacked-email-phone-changed). > Warning: **Cookies beat passwords for silent takeovers.** Session cookies can let an attacker act as you while 2FA still protects a fresh password login. Sign out other sessions after any cookie submit. ## How This Differs From Page Policy Scam Mail Page policy violation message scams often push a password or login page after a fake deletion threat. Cookie bait forms may look like a quieter appeal wizard. Both are hostile. Keep the policy scam article for password page patterns; use this decoder when the form names c_user or xs. ## What Only Meta Can Decide Meta decides Page restrictions and official appeals. Your part is refuse cookie paste, secure sessions, and use in product Account Status. Train every Page admin that Meta will not ask for raw browser cookies in a web form. Keep a screenshot of the fake form URL for your incident ticket without returning to it. Review browsers for malicious extensions that expose cookies. Move Page work to a dedicated browser profile without random extensions. Tell finance if ads accounts were attached to the same login. Do not pay a stranger who offers a cookie cleaner restore service. Write down the exact on-screen wording before you screenshot so later appeals match what the platform showed on the day you acted. Tell close contacts through another channel that your account may send odd links until the situation is stable. Prefer official help URLs you type yourself rather than buttons inside unexpected emails or DMs. Keep a simple timeline with Malaysia time stamps for every password change, appeal and public warning. If a platform offers only a limited number of reviews, use them carefully and attach only evidence you can defend. After access returns, review connected apps and remove anything you do not recognise before you resume normal posting. Teams should nominate one owner for the case so staff do not file conflicting appeals from different logins. Ignore anyone who messages you offering a paid clear or a private tool. Stay on official help pages you open yourself. Do not share your password, codes or session cookies with anyone who contacts you about this case. Keep screenshots of every notice with the date in Malaysia time so later support chats match what you saw. Wording can vary by app and region. If you already paid a stranger who promised a restore, stop further payments and move to bank and police reporting the same day. Document which devices still have an active session so you can sign them out in order once you regain control. A calm checklist beats rushing a second account that can create more policy problems. Share only the facts your staff need. Over-sharing passwords in a group chat creates a second incident. Page teams should practice recognising c_user and xs labels in a tabletop drill. Ads managers should confirm payment methods after any cookie incident on the same login. Keep customer or member messages factual so copycats do not learn your internal recovery codes. Store evidence in a shared drive your team already trusts rather than in the compromised chat thread. If law enforcement asks for logs, hand over exports you already collected instead of improvising new captures. Schedule a short debrief after access returns so the same bait does not work on the next shift. Update internal playbooks with the exact Help Centre titles you used, including the read date. When vendors ask for status, give them a single approved sentence rather than five conflicting staff replies. Rehearse a calm public statement that avoids inventing timelines you cannot prove. Check that billing cards tied to the account still belong to you after the incident settles. Remove leftover recovery codes from screenshots before you file them in email. Ask whether any contractor still has an active session on a personal phone. Prefer daylight Malaysia hours for sensitive resets so more staff can watch the process. If a platform shows a lesson or quiz after a lock, complete only the official in app flow. Do not celebrate early if a temporary feature returns while a deeper appeal is still open. Keep printer access to the incident folder limited to people who need it. Close the loop with anyone who received a scam message from your account during the outage. Move Page publishing to hardware keys where Meta allows them. Brief every admin that cookie paste forms are hostile even when they look bilingual. Export a list of Page roles before and after the incident so missing admins are obvious. Disable unused business integrations that could keep a stolen session useful. Tell customer service which public URL will carry the real Page status update. ## When It Is Safer to Get Expert Help Getting help is safer when cookies were already pasted, when several Page admins changed, or when ads billing sits on the same login. Wrong DIY waits can leave sessions open. If you are unsure about any step, or the Page matters to your income, having an experienced team check it is the safer choice. AwareXone does this work. See our [Facebook Page recovery](https://www.awarexone.com/facebook-page-recovery) page. ## When a Case Review Makes Sense A case review helps when cookie theft, Page admin changes and ads access sit together. We are a Malaysia-based team, independent of Meta, and we use only the official routes. We do not ask for your password, codes or cookies, and we cannot promise a result. See our [trust page](https://www.awarexone.com/trust). ## Frequently Asked Questions ### What are c_user and xs? They are Facebook session cookies. Pasting them into a third party form can hand someone your login session. ### Does Meta ask for cookies in appeals? Use Account Status and appeal tools inside Facebook you open yourself. Treat cookie paste forms as scams. ### Is this the same as a Page policy violation message scam? Related but distinct. That article covers fake policy deletion and password pages. This one is the cookie ask tell. ### What if I already pasted cookies? Change password, sign out other sessions, audit Page admins, and review business access. ### Should I disable 2FA for an appeal? No. Keep two factor authentication on. ## Official sources - [Official: Protect yourself from phishing on Facebook, Facebook Help Centre (read 7 November 2026)](https://www.facebook.com/help/www/166863010078512) - [Official: Check your Account Status on Facebook, Facebook Help Centre (read 7 November 2026)](https://www.facebook.com/help/1392616391875085) - [Official: Recover a hacked account, Facebook Help Centre (read 7 November 2026)](https://www.facebook.com/help/1216349518398524) - [Official: About Page Access, Meta Business Help Centre (read 7 November 2026)](https://www.facebook.com/help/1101781386943864) --- AwareXone is an independent provider serving clients worldwide, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.