Fake Meta Support Scams in Malaysia: How to Spot Them

It is 11pm and you are packing tomorrow's orders when a Messenger chat pops up. The sender is called "Meta Business Support", the profile picture is the Meta logo, and the message says your shop's Facebook Page has a copyright violation and will be deleted in 24 hours unless you appeal through the link. Your Page is where most of your customers find you, so the instinct is to tap straight away.

Do not tap. Messages like this are one of the most common ways Malaysian Page owners, sellers and creators lose their accounts. Meta shows genuine warnings inside its own apps, in places you can open yourself, and its representatives do not ask for your password, login codes or payment details over chat, email or phone. This guide shows how to tell the difference, where real notices live, and what to do if you have already clicked, typed a password or paid. One line up front: AwareXone will never ask for your password or a login code either.

Last checked: 28 September 2026.

#How can you tell if a Meta Support message is fake?

Assume any unexpected message that claims to come from Meta is fake until you have checked it inside the Facebook or Instagram app yourself. Genuine account warnings appear in Account Status, the Support Inbox, Page Status and, for businesses, Meta Business Support Home. A message that asks for your password, a login code, card details or a payment, threatens to delete your Page within hours, offers a verified badge, or offers to "recover" an account for a fee is a scam. Emails from Meta come only from a short list of domains Meta publishes, and Facebook lists its recent security emails in your settings so you can compare. If you already typed a password, change it from the real app and log out other sessions. If money left your account, call your bank's hotline or the National Scam Response Centre on 997 immediately, then make a police report.

#Which fake Meta messages should you watch for?

The wording changes every few weeks, but the lures fall into a handful of patterns. Each one tries to rush you to a link or a payment before you think to check the app.

They arrive through Messenger, Instagram direct messages, email, comments that tag your Page, calls and ads. Meta's help centre lists "false claims that you went against our Community Standards" among the signs of a fake (Facebook Help Centre). A logo, a case number or your Page name proves nothing. Anyone can copy those.

#Why are Malaysian users and businesses targeted?

For many Malaysian sellers, the Facebook Page or Instagram account is the shop. Orders, customer chats and ads run through it, so a message saying it will vanish tomorrow lands hard. The scam leans on urgency, authority and fear of loss, the same pressure points behind most social engineering.

The wider numbers show how much of this is happening. Fraud made up 5,751 of the 7,616 incidents reported to CyberSecurity Malaysia's Cyber999 centre between January and December 2025 (CyberSecurity Malaysia, incident statistics 2025). These are voluntary reports to one Malaysian response centre, not a measure of every case in the country. Separately, citing police figures, the Inspector-General of Police said Malaysians lost RM2.97 billion to online scams of all types in 2025, up from RM1.57 billion in 2024 (Bernama, 15 June 2026). That figure covers all online fraud, not only fake Meta messages.

#Where do genuine Meta notices appear?

Real warnings about your account live inside Meta's own apps and business tools. You reach them by opening the app or typing the address yourself, never through a link in a message. At the time of writing, Meta's help pages describe these places:

Two details are worth remembering. Instagram says it "will never contact you about account security through Direct messaging". Facebook's Recent emails list shows security emails from the last year, while Instagram's shows only the last 14 days, so a recent "security" email that is missing from the list should be treated as fake. Meta is moving people to Meta Accounts, so you may see "Meta Account settings" instead of "Accounts Centre".

#How do you check that a message is genuine?

Do not investigate the message by using it. Close it and check from the other side, starting in the app.

1. Do not tap links, open attachments or reply. Screenshot the message and the sender's profile first.
2. Open the Facebook or Instagram app yourself, or type facebook.com into the browser. Do not use a link from the message.
3. Check Account Status and the Support Inbox. For a Page, check Page Status. For ads or a business portfolio, check Meta Business Support Home.
4. For an email, open "Recent emails" in Accounts Centre and see whether the same email is listed.
5. Check the sender's address. Meta says its emails come only from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, metamail.com and global.metamail.com, or their subdomains, and warns about misspelled lookalikes (Facebook Help Centre). Its business help page adds cases.meta.com and finance.fb.com (Meta Business Help Centre).
6. If the message asks for your password, a login code, card details, an ID photo through a link, or a payment, stop there. That alone makes it fake.
7. If nothing shows in the app, there is nothing to fix. Report the message and delete it.

#Red flags: what the message claims and what is really true

Use this table when a message has you worried. If the claim matches a row, the reality column is what Meta's own pages say.

#What should you do if you only clicked the link?

If you opened the page but typed nothing, the risk is lower. Close it, then open the app yourself and check Account Status and "Where you're logged in" for anything unfamiliar. If the link downloaded a file, delete it unopened and run your device's security scan. Then report the message to Meta.

#What should you do if you entered your password or a login code?

Move quickly. Attackers often use a login code within minutes, while it is still valid. Work through these steps in order, from the real app or a browser where you type the address yourself.

1. Change your Facebook or Instagram password. If you use the same password anywhere else, change it there too, starting with your email.
2. Secure the email account linked to Facebook or Instagram: new password, check the recovery phone and email, and remove any forwarding rules you did not create.
3. In Accounts Centre, open "Password and security", then "Where you're logged in", and log out every session you do not recognise.
4. Turn on two-factor authentication with an authenticator app, or reset it if it was already on.
5. For a Page or business portfolio, check Page access and the people and partners listed in Meta Business Suite. Remove anyone you did not add.
6. If you are already locked out, start at facebook.com/hacked or instagram.com/hacked, ideally on a device you have used before. For a Page you manage, Meta has a separate hacked Page form, and our Facebook Page recovery page explains how we handle Page cases.
7. Screenshot everything: the scam message, the sender, the fake page's address, and any emails about changed details. You will need this if you have to appeal.

Our guides cover the next steps for each platform: recovering a hacked Facebook account in Malaysia, getting a hacked Instagram back, and, if ads or admins were taken, what to do when Business Manager is hacked.

#What should you do if you paid or shared card or bank details?

Treat this as a financial emergency first and an account problem second. The bank can block a card or transfer. Meta cannot.

1. Call your bank's hotline or the National Scam Response Centre on 997 immediately. The government's NSRC page advises calling within 24 hours of discovering the scam so accounts and transactions can be blocked (malaysia.gov.my).
2. Ask the bank to block the card if you typed card details, and to flag any charges you did not make.
3. Make a police report at the nearest police station. Bring your screenshots, the payment details you were given and your bank statements.
4. Keep every record: the chat, the sender's profile link, the payment receipt and the account number or e-wallet you paid into.
5. Change your passwords if you also shared login details, following the steps above.

997 is for money that has already left your account. The NFCC, which runs the NSRC, describes it as an emergency response line for victims whose money was transferred, not a general complaints line, and says there is no guarantee you will get the money back (NFCC, About NSRC). If you only clicked and no money moved, secure the account and report the message instead. Before you pay anyone online in future, PDRM's Semak Mule portal lets you check whether a bank account or phone number has appeared in scam reports.

#Why are "recovery hackers" a second scam?

People who have just lost an account are the easiest people to scam a second time. Offers appear in comments, direct messages and ads within hours of a public post asking for help, promising a quick recovery through a "contact at Meta" or a special tool, for a fee paid upfront.

Malaysian police have warned about the same pattern with lost money. In April 2026, Bukit Aman's Commercial Crime Investigation Department said syndicates were advertising fake recovery services on Facebook, then demanding repeated upfront payments, and that no individual or agency can promise to recover scammed funds for a fee (Malay Mail, reporting Bernama, 13 April 2026). CCID has also said the authorities do not ask victims for payment to investigate or recover losses (AFP Fact Check).

A legitimate service says plainly that only the platform decides, never asks for your password or login codes, and uses the official forms rather than claiming a way around them. SocialSafe by AwareXone, AwareXone's recovery service, reviews each case before anything is agreed, has no special access to Meta staff, and uses the same official routes you can. Read how we work and what we never ask for.

#How do you report a fake Meta message in Malaysia?

Report it to Meta so the sender can be removed, to Cyber999 if it links to a phishing site, and to the authorities if money was lost.

• To Meta: use the report option on the message or the sender's Page in Facebook, Messenger or Instagram. Meta asks people to forward phishing emails to [email protected] (Messenger Help Centre).
• Phishing link or fake site: report it to CyberSecurity Malaysia's Cyber999 through its online form, by email to [email protected], on 1-300-88-2999 during office hours, or on the 24-hour line +6019-266 5850 for phishing (MyCERT reporting channels).
• Money lost: your bank's hotline or 997, then a police report, as above.
• A fake Page posing as your business: report it under the platform's impersonation category. Our impersonation evidence guide explains what to save first.

#A two-minute check before you act on any Meta message

Act on a Meta warning only if every line below is true:

• The same problem shows in Account Status, the Support Inbox, Page Status or Business Support Home.
• Any email is listed under "Recent emails" in Accounts Centre.
• Nothing asks for a password, a login code, card details, an ID photo through a link, or money.
• No deadline of hours, no deletion threat, no badge offer and no paid recovery.
• You have screenshotted the message before reporting and deleting it.

#How do you make the next fake message harmless?

Set your accounts up so one mistaken tap cannot cost you everything. Turn on authenticator-app two-factor authentication for every admin, keep at least two trusted admins on a business Page, and use a dedicated email for the business login. Tell staff and freelancers to check the app before acting on any warning. Our social media security guide for Malaysia covers the full setup, and if you want a badge, our guide to getting verified on Instagram, Facebook and TikTok explains the official route.

If the official routes have not worked, or a business account with customers and ads is involved, you can ask us to review the case. We look at what happened, tell you honestly whether an official route still looks open, and help you prepare the evidence Meta asks for.

#Frequently Asked Questions