The copyright violation scam on Instagram and Facebook follows one script: a message claims your Page or account broke copyright rules and will be disabled unless you appeal through a link. The link opens a fake login page that captures your password and login code. Meta’s real notices live inside your account, so you can check every claim without clicking.
Common Scam Patterns Aimed at Pages, Creators and Advertisers
Our guide to phishing covers how phishing works in general. This one covers the scams aimed at Pages, creators and advertisers.
- Fake copyright or policy strike. “Your Page will be disabled for copyright infringement. Appeal here.” Meta says scammers send false claims that you broke its Community Standards or, for businesses, its Advertising Standards.
- Fake verification offer. A DM promises Meta Verified or a badge, or says you must “verify your account” to keep it.
- Fake “Meta Business Support.” A Page or email with a Meta-style name says your ad account has a problem and asks you to log in.
- Fake collaboration or podcast invite. A brand deal or interview that asks you to sign in to “view the brief.”
- Phishing partner requests. Meta has warned that bad actors send Business Manager partner requests with phishing links from the legitimate facebookmail.com domain.
Red Flags and What Meta Actually Does
Warning signs Meta and the FTC describe:
- Threats and deadlines, such as “do this now or we’ll close your account.”
- An “appeal form” or login page that isn’t on facebook.com or instagram.com.
- A look-alike sender. Meta says its mail comes only from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, metamail.com and their subdomains.
- Any request for your password, a login code, Facebook recovery codes or Instagram backup codes.
- A request to continue the chat on another app.
| Scam message | Real Meta practice | What to do |
|---|---|---|
| “Copyright violation: appeal now or lose your Page.” | Restrictions show in Account Status; real copyright notices include appeal instructions in Meta’s own message. | Open Account Status yourself. |
| “Get Meta Verified” by DM | Meta Verified is a paid subscription you start in the app. Instagram never DMs you about your account. | Report and block the sender. |
| “Meta Business Support” email from an odd domain | Official mail uses Meta’s listed domains; Business Support Home shows real issues. | Forward it to phish@fb.com. |
| Collab invite that needs your login | Meta says never give your password to an unfamiliar source. | Decline and report. |
| “Send us the code we just texted you.” | Meta representatives never ask for passwords or sensitive information. | Never share it. |
How to Check if Meta Really Contacted You
Never verify a message through its own link. Open the app yourself and check:
- Recent emails (Facebook): go to facebook.com/recent_emails/security, or click your profile picture, then Settings & privacy, Settings, Accounts Center, Password and security, and Recent emails below Security checks. The SECURITY tab covers the last year; OTHER EMAILS covers the last two days.
- Support Inbox (Facebook): click your profile picture, then Help & support, then Support inbox. For Page messages, log in as its admin.
- Account Status (Facebook): click your profile picture, then Help & support, then Account Status. It covers your profile and the Pages you manage.
- Instagram: click More, Settings, Meta Account, Login and security, then Recent emails to see the last 14 days. Account Status sits below More info and support. Some people still see Accounts Center instead.
- Business Support Home: Meta says you can confirm there whether emails, texts or calls about business account issues are valid.
Already Clicked or Entered Your Password? Do This Now
Meta says to act as soon as possible. Use the real app, not the message:
- Close the fake page and don’t enter anything else, including codes that arrive by text.
- Reset your password to one you don’t use elsewhere. For Facebook, Meta also says to report the account as compromised at facebook.com/hacked, even if you can still log in.
- In Accounts Center, click Password and security, then Where you’re logged in, then Select devices to log out.
- Open Two-factor authentication, then Additional methods, then Recovery codes (Facebook) or Backup codes (Instagram), and click Get new codes. Turn on two-factor authentication if it’s off.
- Confirm your email and phone number are still yours, and remove linked accounts you don’t recognize.
- Review your activity log and posts. For a Page or business portfolio, undo changes you don’t recognize.
- Entered card details? Contact your bank. Downloaded a file? The FTC says to update your security software and run a scan.
What Not to Do
- Don’t reply to the scammer or retry their “appeal form.”
- Don’t give codes to anyone offering to “secure” your account.
- Don’t pay a “recovery hacker.” Learn how to spot fake account recovery services.
If the Attacker Already Took Over
- Facebook Page: Meta recommends its Page recovery form, which works only if you’re logged in and recently lost access. Meta says it aims to reply within a day, though some reviews take longer. Can’t log in? Start at facebook.com/hacked on a device you’ve used before. See our guide to recovering admin access to a hacked Facebook Page.
- Business portfolio or ad account: Meta notes a scammer might trick you into handing over control in Business Manager, then remove you. Read what to do when Business Manager is hacked.
- Instagram: if security@mail.instagram.com said your email changed, Meta says the secure my account option in that email may undo it. Otherwise, request a login link from the login screen. Full steps: how to recover a hacked Instagram account.
How to Report the Scam
- Forward fake Facebook or Meta emails to phish@fb.com and fake Instagram emails to phish@instagram.com.
- Instagram DM: click Options next to the message, then Report, and follow the instructions.
- Fake “Meta Support” profile or Page: click Options below the cover photo, then Report profile or Report Page.
- The FTC asks you to forward phishing emails to reportphishing@apwg.org, forward scam texts to SPAM (7726) and report at ReportFraud.ftc.gov.
When to Get Professional Help
If the scammer locked you out of a profile, Page or business portfolio, a well-documented request matters. The AccRevert team reviews the case, organizes your ownership evidence and prepares a documented request or appeal submitted through Meta’s official channels.
Only Meta decides the outcome, so no result is promised, and we never ask for your password or login codes. Pricing: a flat $299 case-preparation fee opens a case; a success fee of $599 for personal accounts, $999 for business accounts or $1,199 for Business Manager and ad accounts applies only if access is restored. Payment is by PayPal only. See our Hacked Account Recovery service.
Frequently Asked Questions
Does Meta send copyright warnings by DM?
Instagram says it never sends direct messages about your account in the app, and Meta representatives never ask for passwords over chat. Real copyright removals come with instructions in Meta’s own message, and restrictions show in Account Status. A DM with an outside appeal link is a scam.
Is an email from facebookmail.com always safe?
Not always. It is an official Meta domain, but Meta has warned that bad actors sent Business Manager partner requests with phishing links through it. If you don’t know the person or business in a partner request, don’t click its links. Check Recent emails or Business Support Home instead.
I entered my password but can still log in. Am I safe?
Not yet. Anyone holding your password may be able to sign in, and Meta says you can report a Facebook account as compromised while you still have access. Reset your password, log out unknown devices, get new recovery or backup codes and turn on two-factor authentication.
Why do scammers ask for a login code?
The code is the second step of two-factor authentication. A scammer who already has your password needs it to finish signing in as you, so a “verification” request right after a fake login page signals an active takeover. Treat every code like your password.
Final Checklist
- Don’t click links in copyright, verification or “Meta Support” messages.
- Check Recent emails, Support Inbox and Account Status yourself.
- Never share passwords, login codes, recovery codes or backup codes.
- Already clicked? Reset your password, log out unknown devices, get new codes.
- Report the message to phish@fb.com or phish@instagram.com.
Did a fake copyright notice cost you your Page or profile? Open your recovery case with AccRevert: a flat $299 case-preparation fee starts the work, and the success fee ($599 personal, $999 business, $1,199 Business Manager or ad account) applies only if access is restored.
Related Articles
Stop guessing and document the case properly.
Our team can review the account history, available ownership evidence and the recovery steps already attempted.
“Someone May Have Accessed Your Account” on Facebook: What to Do
Meta Verified Account Recovery: What Support Can and Can’t Do
