# The email really came from Facebook. The scam was in the name. > A food truck owner gets a real Facebook email warning her Page will be disabled in 24 hours. Meta says scammers are hiding phishing links inside business partner requests, so the email passes every check. By Jordan Menlo · Published October 24, 2026 Section: Brokers & Harassment › Industry Scams · Series: Scam Report (https://mcafax.com/notebook/series/scam-report) Canonical: https://mcafax.com/notebook/scam-report-facebook-partner-request-phishing Source: MCAFax, The Broker's Notebook (https://mcafax.com/notebook). MCAFax is not a lender or a law firm. --- "Your Page will be permanently disabled in 24 hours for a trademark violation. Appeal now at the link below or call our support line." Here's a hypothetical, and everyone in it is made up. Dani (made up) runs Copperfern Tacos (a made-up food truck). Her Facebook Page has 6,800 followers, and every Friday she posts where the truck will park. It's basically her whole marketing department. Friday, 11:52 p.m. She's wiping down the flat-top when her phone buzzes. Subject line: a partner request on her business account. She checks the sender, because she's heard you're supposed to. It's from facebookmail.com. The real one. So she taps. The "business" asking to partner with her isn't called anything normal. Its name is the whole warning above: the 24-hour countdown, the trademark claim, the appeal link. That's the trick. Nobody spoofed anything. The scammer made a dummy business, typed the threat in as its name, and sent Dani a partner request. Facebook's own system wrapped that name in a real notification and delivered it, clean, past every spam filter. Meta's help center says it has seen exactly this, partner requests carrying phishing links, and warns that these notifications come from a legitimate Meta domain (Meta). The link opens a page with the right blue, the right logo, a form that says "Appeal review." It asks for her login. Then the code that just texted her. By Saturday morning she's been removed from her own Page. The new admin has her ad account running ads she didn't make, on the card she saved for boosting taco posts. Then the second wave hits. She posts on her personal profile: "Got hacked, don't click anything from Copperfern." Within an hour, three strangers message her. One says he "works with Meta" and can restore the Page by tonight for $200. The BBB says this is its own scam: people pay a stranger to get them back in, then get hit with new fees for "software" or "verification," and the account still isn't back (BBB). Dani doesn't pay him. She does what's below instead. ## Red flags - A partner request from a business you've never heard of. Meta says if you don't know the person or business in the request, don't click any links (Meta). - The "business name" reads like a warning: a countdown, a policy violation, a phone number. A real business is named like a business. - Threats and urgent demands, like "do this now or we'll close your account." Meta lists that as a sign of phishing (Meta). - Any page that asks for your password after you clicked a link. Meta says it will never ask for your password in an email (Meta). - A stranger who DMs you right after you post that you were hacked, offering to get you back in for a fee. The BBB says only the platform can restore access (BBB). ## What to do Don't act from the email. Open a new tab, type business.Facebook.com yourself, and check your business settings. Turn down any partner request you don't recognize, and remove any partner, person, or admin you didn't add. Turn on two-factor authentication for every admin, and use a passkey if you can. Meta says passkeys hold up better against phishing than passwords do (Meta). Already locked out? Use Facebook's own form for hacked Pages. Getting back in through the platform is free, so don't pay a stranger who says they can do it faster (Meta, BBB). Once you're back in, change your password, sign out of all devices, and check that the backup email and phone on the account are yours. The FTC walks through each step (FTC). Call your bank or card issuer about any ad charges you didn't make, and ask to dispute them. Report it at ReportFraud.FTC.gov, and forward the phishing message to phish@fb.com. You can also file it with BBB Scam Tracker so other owners see it (FTC, Meta, BBB). Dani got the Page back after a few days of forms. Her next post was the truck's Friday location, plus one line: "We will never DM you about your account." ## Sources - [Meta Help Center: keep your Facebook profile secure (partner request phishing warning)](https://www.facebook.com/help/213481848684090/) - [Meta Help Center: protect yourself from phishing on Facebook](https://www.facebook.com/help/217910864998172) - [Meta Help Center: hacked Page help](https://www.facebook.com/help/256388474444114) - [BBB: never pay a stranger to get back into your social media account](https://www.bbb.org/article/scams/29411-bbb-scam-alert-why-you-should-never-pay-to-recover-your-social-media-account) - [FTC: what to do if your email or social media account was hacked](https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account) - [FTC: ReportFraud.FTC.gov](https://reportfraud.ftc.gov) ## Questions readers ask **Can a phishing email really come from facebookmail.com?** Yes. Meta warns that scammers have sent Business Manager partner requests with phishing links, and those notifications come from a real Meta domain (Meta). **How do I check if a Meta warning is real?** Skip the email. Go to business.Facebook.com yourself and look at your business settings and account status there. **Should I pay someone to get my hacked Facebook Page back?** No. The BBB says only the platform can restore access, and Facebook's own form for hacked Pages is free (BBB). **What do I do first if my Page was taken over?** Submit Facebook's form for hacked Pages, then secure your login and dispute any ad charges with your bank (Meta, FTC). **Where do I report a Facebook business phishing scam?** Forward it to phish@fb.com and report it at ReportFraud.FTC.gov (Meta, FTC).