Do not use the link. Check the address bar before typing any password, review who holds a role on the Page, remove anyone who no longer needs one, and turn on login approvals for everyone left.

A warning from the security team

The manager who runs a restaurant's Facebook Page opens a message from an account calling itself Facebook Security, complete with a shield and a blue logo.

It says the Page has been reported for breaking the rules and will be removed within 24 hours unless the administrator confirms the account through a link.

The link opens what looks exactly like Facebook's login page. The password typed there goes to whoever built the copy, and with it the Page, its photographs and every follower.

How the trick works

The message borrows Facebook's look and adds a deadline, so the reader acts before thinking. The copy of the login page needs only the password, and the reader supplies it.

The same trick arrives as emails, as Page messages and as comments on the Page's own posts, always with a deadline and a link.

With the password, the sender logs in from anywhere. If that account holds full control of the Page, they can remove every other administrator and lock the owners out.

The Page belonged to the business, but Facebook sees only who holds its roles. Getting it back means proving ownership through Facebook's help pages, which can take a long time.

Signs the message is not from Facebook

These messages vary in wording but share a few marks:

Any one of these is reason to stop. A real notice appears inside Facebook itself, and it does not send you off Facebook to type your password.

Check the address before the password

The address bar is the one thing a copy cannot fake. Facebook's real login page sits on facebook.com, and a copy sits on some other address, however similar it looks.

Better still, do not log in through any link in a message. Type facebook.com into the browser yourself or open the app, then look for any notice about the Page there.

If the password was already typed

Change the Facebook password at once from a computer you trust, and check that the email address on the account is still yours.

In the security settings, end any sessions you do not recognise, then review the Page's roles. Tell the other administrators, so they watch for changes too.

If access is already lost, go to Facebook's help pages for compromised accounts from a different computer, and note what happened and when.

Who holds a role on the Page

Facebook lets several people hold roles on a Page. The top role can add and remove other people; the others can post, reply, run ads or read Page Insights without that power.

Over the years, roles collect: a former manager, a summer student, a photographer, someone who ran one campaign. Each is another password that could be stolen.

Remove anyone who no longer needs a role. Keep the top role for two trusted people, and give everyone else a role that cannot remove administrators.

Turn on login approvals

Facebook's security settings include login approvals. When the account is used on a computer or phone Facebook does not recognise, it will not let anyone in without a code texted to your phone.

A stolen password alone is then not enough. Login notifications, in the same place, send an alert whenever the account is used somewhere new.

Turn both on for everyone who holds a role on the Page, not just the owner. Setting it up takes a few minutes per person, with their own mobile phone in hand to receive the first code.

A worked example

A small modelling agency in Vancouver represents models for catalogue, print and trade show work. Its Facebook Page carries new faces, test shoots and the dates of open calls.

One of its bookers received the shutdown message on a busy afternoon. She clicked the link but stopped at the login page, because the address bar showed an address she did not recognise.

A review of the Page's roles found five people with full control, including a photographer who had left two years earlier and a former assistant. Nobody had login approvals turned on.

The owner and the senior booker now hold the top role. The other bookers post with a role that cannot remove anyone, and the former staff are gone.

Login approvals and notifications are on for everyone with a role. A booker's stolen password could no longer take the Page, and a login from a strange computer now needs a code from that booker's phone.

One rule for everyone with access

Write down one rule and share it with everyone who holds a role: nobody types a Facebook password into a page reached from a message, however urgent it sounds.

Ask them to forward any such message to the owner instead. A second person reading it calmly often spots what the first, in a hurry, did not.

The counter-case

Facebook does remove Pages and posts that break its rules, and real notices do arrive. Ignoring every warning is not the answer.

The answer is to check any warning inside Facebook itself, by opening it directly. A real problem will be there; a fake one exists only in the message.

A business whose owner is the only person with a role is not safer for it. One stolen password then takes everything, which makes login approvals matter even more.

Securing the Page and its roles

  1. Ignore the link in any warning message.
  2. Check the address bar before typing any password.
  3. List everyone who holds a role on the Page.
  4. Remove anyone who no longer needs one.
  5. Keep the top role for two trusted people.
  6. Turn on login approvals for everyone with a role.
  7. Share the rule with everyone who holds a role.

Step six is the safety net. Even when someone is fooled and types the password, a code sent to their phone stands between the stranger and the Page.

A page that quietly copies whatever is typed into it is also the danger that the payment page decides which card questionnaire you fill in describes for online shops.

Frequently asked questions

How can I tell a fake Facebook warning from a real one?

Real notices appear inside Facebook itself. A fake one comes from an account named after the security team, sets a deadline of hours and links to a login page elsewhere.

What happens if I type my password on the copy?

Whoever made the copy can log in as you. If your role on the Page allows it, they can remove every other administrator and take the Page.

What should I do if I already typed it?

Change your Facebook password at once from a trusted computer, check the email address on the account, end sessions you do not recognise and review the Page's roles.

Who should hold the top role on a Page?

Two trusted people who will stay with the business. Everyone else can post, reply and read Page Insights through roles that cannot add or remove other people.

What are login approvals?

A Facebook security setting that requires a code, texted to your phone, whenever your account is used on a computer or phone Facebook does not recognise.

Does Facebook ever remove Pages?

Yes, Pages that break its rules can be removed. Check any warning inside Facebook itself, by going there directly, and never through a link in the message.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure who still holds a role on your Page?

Tell us which Page is yours, and we will walk you through its roles and login settings in one short call.

Start a Conversation