A message arrives that seems to come from Facebook or Instagram: your page has violated a policy and will be disabled within 24 hours unless you “confirm” your account or file an appeal. For anyone who runs a business page, the threat is alarming — and that is the point. It is a phishing scam built to steal the login to your page. Our GetMyPassword team explains how to recognize a fake page violation scam.
How the scam works
You get a notification, message, or email claiming to be from the platform’s “support” or “policy” team, warning that your page has infringed community standards, copyright, or terms and faces removal unless you act now. A link leads to a convincing but fake “appeal” or “verification” form that asks for your login, password, and the two-factor code. Some versions arrive as comments or tags from hacked accounts. Once you enter your details, the scammers seize your page — locking you out, running scam ads, or demanding a ransom to return it. The “violation” is invented; the deadline exists only to rush you.
Red flags to watch for
- An urgent deadline — your page will be disabled in hours unless you act.
- A link to “appeal” or “verify” rather than the platform’s own settings.
- A sender or page that is not the official support channel.
- A request for your password or two-factor code on a linked form.
- Messages from tagged or commenting accounts that look hacked.
How real policy notices work
Genuine platform notices appear inside the app or your account’s official support and quality tools, not as a surprise link demanding your password. Real support never asks for your password or your two-factor code, and any genuine appeal happens through the platform’s own built-in process. If you are unsure whether a notice is real, ignore the link and open the app yourself to check your account status and any support messages. A “violation” that can only be resolved by logging in through a link someone sent you is phishing, no matter how official it looks.
Real policy notices live inside your account, not in a link with a countdown. The platform will never ask for your password or code to “save your page” — that request is the theft itself.
How to protect yourself
Never log in or share a code through a link in a violation message; check your account status inside the app instead. Turn on two-factor authentication for your page and personal account, and add backup admins so no single login is a single point of failure. If you clicked and entered details, change your password immediately and review active sessions and page roles. Protect every account with a unique password from our password generator, so a captured password cannot unlock more.
Frequently asked questions
Is a “page violation” message a scam?
An urgent message with a link to “appeal” or “verify” your page, asking for your login or two-factor code, is almost always a phishing scam. Real policy notices appear inside the platform’s official tools, not as a surprise link with a deadline.
Does the platform ask for my password by message?
No. Genuine support never asks for your password or two-factor code, and appeals happen through built-in processes. Any message requesting them is impersonating the platform to steal your page.
What if I already entered my details?
Change your password immediately from the official app, review active sessions and page admin roles, and remove anything unfamiliar. Turn on two-factor authentication and report the compromise to the platform to recover your page.