Meta ‘unusual activity’ scam targets Facebook users with supposed PDF attachment

In 2026, Facebook users warned of a phishing scam involving an alleged Meta notice in a Messenger chat message from a misspelled “Meta Verrified” user, a claim of “unusual activity on your account,” a 24-hour countdown threat and a purported PDF attachment.

(Kelly Sue Street accessed via Facebook)

 A Meta spokesperson told Snopes the company’s team was aware of these types of phishing campaigns and is investigating the scam links we sent over, saying they will take action on content that violates policies. The company also urged users to report scam content by clicking the three-dot icon next to posts and messages and then selecting the “report” option.

We located no information suggesting Facebook or Meta notifies users via a Messenger chat message of a 24-hour countdown prior to account disablement. The company informs users of a locked or disabled account via an email and upon a user’s attempt to login.

The term “phishing” refers to the fraudulent act of tricking internet users into revealing sensitive information such as website login details for illicit use.

How the Facebook PDF phishing scam works

The scam begins with a message on Messenger from a user posing as an official Meta representative, usually the misspelled name “Meta Verrified” (as opposed to “Meta Verified”). The message might begin with the words “Meta Alert,” “Meta Announcement” or “Special Notice from Meta.” Four sentences follow, with each line displaying an emoji. For example:

🚨 Meta Alert

🔒 We’ve received reports of unusual activity on your account, such as harassment or impersonation, or posts containing content or images that violate our copyright policies.

🔍 If you believe this is a mistake, please verify your identity to ensure you are the account owner and are not violating Meta’s Terms of Service.

🔗 Please verify your account using the file attached below.

⛔️ If you fail to complete the verification process within 24 hours, your account will be permanently disabled.

The message ends with a supposed PDF or a link designed to appear like an attachment. For example, posts showed the file names “Facebook_Acconunt_Support_Center_Help 2026.pdf,” “Sc 14785 Help Center 2026.pdf,” “Facebook-Acconunt-Support-Help-Center-15.pdf” and “Facebook_Account_Support_Center.pdf.”

Snopes did not independently verify what happens when a user clicks on the PDF notice, including finding out whether a file downloads or if a user’s browser opens a link. Similar scams impersonating Meta and Facebook prompt users to visit links leading to phishing websites that ask for sensitive data in order to take over accounts. Seeing as the inauthentic Meta message originates from fraudsters, the PDF attachment or link would perform the same basic function.

Facebook advises users who fell victim to account takeover scams to visit facebook.com/hacked, as well as to follow steps to keep their accounts secure. For example, avoid clicking on suspicious links and set up two-factor authentication — an added layer of account security where logging in requires a special code.

Regarding contacting Meta, the company says they do not offer a customer service and support phone number. Facebook warns users against calling scam phone numbers listed in Facebook posts. We located numerous examples of fake numbers appearing both on Facebook and in Google search results, and advise readers to never provide sensitive information over the phone, as well as in emails, text messages and online chats.

For further reading, we previously published a collection of nearly two dozen Facebook and Meta rumors.

Sources