Meta Wants You to Verify Your Identity or Business — Is It Legit, or a Scam?

Both happen, so the safe rule is simple: a real verification request can always be completed inside Meta's own tools — never by clicking a link in an email, text, or DM. Meta does sometimes ask real advertisers to verify their identity or business. Scammers also send fake "verify your account or it will be disabled" messages that are designed to steal your login. You can tell them apart without guessing: ignore the message, open Facebook or Business Manager yourself, and check for the request there. If it's real, it'll be waiting in your account. If it only exists in the email, it's a scam.

Why is Meta asking me to verify at all?

Verification is usually routine housekeeping, not a punishment. Meta asks advertisers and Business accounts to confirm who they are for a few normal reasons:

• Business verification — confirming your business is real (often needed to unlock certain ad features, higher limits, or specific ad categories).
• Identity confirmation — Meta occasionally asks a person to confirm their identity during a security review or when unusual activity is detected.
• Special ad categories — ads about credit, employment, housing, social issues, elections, or politics can trigger extra verification.

None of these require you to reply to an email or hand over a password. Real verification is completed by uploading documents inside Meta's interface.

How do I tell a real Meta request from a phishing scam?

Check the request against this list. Real Meta verification:

• Lives inside your account — you'll see it in Facebook notifications, the Account Quality / Security section, or Business Manager, not only in your inbox.
• Never asks for your password — Meta already knows it; a request for your password is always a scam.
• Doesn't threaten you with a countdown — "your account will be deleted in 24 hours, click here now" is a pressure tactic scammers use.
• Doesn't send you to a non-Meta link — hover over any link; if it doesn't go to facebook.com, business.facebook.com, or meta.com, don't click it.

Phishing red flags to treat as automatic no's:

• An email, SMS, or Messenger DM saying your page/account is "flagged," "restricted," or "about to be disabled" with a link to "appeal" or "verify."
• Sender names like "Meta Support," "Facebook Security Team," or "Business Help" from a Gmail/Outlook/random address.
• Any page that asks for your password, 2FA code, or full card number.
• Poor grammar, mismatched logos, or a login page whose URL isn't Meta's.

Scam tactics change constantly — treat the behavior (asks for password, pressures you, links off-platform) as the signal, not the exact wording.

What should I do if I get a "verify your account" message?

Don't act inside the message. Do this instead:

1. Don't click the link, reply, or forward any documents from the message.
2. Open Facebook or Business Manager yourself — type the address or use your bookmark, don't use the message's button.
3. Look for the request in your account — check Notifications and the Account Quality / Security section. A genuine request appears there.
4. If it's there, complete it inside Meta. If it isn't, the message is fake — delete it (and report it as phishing if you like).

That one habit — verify by opening Meta yourself — defeats nearly every ad-account phishing attempt.

How do I complete a real business verification safely?

Once you've confirmed the request is genuine (it's showing inside your account):

• Go to Business Settings → Security Center / Business Info in Business Manager and follow the verification prompt there.
• Have your legal business name, address, and a matching document ready (Meta accepts things like a business license, utility bill, or official registration — the exact list is shown in the flow).
• Make sure the details you submit match your official records exactly, or it can bounce.
• Upload only inside Meta's interface — never email documents to anyone claiming to be Meta.

What if I already clicked a phishing link or entered my password?

Move fast — this is how accounts get taken over:

1. Change your Facebook password immediately (from a device you trust).
2. Turn on two-factor authentication if it isn't already.
3. Check for logins and admins you don't recognize and remove them.
4. Review your ad account for campaigns or payment methods you didn't add.

If ads you never created are already running, you're likely dealing with a takeover — see our guide on recovering a hacked account that's spending your budget (#). And once you're back in, harden the account so it can't happen again (#).