My friends are getting scam messages from my Facebook account

Someone rings to ask about the odd message you sent, and you have not sent anything. This is usually the first sign, and it means one of two quite different things: either somebody is inside your real account, or somebody has copied your profile and is messaging your friends from a fake one. The fix is different for each, so the first job is telling them apart, which takes about a minute.

Last checked: 15 August 2026. Every official Facebook, Instagram and Australian government link on this page was opened and confirmed working on that date. If you find one that no longer works, please tell us and we will fix it, because a dead link on a page like this is worse than no page at all.

Which of the two is it?

Open Messenger and look at your own sent messages. If the strange messages are there in your conversation history, somebody is inside your real account. If your sent messages look completely normal, and friends describe receiving a fresh friend request from a second profile using your name and photograph, then your account is fine and somebody has made a copy of it.

If somebody is in your real account

You can still log in, which means you can end this yourself in about ten minutes. Do it now rather than this evening, because they are using it while you read.

Signing out of other sessions is the step that actually stops it. Changing the password on its own does not always end a session that is already open, so the messages can carry on going out while you assume you have fixed it.

1. Change the password, and change it anywhere else you used the same one. If that password was also on your email or your banking, those come first, before the social account.
2. Check the recovery email address and phone number on the account and remove anything you do not recognise. This is the step people skip, and it is the reason accounts get taken a second time a week later.
3. Sign out of all other sessions, so a device the attacker is still holding gets kicked off.
4. Turn on two factor authentication, so a stolen password on its own is no longer enough.
5. Look at what was posted or sent while they had it, so you know what your friends and family received.
6. Tell the people who were messaged, ideally somewhere other than the account that was taken.

If it is a copy of your profile

Cloning needs no hacking at all. Somebody saves your profile photograph and your name, makes a new account, and sends friend requests to the people on your list, who reasonably assume you have made a new account. Then the requests for money start.

Then post once on your real account telling people a fake exists, and ask them not to accept a second request from you.

How to warn people properly

• Use a different channel. A text message or a phone call, because a message from the account itself may be from the attacker.
• Be specific about money. The usual approach is an urgent request for help, a payment, or a gift card. Say plainly that any such request is not from you.
• Warn them about codes. Tell them never to pass on a verification code, however convincingly you appear to be asking. That code takes their account next.
• Mention the grant and prize messages. Fake competition wins and government payment offers are the most common script, and they work because they arrive from a friend.

If a friend has already sent money

Tell them to ring their bank straight away, today, because the window in which a payment can sometimes be stopped is measured in hours. Then Scamwatch and ReportCyber. None of that is your fault, and it is worth saying so to them, because people are often embarrassed enough to stay quiet, which only helps the person who did it.

Related pages on this site

• Start at the router , if this is not quite your situation.
• There is no Meta phone number , and what the numbers really are.
• Paid recovery services , why none of them are real.
• The full Facebook page .
• How to spot a scam , the general guide.
• Is this message a scam , a 30 second checklist.