Friday morning, the person who runs your Facebook page gets an email. The subject line says your page's visual language is under formal review. There is a paragraph about branding policy, a case number, and a button that says Verify Content. Near the bottom, a line about deadlines.
Most people I talk to would forward that to the owner and ask what to do. That is the right instinct. The wrong move is the reasonable-looking one: clicking the button, because the form behind it looks exactly like Meta.
The form asks for things a password reset never asks for
Here is what the form wants. Your full name. Your personal email. Your business email. Your phone number. Your date of birth. Then, further down, your password.
Notice the first five. None of them is a secret. Your birthday is printed on your driver's license. Your phone number is on the side of your truck. That is why the form works. It feels like a records update, not a robbery.
Now read that same list again as somebody who intends to take your page and keep it.
Those fields are not verification. They are inventory.
Researchers who pulled apart this exact campaign found the same thing. Cofense, which tracked the kit behind these emails across nineteen countries, noted that some of the requested information looks unnecessary on an appeal form, then explained why it is there anyway. It "could help them disrupt Meta's account recovery process."
Read that slowly. The birthday is not there to confirm who you are. It is there so that later, when you try to prove who you are, the proof does not work.
That is a different kind of theft than most people picture. Nobody is guessing your password. They are collecting the answers to the questions a support team will ask you three weeks from now.
Your page doesn't belong to your business. It belongs to a person.
This is the part almost nobody knows, and it is why the form is so effective.
Access to a business page runs through somebody's personal Facebook profile. Meta's own security team has described how that gets used: financially motivated groups "often first go after the personal accounts of people who manage or are connected to business pages and advertising accounts." Once inside one personal account, they add themselves as an admin of the page.
So the security of your business page is the security of the weakest personal account on the admin list. If your bookkeeper set up the page in 2016 with a password she also used on three other sites, that is your page's security posture. Not the password you think of as the business one.
Then the phone call
A week later, the phone rings. Someone says they are from Meta support. They know your name. They know the page name. They read back your email, confirm your phone number, and mention the case number from that email.
You already gave them all of it. That is the entire trick. The follow-up call does not have to be convincing on its own. It only has to sound like your own information being read back to you.
What it actually costs
A taken page is not a marketing inconvenience. It is your storefront, your reviews, your follower list, and the place customers message you to ask whether you are open. Whoever holds it can post offers in your name, run ads on your ad account billed to your card, and message your customers directly.
This is not a corner of the internet. In 2025, nearly 30 percent of people who reported losing money to a scam told the Federal Trade Commission that the scam started on social media, and more of them named Facebook than any other platform. The FTC published that data in April 2026.
Recovery is the hard part. Once somebody else is an admin, you are asking a platform to choose between two people who both claim the page, and the other person is holding the details you handed over.
The check that takes two minutes
Before you appeal anything, log in the way you always do. Type the address yourself or use a bookmark.
Then look in Business Suite for Account Status or Account Quality.
If there is a real problem with your page, it is there. It will still be there tomorrow. If the only place this problem exists is an email with a button and a deadline, the problem is the email.
What's worth doing this week
Write down the Page ID, the ad account ID, the business portfolio ID, and the email address of every admin. Keep that somewhere you can reach without logging in. If you are ever locked out, you cannot look it up from inside.
Then open the admin list and look at it. Remove anyone who should not be there. Every person with admin access is a door.
Turn on two-factor authentication on the personal accounts of everyone who can touch the page. Not just the account you think of as the business one. That is where the break-in happens.
Put a spending limit or a payment alert on the ad account, so an unfamiliar charge arrives as a text message instead of a line on a statement.
And give your staff one rule they can actually remember. Anything that arrives with a deadline and a button gets checked somewhere you navigated to yourself.
The part that matters
The email is not the emergency. It is the setup for one, and the setup is quiet on purpose. What saves a business here is usually somebody pausing long enough to open the app and look, instead of clicking.
A page you cannot log into is not a marketing problem. It is the one phone call you cannot make, on the day you most need to make it.