Real or fake Meta email? How to check a message from Instagram or Facebook support

A real email from Meta comes from one of six domains (fb.com, facebook.com, facebookmail.com, instagram.com, meta.com or metamail.com) or a subdomain of one of them, and it also appears in the Recent emails list inside your Instagram or Facebook settings. That second check is the one that settles it. If a message about your account is not listed there, or it reached you as a DM, a text or a WhatsApp chat, treat it as fake and do not click anything in it.

Scammers know that most people check the sender name and nothing else, so the sender name is the part they always get right. This guide covers the checks a fake cannot pass.

The short answer

• Domain check: Meta says its emails come only from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com or metamail.com, or their subdomains. Anything else is not Meta.
• In-app check: Accounts Center, then Password and security, then Recent emails. If the email is not listed, Meta did not send it.
• Channel check: Instagram says it never contacts you about account security through Direct Messages. No Meta help page we checked describes copyright or appeal notices sent by WhatsApp.
• Appeal results: Instagram sends a push notification and shows the decision in Account Status and Support Requests. You never need an email link to read it.
• Already clicked? Change your password from inside the app, not from the link, and check where you are logged in.

The check that settles it: Recent emails

Both apps keep a record of what Meta actually sent you, and a scammer cannot add anything to it.

On Instagram, go to Settings, then Accounts Center, then Password and security, then Recent emails, and pick your account. Instagram’s page on reviewing recent emails says the list shows official emails from the last 14 days, with security and login emails under Security and everything else under Other.

On Facebook, go to Settings and privacy, then Settings, then Accounts Center, then Password and security, and under Security checks select Recent emails. You can also open facebook.com/recent_emails/security directly. Facebook’s page on checking whether an email is really from Facebook says the Security tab shows security emails from the last year, and the Other emails tab shows other emails from the last two days.

Two limits are worth knowing. Facebook says it may hide a special link or security code in the settings copy, so the list confirms an email exists but you may still need your inbox to act on it. And the list only covers your own account: for an older message, or one about an account you cannot log into, fall back to the address check below.

Which addresses real Meta emails come from

Meta’s Account Recovery Hub and Facebook’s help page give the same rule: correspondence from Facebook, Instagram or Meta comes only from these domains or their subdomains (such as support.facebook.com or business.fb.com):

• fb.com
• facebook.com
• facebookmail.com
• instagram.com
• meta.com
• metamail.com

Instagram’s own page names the specific addresses it uses for account security: @support.facebook.com, @support.instagram.com, @facebookmail.com, @mail.instagram.com and @global.metamail.com. The best known is security@mail.instagram.com, which Instagram says it uses when the email on your account is changed, with a link to reverse the change.

How to read an address correctly:

• Read the end of the address, not the start. In security@mail.instagram.com the domain is instagram.com, which is fine. In support@instagram.com-appeals.net the domain is com-appeals.net. In meta.support.team@gmail.com it is gmail.com. Neither of those is Meta.
• Ignore the display name. “Meta Support Team” or “Instagram Copyright” can be typed by anyone. The address behind it is what counts.
• Watch for misspellings. Facebook warns specifically about misspelled versions of its domains: an extra letter, a swapped letter, or “rn” standing in for “m”.
• Treat the logo as a bonus. Facebook says that in Gmail, Yahoo Mail or Apple Mail you can trust an email that shows the Facebook logo next to the address. A missing logo proves nothing either way, so use Recent emails.

What the fakes say

Facebook’s page on suspicious emails claiming to be from Facebook lists the usual disguises: false claims that you broke the Community Standards, claims that a business is not complying with advertising or commerce policies, warnings that something will happen to your account unless you act, and offers that sound too good to be true. Instagram’s phishing page adds messages claiming your account will be banned or deleted if you do not follow their directions.

In the cases we see, three templates cover most of them:

1. The copyright notice with a 24 or 48 hour deadline and an “appeal” button.
2. The verification offer, promising a badge if you confirm your details on a form.
3. The fake appeal team, writing after a real disable and offering to restore the account.

All three end at a login page that is not Instagram’s or Facebook’s. Facebook says it will never ask for your password in an email or send you a password as an attachment.

What email does an Instagram appeal come from?

This is one of the most searched questions about Meta emails, and the honest answer is that you should not be waiting for an email at all. Instagram’s page on requesting a review says you get a push notification once a decision is made, and you can check the status at any time in Account Status or in Support Requests (profile menu, then Help, then Support Requests, then Violations). The Instagram help pages we checked do not name a separate sender address for appeal results.

So if an email says your appeal was approved or rejected, open the app first. If the decision is there, the email adds nothing. If it is not there, the email is fake, however official it looks. Facebook works the same way: its Support Inbox holds account alerts and messages from Facebook. Our guide to contacting Instagram support lists the channels that do exist.

“Instagram copyright violation” on WhatsApp

A WhatsApp message from an unknown number, claiming to be Instagram’s copyright or legal team, is a scam. Meta’s own pages make that clear:

• Instagram says it will never reach out about account security through Direct Messages, and that its account security emails come from the addresses listed above.
• The Instagram help pages we checked mention WhatsApp in one official role: delivering two-factor login codes, and only if you chose WhatsApp as a security method yourself.
• WhatsApp’s page on suspicious messages and scams lists the warning signs, and this message shows several: a link to tap, a request for login details, and a sender posing as a well-known company.

Do not reply and do not tap the link. If a login code arrives a few minutes later, do not forward it to anyone. Report the sender and block the number from the chat. Our breakdown of the copyright phishing kit shows what happens after the click.

If you already clicked

If you typed your password into the page behind the link, act while you can still log in:

1. Open the Instagram or Facebook app directly and change your password there, never through a link in an email.
2. In Accounts Center, open Password and security, then Where you’re logged in, and log out any device you do not recognize.
3. Check that the email address and phone number on the account are still yours.
4. Turn on two-factor authentication, preferably with an authentication app, which Instagram recommends.
5. Check Recent emails for changes you did not make. A real “your email was changed” message from security@mail.instagram.com contains a link to reverse the change; use it immediately.

If you are already locked out, the official route starts at instagram.com/hacked or facebook.com/hacked. Our guide to recovering an Instagram account after the email was changed walks through it in order.

Reporting the fake

Instagram asks for suspicious emails to be reported to phish@instagram.com, and Facebook to phish@fb.com. Reporting will not change anything on your own account, but it helps Meta block the next wave. Then delete the email.

When to get help

If you received a fake email and did not click, you do not need help: delete it and move on. If you entered your password, lost access, or the attacker has already changed the email or turned on their own two-factor, that is a takeover, and the order of the recovery steps starts to matter. Our hacked account recovery service starts with a free case review. We work only through Meta’s official recovery channels, we never ask for your password, and we cannot promise an outcome, because the decision is Meta’s.