Facebook is now 20 years old and is the most popular social media platform with nearly three billion users. It is the third most visited website and more than a billion people connect with businesses on the platform each week.

Yet, Facebook is a cybercriminal’s dream when it comes to harvesting data. Personal information such as names, locations, birthdays, interests, and connections can provide a hacker with answers to security questions used on other sites. Even something hidden in the backdrop or foreground of business-related photos can present a potential threat. All of which is referred to as social engineering in cyber security terms.

At the WCRC we are seeing first-hand the impact this is having on the Welsh business community. We have received a number of messages through Facebook Messenger over the past couple of months, claiming to be from Meta Business Services, or Facebook Meta, some of which are pictured below.

In each of the messages, there is an accusation that your business has breached Facebook standards, and that the account will be deactivated. In order to prevent this from happening you are instructed to click on the link. It’s fair to say that some of these messages look more genuine than others! We have even had messages telling us our account has now been deactivated, but it’s still remained live!

The most recent Facebook phishing scam we received was a message from a ‘Facebook customer’ claiming that the product they had purchased was faulty. Attached with it was a file which was apparently a video of the faulty item. The WCRC doesn’t sell physical products but if you’re a business who does use the platform to sell items it would be very easy to fall for this. The alleged video most likely would have delivered corrupt software if opened.

It’s understandable that a business owner operating on Facebook would not want their account deactivated and may feel pressured into clicking on the link. By following the link, the criminals will try and harvest login details or dupe you into downloading malware. If you look at the examples above, the link addresses are not consistent with the Facebook domain name. You would expect if it was a genuine message that a link would contain the word ‘Facebook’ or a variation of it such as ‘fb’.

However, and this is crucial, even if the link did contain a reference to Facebook this does not mean the link and/or content of the message is legitimate. So, it is important to be alert as it is a recognised phishing attack, with messages that look like they are from Facebook, making false claims your business has gone against community standards, and/or something will happen to your account if you don't update it or take a certain action. If you are unsure as to whether a message is genuine, don't click on the link.

Remember, Facebook states that it will never ask you for your password in an email or send you an attachment. You can report these attacks to phish@fb.com or through the report links that appear throughout Facebook.

Reporting an attack is free, it only takes a minute and to put it into numbers - as of 31 October last year, the number of reports received stood at more than 25,849,000, with the removal of more than 151,800 scams across 277,900 URLs.

You can report phishing emails to the National Cyber Security Centre by forwarding them to report@phishing.gov.uk.

Do you have a cyber question about your social media or any other area of your business? Please contact the WCRC team. 

For resources, toolkits, regular cyber news, threat updates and more, sign up for the centre’s FREE membership programme.