Meta Wants You to Verify Your Identity or Business — Real, or a Scam?

A message lands: your Page will be disabled in 24 hours unless you "verify your business" — tap here. Your stomach drops, because the ads matter to your revenue and the clock is ticking. Here is the calm version: real verification and fake verification both exist, and you never have to guess which one you're looking at. A genuine request can always be finished inside Meta's own tools. So the rule is simple — ignore the message, open Facebook or Business Manager yourself, and check whether the request is actually there. If it's real, it's waiting in your account. If it only exists in the email, SMS, or WhatsApp, it's a scam, and the countdown was the bait.

Why is Meta asking me to verify at all?

Most of the time verification is routine housekeeping, not a punishment. Meta asks advertisers and business accounts to confirm who they are for a few ordinary reasons:

• Business verification — confirming your business is a real, registered entity. This is often what unlocks certain ad features, higher spending limits, or specific ad categories.
• Identity confirmation — Meta occasionally asks a person to confirm who they are during a security review, or when it sees unusual activity on the account.
• Special ad categories — ads about credit, employment, housing, or social and political issues can trigger extra verification before they'll run.

None of these ever need you to reply to a message or hand over a password. Genuine verification is completed by uploading documents inside Meta's interface — and the specific triggers and requirements shift over time, so treat the reason shown inside your account as the real one, and reconfirm anything unclear against Meta's Help Centre.

How do I tell a real request from a phishing message?

Hold the request up against this list. Genuine Meta verification:

• Lives inside your account — you'll see it in Facebook notifications, the Account Quality or Security section, or Business Manager, not only in your inbox or chats.
• Never asks for your password or OTP — Meta already has your password and never needs your one-time code. A request for either is always a scam.
• Doesn't run a countdown — "your account will be deleted in 24 hours, act now" is pressure, not policy.
• Doesn't push you to an outside link — press and hold any link to preview it; if it doesn't go to facebook.com, business.facebook.com, or meta.com, don't open it.

Red flags to treat as an automatic no:

• An email, SMS, WhatsApp message, or Messenger DM saying your Page is "flagged," "restricted," or "about to be disabled," with a link to "appeal" or "verify."
• Sender names like "Meta Support," "Facebook Security Team," or "Business Help" coming from a Gmail, Outlook, or random address or an unknown number.
• Any page or chat that asks for your password, your OTP, or a full card number — the same demand a bank scam makes, wearing a different logo.
• Clumsy grammar, a slightly-wrong logo, or a login page whose address isn't Meta's.

Scam wording changes constantly, so judge the behaviour — does it ask for a secret, pressure you with a clock, or send you off-platform? — not the exact words.

What do I do the moment a "verify your account" message lands?

Don't act anywhere inside the message. Do this instead:

1. Don't tap the link, reply, or forward any document. Nothing you do inside the message is safe, including "just checking."
2. Open Facebook or Business Manager yourself — type the address or use your own bookmark or app. Never use the message's button.
3. Look for the request in your account — check Notifications and the Account Quality or Security section. A genuine request shows up there.
4. If it's there, finish it inside Meta. If it isn't, it's fake — delete it, and report it as phishing if you'd like.

That one habit — verify only by opening Meta yourself — defeats nearly every ad-account phishing attempt going around. It costs you two minutes and it's the single most useful reflex an owner can build.

How do I complete a genuine business verification safely?

Once you've confirmed the request is real — because it's showing inside your account:

• Go to Business Settings → Security Centre / Business Info in Business Manager and follow the verification prompt there.
• Have your legal business name, registered address, and one matching official document ready. In practice that's usually something like a GST registration certificate, a certificate of incorporation or partnership deed, or the registration your business actually runs on — and often a PAN. The exact accepted list appears in the flow and Meta changes it often, so reconfirm the current requirement against Meta's Help Centre rather than trusting a list someone sent you.
• Make sure every detail you submit matches your official records exactly, or the review can bounce.
• Upload only inside Meta's interface. Never email or message these documents to anyone claiming to be Meta. Your registration papers and PAN are personal data — under the DPDP Act that's exactly the kind of information you hand over deliberately and only to the platform itself, never to a stranger who messaged you first.

There's no shortcut and no one who can "fast-track" it for you from outside — anyone offering that is the scam.

What if I already clicked the link or shared my password or OTP?

Move quickly — this is precisely how accounts get taken over — but don't panic; most of this is recoverable if you act now:

1. Change your Facebook password immediately, from a device you trust.
2. Turn on two-factor authentication if it isn't already on, for everyone with access.
3. Remove logins and admins you don't recognise — check where your account is logged in and who has access.
4. Review your ad account for campaigns or payment methods you never added.

If ads you never created are already spending your budget, you're likely dealing with a takeover — recovering a hacked account that's burning your money is its own job, and so is hardening the account afterwards so this can't happen again. The goal isn't to never be targeted; every advertiser is. It's to make sure a message can't cost you the account you built.