Don’t Trust security@facebookmail.com Unless You Like Malware

Your account may be in danger if you receive emails from security@facebookmail.com — but not for the reason you think. 

Is security@facebookmail.com Legitimate?

Technically, security@facebookmail.com is a legitimate email address that Facebook uses to inform users of potential security issues. In fact, it’s the primary email address for the Facebook Protect service. But don’t let your guard down just yet — hackers can spoof email addresses.

The email could be related to bots, a technical issue on Facebook’s end or threat actors. In all likelihood, it’s probably the last option — Facebook login credentials leak or get stolen all of the time, meaning cybercriminals often try to get into accounts the legitimate way. 

Cybercriminals could also be checking to see who still has an active account, who checks their emails for security alerts or who readily clicks on links. The danger here is that you could get your account stolen or unintentionally install malware onto your device. 

How Can You Tell if the Email Is Legit?

Online searches won’t reveal your email’s legitimacy since security@facebookmail.com is technically legit. While some Facebook users say theirs was real, others claim it’s a scam. The only way to find out for sure is to click on a potentially malicious link, which you don’t want to do.

As we’ve mentioned, you can’t verify the email address since they can be spoofed. The same concept applies to URLs — hovering over them won’t reveal much. Now that hackers have artificial intelligence, you can’t even rely on finding spelling and grammar mistakes. Don’t be lured into a false sense of security because you don’t spot any obvious danger signs. 

Three Ways to Verify the Email’s Validity

There are three ways to tell whether the email is a phishing scam or from Facebook.

1. Follow Facebook’s Warning

Facebook says it will never ask for login credentials in an email. It also says its emails won’t contain links, attachments or buttons to log into your account. If the sender sent you any of those, there’s a good chance it’s illegitimate. 

2. Search Through the Metadata

Checking the email’s metadata can give you insight into whether or not it’s legit. This information is in every email, but it’s hidden unless you explicitly search for it. 

Open, select or right-click the security@facebookmail.com email. To pull up the metadata on Gmail, click the three vertical dots and choose Show Original. On Outlook, click File and Properties. For Yahoo, click the three horizontal dots and select View Raw Message. 

Here, you can view the Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) — email authentication protocols that verify if emails are legit or not. Failed authentication is an indicator of spoofing.

You can also check the sender’s IP address — a VPN can spoof this, by the way — and who the email was delivered to. All that text might be challenging to understand at first, but those little details can help you determine if the email is legit. 

3. Go to Security Settings 

One of the fastest ways to tell if the email you got is legit is to go to your security and login settings. Here, you scroll down to See recent emails from Facebook and click on View. Any security-related emails sent within the last two weeks will be under the SECURITY tab. 

If you don’t see any recent activity but have an email from security@facebookmail.com in your inbox, it’s most likely a phishing attempt. While there’s a small chance it could still be legit — a technical error on Facebook’s end — that scenario is unlikely. 

What to Do About security@facebookmail.com Emails

We recommend not clicking on the email’s links, buttons or attachments, even if you think yours is real. When it comes down to saving a few seconds or protecting your account, the choice is clear. Spending a little longer navigating settings to reset a password or view a recent login attempt is worth the peace of mind. 

You must take action even if you think the security@facebookmail.com emails are actually from Facebook. If they’re real, there’s a good chance someone is trying to brute force their way into your account. Whatever you do, don’t just ignore them. 

Delete the emails and report them as potential phishing if you’re suspicious of them. Then, you should change your password — whether or not you’ve clicked on any suspicious links. If someone’s trying to steal your account, you want to strengthen your defenses. 

First thing first — change your password. If you’re logged in, go to the Security and login tab in your settings, locate the Change Password section and hit Edit. If you aren’t logged in, go to Facebook’s login page, select Forgot Password? and proceed through the instructions. 

Make sure your password is strong enough to protect your account. It should be at least 10 characters long and has a mixture of numbers, symbols and letters. Don’t use words, phrases, dates or sequential numbers because brute-force attacks can crack them faster. 

What If security@facebookmail.com Keeps Emailing?

Blocking security@facebookmail.com ensures every official security-related email from Facebook goes straight to your spam folder — you don’t want that. Instead, you should contact Facebook to ask if the issue is on their end and if they can resolve it. 

You should keep strengthening your security if you keep getting emails from this sender. Either way, someone is likely trying to take over your account. If you use multi-factor authentication, strong passwords or biometrics, there’s a better chance they’ll feel discouraged and stop trying to access your account. 

Should You Delete Your Facebook Account? 

Deleting your Facebook account ensures you won’t have to worry about phishing emails disguised as Facebook ever again. It might be the best choice if you don’t use the site much anymore and are worried a threat actor could steal your login information and impersonate you. 

1. Delete Your Account in Settings 

The first deletion method involves settings. Scroll down to the Account Settings tab and select Personal Details. In the Account Ownership and Control section, click on Deactivation and Deletion. Once you hit Deletion, follow the instructions and confirm your choice.

2. Deactivate Your Account in Settings

If you don’t want to see any more emails from security@facebookmail.com but don’t want to delete your account, consider deactivation — it only temporarily disables your account while preserving your access to Facebook Messenger.

Follow the same steps above, but choose the Deactivate Account option when you get to Deactivation and Deletion. Follow Facebook’s instructions and confirm your choice to temporarily disable your account. 

If security@facebookmail.com Emails Again, Act Urgently

Although there’s a chance security@facebookmail.com is legit, you should never be too careful. Repeat the steps to secure your account we listed above and contact Facebook for help.