What is the Facebook Page Has Infringed Copyright Information scam

The “Facebook Page Has Infringed Copyright Information” emails and Messenger messages are part of a phishing campaign that aims to hijack users’ both personal and business Facebook accounts. Hijacked accounts are used to spread this phishing scam further and take over more accounts.

 

 

In the last couple of months, Facebook users have started getting emails and Facebook messages, seemingly from Facebook, about supposed copyright violations. The message, purposely made to look like it was sent by Meta (the owner of Facebook), explains that users need to verify their accounts by clicking on the link and providing their information. According to the message, if users do not follow the instructions, their accounts will be blocked.

Dear admin page!
POLICY PAGE!
Your Page has infringed copyright information!
Your account has been detected in violation of our current copyright policy. For security reasons and to prevent permanent deactivation of your account, follow these steps. In more serious cases, we will cancel your report immediately. If you do not confirm, our system will automatically block your account.
Verify these related accounts: –
Thank you for helping us improve our account services.
FB copyright team integration.
The pages marked below are copyright infringers.

This email/message is part of a phishing campaign that aims to hijack users’ Facebook accounts. When users click on the link in the email/message, they are taken to a fake Facebook page that displays a message saying that their accounts have been restricted. The notification claims that the account will be locked if no action is taken within 48 hours. A “Verify Account” button is displayed, and if clicked, it will take users to a fake Facebook login page. If users try to log in with their legitimate credentials, the credentials will be immediately sent to the malicious actors operating this phishing campaign.

When a phishing attack is successful, the malicious actors immediately hijack the Facebook account. The email address, phone number, password, etc., is changed to prevent users from being able to recover their accounts. The account’s name is also changed to “Meta Copyright Infringement” so that the attacker can message other accounts with the same messages and try to phish their login credentials.

Once a Facebook account is hijacked, it’s notoriously difficult to get it back if all the information has been changed. Furthermore, if the hijacked account is reported enough times for malicious activities, Facebook will eventually block it for violations of its policies. Once blocked by Facebook, it will be practically impossible to get it back because the appeal process is very slow. Users who fall for this attack end up losing access to not only their personal accounts but also business pages connected to the accounts.

The Facebook Page Has Infringed Copyright Information phishing emails and messages look fairly legitimate. Some phrasing may sound awkward but there are no obvious grammar or spelling mistakes, which makes the attack quite sophisticated. It uses the typical tactic of creating a sense of urgency to force users to act without questioning the situation too much. By claiming that their account will soon be disabled permanently if no action is taken, the attackers force the user to take action and disregard all security advice they may have read in the past.

How to recognize a phishing attack?

Depending on who the target is, phishing attacks can range from very obvious to highly sophisticated. Generic phishing attacks that target a large number of users at the same time are usually much easier to identify because they do not have any personal information. Low-effort ones are also full of grammar and spelling mistakes, which makes them immediately obvious.

More sophisticated ones like this “Facebook Page Has Infringed Copyright Information” do not have grammar/spelling mistakes but they are usually not difficult to identify if you know what to look for.

One of the first things to check when you receive an email asking you to perform some kind of action is to check the sender’s email address. The Facebook Page Has Infringed Copyright Information phishing email was sent from a random-looking address, one that Facebook certainly does not use. Even when an email address looks legitimate, you should always research it with a search engine to see whether it’s used by the company the sender claims to be from.

When you receive an email that asks you to click on a link, do not blindly click on it. Even if it initially seems legitimate, hover over it with your mouse and the real URL will appear at the bottom. In “Facebook Page Has Infringed Copyright Information” phishing emails, it’s not until you hover over the link that it becomes obvious it’s a phishing attempt. Ideally, if an email asks you to fix something in your account, do not click on any links and instead access the account manually. If there’s an actual issue, you will know when you log in.

When you are asked to log in anywhere, always check the URL first. Phishing sites are made to closely resemble legitimate sites to the point where they may look identical. However, the URL is what will always give away a phishing site. If the URL looks even remotely suspicious, do not type in your login credentials.