That Email From Facebook Is Real — But the Request Inside It Is a Scam

We got an email this week from [email protected]. It was real. Facebook actually sent it.

But what it was asking us to do? That was a scam.

The email said we'd received a "Business Manager partner request." It used Meta's branding, came from a real Facebook email address, and looked completely official. If we'd clicked through and approved it, we would have handed a stranger access to our Facebook Page, our ad accounts, and our business data.

This is happening to small businesses everywhere right now, and the reason it works so well is that the email really does come from Facebook.

How the Scam Works

Facebook has a feature called Partner Sharing inside Business Manager. It's meant for legitimate collaboration. Say you hire a marketing agency to run your ads. You'd use Partner Sharing to give them access to your Page and ad account so they can do their job.

Scammers figured out they can abuse this system. They create a Facebook Business account, give it an official-sounding name, and fire off partner requests to real businesses. Facebook sends the notification email on their behalf, because that's how the system is designed to work.

The request we received came from an account called "MetaForBusiness." That name is not an accident. It's designed to make you think Facebook itself is reaching out.

But here's the giveaway. Buried in the email, Facebook includes this disclaimer:

"Meta Partner Support m.me/partnerplatformprogramagency you is not part of or affiliated with Meta. Only approve requests and invitations from people and businesses that you know and trust."

Facebook is literally telling you this requester is not them. But most people skim emails. Most people see "MetaForBusiness" and assume it's official. That's what the scammer is counting on.

What Happens If You Approve It

If you click through and approve the partner request, you're giving the scammer access to your business assets. That means:

They can control your Facebook Page. Post as your business, change your settings, remove your admin access entirely. Some scammers lock you out of your own page and demand payment to give it back.

They can access your ad accounts. That means they can run ads using your payment method. You wake up one morning to hundreds of dollars in charges for ads you never approved, promoting products you've never heard of.

They can see your data. Your Facebook Pixel, your custom audiences, your website visitor data. All of it becomes accessible to someone you've never met.

None of this requires your password. That's what makes Partner Sharing dangerous when it's abused. You're not getting phished in the traditional sense. You're granting permissions through Facebook's own tools.

How to Spot It

The tricky part is that this isn't a fake email. There's no spoofed sender address. No sketchy link to a lookalike domain. Facebook genuinely sent this because someone genuinely submitted a partner request through their system.

So you have to look closer.

Check the requester's name. Do you recognize them? Did you hire them? If you didn't initiate a business relationship with whoever is requesting access, decline it. Period.

Read the disclaimer. Facebook tells you right in the email whether the requester is affiliated with Meta. In our case, they said the requester was not part of or affiliated with Meta. That's a big red flag when the account is named "MetaForBusiness."

Don't click links in the email. If you want to check on the request, go to business.facebook.com directly by typing it into your browser. Look at pending requests there. This way you avoid any risk of landing on a phishing page, even though in this case the email itself is real.

Watch for urgency. Facebook even warns you in the email: be cautious of messages that use urgent or threatening language. If something says your page is at risk and you need to act now, slow down.

What to Do If You Get One

Ignore it. Or better yet, go to Meta Business Suite and decline it. Report the business account that sent the request. Then delete the email and move on with your day.

Do not approve partner requests from businesses you don't know. It doesn't matter how official the name sounds.

Not Sure If Something Is a Scam? Send It to Us.

We know this stuff is confusing. When the scam email comes from a legitimate sender, it's genuinely hard to tell what's real and what isn't. That's by design.

If you ever get an email, text message, or even a letter in the mail that feels off, send it our way. We'll take a look and tell you if it's legit or not.

We don't charge for this. It takes us a couple of minutes, and it could save you from losing your Facebook page, your ad spend, or worse. Just forward it to [email protected] or give us a call.

Small businesses deal with enough without having to become cybersecurity experts. We're happy to be the people you check with before clicking something you're not sure about.

Got a suspicious email, text, or piece of mail? Forward it or snap a photo and send it to [email protected]. We'll tell you if it's legit. No charge, no strings attached.