Verify a social media account recovery message

Short answer: Check whether an account recovery alert is genuine before following a link or sharing a security code.

Pause before the irreversible step

A direct message claims your profile will be disabled unless you appeal through a supplied form. The useful question is not whether one detail looks convincing. It is whether the identity, channel, context and requested action agree when checked independently.

Read the context, not one clue

Read these observations together. One item may have an innocent explanation, while several mismatches can justify stopping before money, access or personal information changes hands.

The warning arrives through a personal account

The warning arrives through a personal account. This matters because the visible message may be controlled by the same person asking you to trust it. A useful counter-check is to open the platform from your usual app.

The link uses a lookalike sign-in page

The link uses a lookalike sign-in page. This matters because the visible message may be controlled by the same person asking you to trust it. A useful counter-check is to review active sessions and security notices.

The sender requests a recovery or two-factor code

The sender requests a recovery or two-factor code. This matters because the visible message may be controlled by the same person asking you to trust it. A useful counter-check is to change credentials from account settings if needed.

The deadline leaves no time to check settings

The deadline leaves no time to check settings. This matters because the visible message may be controlled by the same person asking you to trust it. A useful counter-check is to report the sender through the platform.

Checks you can repeat

Use a route that does not depend on the contact, link, attachment or account being assessed. Preserve the original evidence first when fraud, account compromise or a payment dispute may need to be reported.

1. Open the platform from your usual app.
2. Review active sessions and security notices.
3. Change credentials from account settings if needed.
4. Report the sender through the platform.

For a broader check, continue with the pause, verify, decide checklist.

What each check tells you

Practical takeaways

• Pause before the requested action becomes difficult to reverse.
• Verify the person or organization through contact details you found independently.
• Keep records of the request, your checks and any transaction or account change.
• Escalate to the relevant provider or authority when money, identity or active access is at risk.

Where uncertainty remains

Even a real alert does not require sending a one-time code to another person. The purpose of this review is to choose a safer next action, not to label a person or message with certainty. Conditions, platform controls and legal rights vary, so use the relevant provider or authority for a high-consequence decision.

Official guidance

FTC phishing guidance provides primary guidance related to this topic. Procedures can change, so use the source for current reporting or recovery steps.