Fake Copyright Violation Message: How to Spot It

An email lands with a red banner: your account has "violated copyright", your Page or channel "will be disabled", and you must appeal within 24 hours. Sometimes it arrives as an Instagram DM from an account called "Meta Verification", or as a YouTube video titled like a policy update. You run a small shop or a channel, so the threat feels real.

The short answer: treat it as fake until the real app tells you otherwise. Genuine copyright notices on Instagram, Facebook and YouTube also show up inside the app or YouTube Studio, where you can open them without touching the message. We never ask for your password or a login code, and neither does any platform.

This guide covers how the fake notices look, where the real ones live on each platform, how to report the message, and what to do if you already typed something in.

Last checked: 29 September 2026.

#Is a Copyright Violation Message from Meta or YouTube Real?

Usually not, when it pushes you to a link with a deadline. Meta lists "false claims that you went against our Community Standards" and warnings that something will happen to your account unless you act as typical fake emails (Facebook Help Centre). Real copyright removals do exist, but you can confirm them yourself: Instagram's Account Status, Facebook's Page Status and Account Status, or YouTube Studio's Copyright filter. If the notice is not there, and the email is missing from the platform's recent emails list, delete it and report it. Never enter a password, a login code or card details on a page reached from the message.

#What the Fake Notices Look Like

The wording changes, and scammers write it in English, Bahasa Malaysia and Chinese. People search phrases such as "notis hak cipta palsu", "akaun akan dinyahaktifkan dalam 24 jam" and "版权侵权 假邮件" after seeing one. The shape underneath stays the same:

• An email with a platform logo saying a post broke copyright law and the account will be removed unless you appeal through a button.
• An Instagram or Facebook DM from a profile named after Meta, a "Copyright Team" or "Meta Verification", often with a blue tick in the profile picture rather than a real badge.
• A Facebook Page comment or tag warning the Page will be unpublished, with a link to an "appeal form".
• A YouTube private video shared with you from a channel with an official-sounding name, with a link in the description to a "document".
• An offer of a verified blue badge that needs you to fill in a form with your login details.
• A page that asks for your password, then a login code, then sometimes your date of birth or ID.

Meta's phishing page lists the same warning signs in its own words: threats such as "Do this now or we'll close your account", requests for passwords or account details, language pushing you to click, and messages from people you do not know (Facebook Help Centre).

#Where Real Copyright Notices Appear, Platform by Platform

Every platform in this guide gives you a place inside its own app to see real enforcement. Open the app or type the address yourself, never through the message.

For YouTube, the help page says official copyright strike emails come from no-reply@youtube.com and explain how to resolve the strike. Some removal requests are "scheduled", which gives you 7 days to delete the video and avoid the strike. That real deadline is one reason scammers copy the format. Check it in YouTube Studio, not in the email.

If Instagram really did remove a post for copyright, the process is covered in our guide to a post removed for copyright on Instagram. Instagram says appeal instructions are in the message it sent, and if the account itself is disabled, you appeal by logging in and following the on-screen steps (Instagram help).

#How to Check a Suspicious Message in Five Minutes

1. Do not tap anything in the message, and do not reply. Screenshot it, including the sender address.
2. Open the real app, or type instagram.com, facebook.com or studio.youtube.com into the browser yourself.
3. Look in the places from the table above. No notice there means the threat in the message is not on your account.
4. Check the platform's recent emails list. Facebook shows security emails from the last year at facebook.com/recent_emails/security (Facebook help). Instagram shows emails from the last 14 days under "Accounts Center", "Password and security", "Recent emails" (Instagram help).
5. For a Google or YouTube warning, open myaccount.google.com/notifications yourself to see recent security activity (Gmail help).
6. Still unsure? Report it and move on. A real notice will still be in the app tomorrow.

#Why a Real Sender Address Is Not Enough

Check the address, but do not let a correct one settle it. Meta says its emails come only from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, metamail.com and global.metamail.com, or their subdomains, and warns about misspelled versions (Facebook help). Instagram's hacked account page names security@mail.instagram.com as the sender for email change alerts (Instagram help). YouTube says legitimate emails come only from @youtube.com or @google.com (YouTube help).

Three things still go wrong. A display name such as "Instagram Copyright" can sit on top of any address, so tap the name to see the real one. Meta has warned that scammers sent Business Manager partner requests containing phishing links through its own facebookmail.com domain (Facebook help). And Google says phishers share private YouTube videos from channels with official-looking names, which is why the email arrives from a genuine YouTube address; YouTube says it never contacts creators that way (Google help). The in-app check is what decides it.

#Red Flags: What the Message Says and What Is Really True

#Fake Blue Badge and Verification Forms

Some messages skip copyright and promise a verified badge instead, or say you must "verify" to avoid losing one. Meta Verified is a paid subscription you start inside the app: you choose the profiles, set up payment and confirm your identity, and Meta says Advanced Protection needs to be on (Facebook help). There is no route where a stranger sends you a form, collects your password and hands you a badge. Anyone offering that wants the account.

#What to Do If You Only Opened the Message or Link

Opening an email is low risk on its own. If you tapped the link but typed nothing, close the page and do not go back. If the link downloaded a file, delete it unopened; Google's warning about fake creator videos says such links can install malicious software (Google help). Then open the real app and check Account Status and the devices logged in, just to be sure.

#What to Do If You Entered Your Password or a Code

Act straight away, from the real app or a browser where you type the address yourself. Attackers often use a stolen code within minutes.

1. Change the password of the account you typed in, and of your email account if it uses the same one.
2. Log out of all sessions you do not recognise. Instagram's phishing page advises resetting the password and logging out of devices you don't own (Instagram help).
3. Turn on two-factor authentication. YouTube recommends 2-Step Verification with a passkey as the strongest protection against phishing (YouTube help).
4. Check that the email and phone number on the account are still yours, and remove linked accounts or third-party apps you do not recognise.
5. For YouTube, check channel permissions and remove anyone you did not add.
6. If you are already locked out, go to instagram.com/hacked or facebook.com/hacked, or Google's account recovery for a YouTube channel.

Our step-by-step guide on what to do after clicking a phishing link goes further, and if a creator channel is already taken, see how to recover a hacked YouTube channel.

#How to Report a Fake Copyright Message

• Meta: forward suspicious Facebook emails to phish@fb.com, or use the report links in Facebook (Facebook help). Businesses can check Meta Business Support Home for real issues.
• Instagram: forward suspicious emails to phish@instagram.com (Instagram help), and report the DM or profile inside the app.
• Gmail: open the message, tap the three dots next to Reply and choose "Report phishing" (Gmail help).
• YouTube: report the video or channel that shared the fake notice through YouTube's report option.
• Malaysia: report the phishing site or email to CyberSecurity Malaysia's Cyber999 by online form, email or its app. Cyber999 asks for the email header and time of the attack if you have them.

#If You Paid or Shared Bank Details in Malaysia

Some fake notices end with a "verification fee" or a card form. If money moved, call your bank's 24-hour hotline or the National Scam Response Centre on 997 as soon as you notice, then make a police report at the nearest station within 24 hours. The NSRC FAQ says to contact the bank or 997 first, lists the evidence to bring (the scam URL, messages and transaction details), and says there is no guarantee the money comes back (NFCC, About NSRC). It also says NSRC, PDRM, MCMC, BNM and banks will never ask for your password, PIN, TAC or OTP.

#Mistakes That Turn a Fake Notice into a Real Lockout

• Trusting the email because the sender address looked right, without checking the app.
• Typing a login code "to prove ownership". The code is what lets the scammer in, even with two-factor authentication on.
• Signing in with Google from a pop-up on a copyright page. YouTube's advice is to enter your Google password only on myaccount.google.com.
• Deleting the message before taking a screenshot of the sender and link, which you need for reports.
• Changing only the social media password while the email account behind it stays open to the attacker.

#When a Case Review Makes Sense

Most readers can finish here: the message was fake, it has been reported, and the account is locked down. It is worth a second opinion when you typed a password and now see changes you did not make, when a business Page or channel is tangled up with a real strike, or when you cannot tell which notices are genuine. AwareXone, AwareXone's recovery and account security service, reviews the situation first and tells you plainly whether you need us at all. You can see how our account security work runs, and our Trust Center explains what we never ask for, starting with your codes.

#Frequently Asked Questions