Meta adds scam warnings to WhatsApp, Facebook and Messenger as account-linking fraud grows

On 11 March 2026 Meta announced new anti-scam protections across WhatsApp, Facebook and Messenger, along with enforcement figures for 2025 and a joint operation against Southeast Asian scam centres. For developers the consumer features matter less than what they show: account takeover through legitimate features such as device linking is now a mainstream fraud technique, and platforms are answering it with risk signals placed at the moment a user is about to approve something.

What happened

Meta's announcement covered three product changes:

• WhatsApp device-linking warnings. If behavioural signals suggest a request to link a new device is suspicious, WhatsApp shows where the request comes from and warns that it may be a scam, so the user can stop before approving it.
• Facebook friend-request alerts (in testing). These flag requests from accounts that share few mutual friends with the user or list a different country, and offer block or reject options.
• Messenger scam detection, expanding to more countries. It warns when a chat with a new contact matches common scam patterns, such as suspicious job offers. Users can choose to share recent messages for an AI review, and they are offered block or report options.

Meta also described AI systems that use text, image and context signals to catch celebrity-bait ads, brand impersonation and lookalike domains. It reported removing more than 159 million scam ads in 2025, 92% of them before anyone reported them, and taking down 10.9 million Facebook and Instagram accounts linked to criminal scam centres. It plans to expand advertiser verification so that verified advertisers account for 90% of ad revenue by the end of 2026, up from about 70%.

Separately, Meta said it supported a disruption operation led by the Royal Thai Police Anti-Cyber Scam Center with the FBI and the US DOJ Scam Center Strike Force, plus agencies from the UK, Canada, Korea, Japan, Singapore, the Philippines, Australia, New Zealand and Indonesia. Thai police arrested 21 people, and Meta disabled more than 150,000 accounts tied to scam-centre networks.

Who is affected

• End users of WhatsApp, Facebook and Messenger. The warnings roll out gradually and vary by country.
• Advertisers, who will face more verification requirements, especially in high-risk categories, ad types that are easier to abuse, or after past policy violations.
• Brands and developers whose names are used in impersonation scams, which Meta says its brand-impersonation detection now covers for "thousands of brands."

What it means for developers and engineering teams

The WhatsApp change addresses a technique worth understanding if you build anything with multi-device sessions. The attacker doesn't steal a password. They talk the victim into handing over a phone number and a linking code, or into scanning a QR code, which adds the attacker's device as a trusted companion session. The victim keeps working normally, so nothing seems wrong, while the attacker reads and sends messages as them. The same pattern shows up as OAuth device-code phishing and QR-login phishing on other platforms.

Meta's response is a useful model: add friction based on risk at the approval step, and show context the user can judge for themselves (where the request comes from) instead of a generic warning. If your product has "link a device", "approve this sign-in" or device-code OAuth flows:

• Show the approving user the requesting device's approximate location, platform and time, and flag it when that doesn't match their usual pattern.
• Keep linking codes short-lived and single-use, and rate-limit attempts.
• Send an out-of-band notice ("a new device was linked") with a one-click revoke, and make the list of linked sessions easy to find.

The friend-request signals (few mutual connections, mismatched country) are simple heuristics, which is why they work: they are cheap to compute and easy to explain to the user.

What to do now

1. Review your own device-linking and sign-in approval flows against the checklist above, especially QR login and the OAuth device authorization grant.
2. Add new-session notifications by email or push, with revoke links, if you don't already send them.
3. If your brand is impersonated in ads, use Meta's brand rights and impersonation reporting channels and monitor for lookalike domains.
4. If you advertise on Meta, complete advertiser verification early to avoid delivery interruptions as requirements expand.
5. Tell your own team to check WhatsApp's Linked Devices list and remove sessions they don't recognise.

Related on TechLogHub

• What is authentication?
• What is OAuth?

Sources

• Meta Newsroom: Meta Launches New Anti-Scam Tools (11 March 2026)
• Meta Newsroom: Global law enforcement agencies, with support from Meta, disrupt Southeast Asian scam networks
• Malwarebytes: Meta rolls out anti-scam tools across WhatsApp, Facebook, and Messenger
• BleepingComputer: Meta adds new WhatsApp, Facebook, and Messenger anti-scam tools