That 'Facebook Protect' notification is real — here's what you need to know

Many Facebook users are getting messages and alerts that they need to upgrade their accounts to something called "Facebook Protect" — or risk being locked out of Facebook altogether.

"Your account requires advanced security from Facebook Protect" reads the subject line of an email message spotted by Android Police. The message goes on to say that Facebook Protect must be turned on by March 17 or "you will be locked out of your account until you enable it."

This may sound like a phishing scam, but it isn't. Facebook really is forcing some users to upgrade the security on their accounts, chiefly by activating two-factor authentication (2FA). Facebook Protect also adds "back-end threat detection so our teams can quickly respond to compromise attempts," as Facebook/Meta head of security Nathaniel Gleicher said in a series of tweets Tuesday (March 1).

Facebook Protect, launched in 2018, was originally meant to be used by political "candidates, their campaigns and elected officials," as a Facebook paper explaining the feature states. 

Now it's being expanded to political activists and journalists, as a Meta blog post authored by Gleicher back in December said. At that time, 1.5 million accounts had already enrolled in Facebook Protect.

If you get such a message, there's an embedded button that takes you to the spot in your Facebook account settings where you can enroll in Facebook Protect. 

Granted, all of this really does sound like a phishing scam. As a rule, we advise people not to click on links embedded in email or social-media messages. It's also possible that real crooks may now send out fake Facebook Protect notifications as part of real phishing scams.

Fortunately, eligible Facebook users can manually enroll in Facebook Protect. According to Nikki Rudd at WHEC-TV in Rochester, N.Y., you just need to follow these steps in a web browser after logging into your Facebook account.

How to enable Facebook Protect

1. Click Account at the top right of the Facebook web page
2. Click Settings & Privacy in the drop-down menu
3. Click Settings in the next page of the drop-down menu
4. Click Security and Login in the left-hand navigation bar
5. Scroll down to Facebook Protect and click Get Started
6. Click Next on the welcome screen
7. Click Next on the Facebook Protect benefits screen

Like Rudd, a fair number of other U.S. TV news reporters are getting the new wave of notifications, to judge by several local-TV pieces from the past few days.

"Your account has the potential to reach a lot more people than an average Facebook user," reads a sample notification posted by Android Police. It adds, "Facebook Protect isn't available for everyone ... We require stronger security for your account because it has the potential to reach a large audience."

That smacked some Twitter users as unfairly exclusionary. 

However, you can turn on most of the benefits offered by Facebook Protect simply by activating Facebook's two-factor authentication option.

How to enable Facebook's two-factor authentication

1. Click Account at the top right of the Facebook web page
2. Click Settings & Privacy in the drop-down menu
3. Click Settings in the next page of the drop-down menu
4. Click Security and Login in the left-hand navigation bar
5. Scroll down to Two-factor authentication and enable it

The easiest way to receive 2FA one-time-use codes is via SMS text messages, but it's also the method that's most likely to have 2FA codes intercepted by hackers. 

We recommend instead installing a free authentication app, such as Authy or Google Authenticator, on your smartphone, which will generate 2FA one-time-use codes right on your phone. Even safer are USB security keys, but you have to buy those before you can use them.