A friend messaged me “is this you in this video?” with a link — is it a scam?

Yes — “is this you?” is the hijacked-friend phish, one of the most persistent Facebook scams. The message really is from your friend's account, which is exactly the problem: their account was already stolen by the same message, and the link leads to a fake Facebook login (to steal your password next) or a malware download. Don't click — tell your friend their account is compromised by calling or texting them, then report the message in Messenger.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — August 28, 2026 →

Why you’re seeing this now

Because this phish never dies — it mutates. “Is this you in this video/photo?” keeps appearing in 2026 round-ups of the top Facebook scams, and every stolen account becomes the next wave of bait: the message arrives from someone you trust, which is precisely why it works. The current variants lead to a pixel-perfect fake Facebook login; older ones pushed “video player” malware downloads.

The exact words they use

Quoted from documented versions of this script so you can recognize it on sight. The words are the scammer’s — the patterns inside them are what give the con away.

“is this you in this video?? 😂”

“[A shortened or lookalike link — sometimes wearing a facebook.com costume]”

“[On the page] You must log in to Facebook to watch this video — Email or phone — Password.”

“[Hours later, from your account to all your friends] is this you in this video?? 😂”

Script language quoted for recognition — if the message in your hand reads like this, you already have your verdict.

Five red flags — any one is enough

A link from a friend with no context — curiosity bait with your name on it is the delivery mechanism.

A “video” that requires you to log in first — real Facebook content never re-asks your password through a message link.

A shortened or misspelled URL, or a domain that only looks like facebook.com at a glance.

The same message arriving from multiple friends — each one is a freshly stolen account.

A “video player update” or app download offered so you can watch — that's the malware variant.

Your next three moves

Don't click. Tell your friend their account is sending scam links — by phone or text, on a channel the scammer doesn't control.

Report the message inside Messenger and delete it.

If you already clicked and entered your password: change your Facebook password immediately from the official app, turn on two-factor authentication, check your logged-in sessions for devices you don't recognize, and warn your own friends — your account may already be sending the same message.

Why would my friend send me a scam link?

They didn't — their account did. The whole point of the phish is that it propagates through trust: each stolen account messages all its friends, and the bait arrives from someone you'd never suspect.

I clicked the link but didn't type anything — am I safe?

Usually, yes — the steal happens when you enter your password or run a download. Close the page, install nothing it offered, and run a scan if you downloaded a “player.”

I entered my password — how bad is it?

Treat the account as compromised: change the password now, enable two-factor authentication, and review your active sessions. Then check whether your account sent the same message to friends — warn them before they click.

How do I help my friend recover their account?

Tell them by phone or text to visit facebook.com/hacked from a device they trust, reset the password, sign out all sessions, and turn on two-factor authentication — and to warn their friends not to click the message.