🔍 How the Scam Works

Scam operators have discovered that by creating a fraudulent Meta Quest account (using an email address they control) and then adding a legitimate Facebook user—who has never signed up for Meta Quest—as a “family member” (often designated as a child), they can trigger an automatic, authentic-looking notification from Meta or Facebook asking the target to confirm the link. When the unsuspecting user clicks “Approve” (believing it to be a harmless friend request or family invitation), they unwittingly hand over account management privileges to the scammer. As a result:

• The scammer becomes a linked Meta account holder, giving them the ability to control notifications and change recovery settings.
• They can then lock the victim out by resetting the Facebook password, changing two-factor authentication (2FA) settings, or modifying the account email.
• With full control, the scammer can impersonate the victim, send phishing messages to friends, post malicious links, or run lucrative “fake giveaways” to harvest additional personal data and payment information from the victim’s network.

According to recent reporting, Vietnamese hacker groups have already exploited this tactic to suspend over 1,000 valid Facebook accounts without needing to break two-factor authentication, simply because the emails for the Meta Quest linkage did not match the victim’s account on record . In short, you could be locked out even if you follow standard security best practices like 2FA—because these attackers never need to “guess” your password.

🛡️ How to Protect Yourself

Preventing this scam requires a combination of proactive account management and vigilance. We recommend the following steps:

1. Create your own Meta Quest account now (even if you don’t plan to use VR), so that any future family or friend linking requests you receive can only come from you. Learn how to set up a Meta Quest account here .
2. Use the same email associated with your Facebook profile when creating your Meta account. This ensures that if someone tries to link a Quest profile to your Facebook, they cannot match the email exactly and will be flagged as unauthorized.
3. Reject any unexpected “family member” or linking requests. If you did not initiate the link, do not click “Approve.” Instead, navigate directly to your Facebook settings and verify there are no pending Meta Quest connections.
4. Familiarize yourself with Meta’s official guidelines on avoiding phishing and scam attempts by reviewing Meta’s help center Avoid scams and phishing attempts . This resource explains how to identify legitimate communications from Meta and what email addresses or domains they use.
5. Limit linking your Meta and Facebook accounts unless absolutely necessary for VR functionality. Consider creating a dedicated email for VR-related logins instead of using your primary Facebook email. If you do choose to link, set up 2FA on both accounts with different phone numbers or authentication apps.

👤 Real Incident: What Happened to My Client

Just today, one of my boutique law-firm clients in the greater Chicagoland area received a notification asking them to confirm a Meta Quest family invitation. They had never signed up for VR, yet the message looked exactly like Meta’s standard “X wants to link to your account” prompt. Had they clicked “Approve,” the scammer would have immediately gained the ability to reset their two-factor settings and lock them out of Facebook—seizing control of years of professional contacts, group memberships, and client communications.

Thanks to our proactive Managed IT Security services, we were monitoring their account activity and recognized the fraudulent request instantly. We guided them through rejecting the link and then performed an urgent audit of all account recovery methods to ensure no backdoors were left open.

This event underscores why businesses and individuals alike must treat their social media security as seriously as their email, network, and endpoint protection. If you don’t have an MSP watching over these details, a simple “click” could cost you thousands in reputation damage, data loss, or even potential litigation if client information is exposed.

💼 How myTech.Today Can Help

As a leading Managed Services Provider (MSP) headquartered in Barrington, IL, myTech.Today specializes in proactive cybersecurity and comprehensive IT management for small and medium-sized businesses throughout the N & NW Suburbs of Chicagoland. When you partner with us, we:

• Monitor Account Activity 24/7: Our Security Operations Center keeps an eye on unusual login attempts, suspicious account-linking requests, and phishing indicators across all your digital assets. Learn more about our IT Services and Solutions here .
• Provide Employee Training & Awareness: We conduct regular security workshops so your staff can spot phishing emails, fraudulent notifications, and social engineering attacks before they do damage. Our Security Awareness program has successfully reduced click-through rates on malicious links by over 80% in client environments.
• Harden Account Protections: We configure multi-factor authentication (MFA) on all critical accounts—Facebook included—using best-in-class tools and ensure that account recovery options (backup emails, phone numbers) are locked down under strict policies.
• Offer Rapid Incident Response: In the event a scammer tries to link a false Meta Quest account or execute any other account takeover attempt, our team is ready to isolate and remediate within minutes, minimizing downtime and reputational risk.
• Conduct Periodic Security Audits: We review account settings, recovery methods, and connected devices on a quarterly basis to ensure there are no unauthorized links or lingering vulnerabilities.

By choosing myTech.Today, you gain a local partner in Barrington, IL, deeply familiar with the challenges facing Chicago-area businesses. We align our services to your unique needs—whether you operate in healthcare, legal, finance, or general retail—and deliver scalable solutions that grow as you do. For a detailed breakdown of our offerings, visit Empowering Businesses With IT Solutions .

📬 Final Thoughts

Meta’s interconnected ecosystem is powerful—but it is also an appealing target for cybercriminals looking to exploit account linkage features. The best defense is a multi-layered approach: proactive account creation, strict email hygiene, vigilant monitoring, and ongoing user education. Don’t wait until a scammer hijacks your social media presence to take action.

— Kyle C. Rode
IT Consultant | myTech.Today
kyle@mytech.today | 847-767-4914
Serving Barrington and the N & NW Suburbs of Chicagoland

P.S. If you found this alert helpful, check out our in-depth guide on “Why Passwords Matter”—a practical resource to build strong, memorable credentials that protect you against identity theft and free data breaches. Read it now at: https://mytech.today/why-passwords-matter/