How to Stop Facebook Message Spam in 2026 (5 Settings That Actually Work)
Facebook Messenger spam got noticeably worse in 2024 and 2025 after Meta switched all chats to end-to-end encryption by default. With message contents now encrypted, Meta can no longer automatically filter most scam messages before they hit your inbox — the burden shifted to user-side controls. The good news is that those controls are surprisingly powerful if you know where to find them. This guide covers the five settings that actually stop Facebook message spam in 2026, plus what to do about the newer scam patterns (Marketplace impersonation, AI-generated friend requests, and crypto investment DMs) that bypass the old filters.
Important note up front: Facebook split chat into the standalone Messenger app years ago. Most privacy settings now live inside Messenger, not on the main Facebook app. A few overlap with Facebook’s Privacy Center on the web. Both paths are covered below.
1. Lock Down Message Delivery (Who Can Reach You)
This is the single highest-impact setting. Message Delivery controls three separate buckets: Facebook friends, friends of friends, and everyone else (including Instagram, Marketplace buyers, and Group members). Tightening the “others” bucket kills most spam before it ever reaches you.
In the Messenger app (iOS or Android): tap your profile picture top-left → Privacy & safety → Message delivery. On Facebook’s website: Settings & privacy → Settings → Privacy → How people can reach you → Messages.
You’ll see options for each sender category. Set them like this:
| Sender Category | Recommended Setting | Why |
|---|---|---|
| Friends of friends | Message Requests | Sends to the filtered folder instead of your main inbox |
| Others on Facebook | Don’t receive requests | Blocks cold outreach from strangers entirely |
| Instagram followers | Message Requests | Keeps legitimate IG contacts reachable but filtered |
| Others on Instagram | Don’t receive requests | Same logic — blocks stranger DMs |
| People with your number | Don’t receive requests | Meta cross-references contacts; turn this off unless you explicitly want it |
| People with your email | Don’t receive requests | Same as above |
| Facebook Groups | Message Requests | Group admins sometimes DM you; filter them |
“Don’t receive requests” is stricter than most users realize — it doesn’t just hide messages, it prevents the sender from initiating a conversation at all. If you switch everything in the “Others” tier to this, roughly 80% of Facebook message spam disappears overnight.
2. Silence the Message Requests Folder
Anything not explicitly blocked still lands in Message Requests. By default, Messenger pushes a notification every time a new request arrives, which is where most of the noise comes from. You can turn those notifications off without losing notifications for real friends.
In Messenger: profile picture → Notifications & sounds → scroll to Message requests → toggle off. On Android, this toggle sits under Preferences → Notifications instead. Your main inbox will still ping normally; only the spammy Requests folder goes quiet.
One more setting worth flipping: in the same menu, under Story reactions, set notifications to Off. Story-reaction DMs are a common spam vector because the filter classifies them as social engagement, not unsolicited messaging.
3. Use the Restricted List for Soft-Block Cases
Sometimes you don’t want to fully block someone — a distant relative, a coworker, an old school friend — but you also don’t want their messages reaching you. That’s what the Restricted List is for. It’s technically a Facebook feature, not a Messenger one, but it affects Messenger behavior.
On Facebook web: go to the person’s profile → click Friends (the button that shows your friendship status) → Edit Friend List → check Restricted. On mobile, tap their profile → three-dot menu → Edit Friend List → Restricted. Their messages will land in Message Requests rather than your main inbox, and they can only see posts you make public — but they won’t know they’ve been restricted.
4. Block and Mute Persistent Spammers
For accounts that keep getting through, a full block is the durable fix. Messenger has two levels: Ignore Messages (mutes the thread without notifying the sender) and Block (cuts them off entirely from both Messenger and Facebook).
To Ignore Messages (soft mute)
- Open the conversation with the spammer.
- Tap the person’s name at the top of the chat.
- Scroll down and select Ignore messages.
- Confirm. The chat moves to the Spam folder — you won’t get notifications, but you can still read messages if you search for them.
To Block (hard cut)
- Open the conversation.
- Tap the person’s name at the top.
- Scroll to Block.
- Choose Block on Messenger (stops messages and calls only) or Block on Facebook (cuts all contact across both apps). For spammers, always choose the Facebook-wide block.
A common gotcha: if the spammer is a business account rather than a personal profile, the block flow looks different. Business accounts have a Manage messages option in the chat header — tap that, then Block messages. Ignoring a business page does nothing, you must block.
5. Report Scams So Meta’s Filters Learn From Them
With end-to-end encryption rolled out, Meta’s only signal that a message is spam is user reporting. Every report trains the classifier, which is now what protects other users. Reporting takes about five seconds per message:
- Open the message thread.
- Long-press the specific message (mobile) or hover and click the three-dot menu (desktop).
- Select Report.
- Choose the closest category: Spam, Scam or fraud, Pretending to be someone, or Suicide, self-injury or violence. “Scam or fraud” is the right choice for most phishing, crypto, or Marketplace impersonation messages.
- Optionally also check Block on the same screen to do both in one action.
If the message contains a suspicious link, don’t click it even to verify. Forward the full URL to Meta’s dedicated phishing address at [email protected]. Unlike regular reports, [email protected] goes to the security team directly and is the right channel for credential-harvesting pages impersonating Facebook login.
The Scam Patterns Driving 2026 Messenger Spam
The scams landing in Messenger inboxes this year are not the same as the 2022-era “You won a gift card” messages. A handful of patterns dominate:
| Scam Type | What It Looks Like | Telltale Sign |
|---|---|---|
| Marketplace buyer scam | “Is this still available? Can I send my courier?” | Offers to overpay and send a third-party courier; asks for Zelle or gift cards |
| AI-generated friend request | Attractive stranger, two or three stock-looking photos, no mutual friends | Profile created within the last 90 days, no tagged photos, opens with a compliment |
| Crypto or forex DM | “I made $X last week with this broker, let me show you” | Moves conversation to WhatsApp or Telegram within two or three messages |
| Account-lock phishing | “Your page will be deleted in 24 hours, click here to appeal” | Link is never facebook.com — always a lookalike domain |
| Family impersonation | “Hi it’s your cousin, I got a new number, can you help me?” | Asks for money or gift cards within five messages |
The common thread across all of these: the sender tries to move the conversation off Messenger quickly, because they know Meta’s reporting tools can’t reach them once you’re on WhatsApp, SMS, or email. If anyone asks to switch platforms in the first few messages, that’s reason enough to report and block.
Two-Factor Authentication Is Part of Spam Defense
Many Messenger phishing messages are ultimately trying to steal your Facebook login so they can use your account to spam your friends. If the attacker does get your password, 2FA is what stops them from logging in. Turn it on if you haven’t: Settings & privacy → Settings → Security and login → Use two-factor authentication. Use an authenticator app like Authy or Google Authenticator rather than SMS — SIM-swap attacks have become common enough that SMS 2FA is considered weak as of 2026.
When to Contact Meta Support Directly
If your account is actively being impersonated (someone has copied your photo and name to scam your friends) or if you believe your account is sending spam without your consent, reporting through the in-app flow is not enough. Go to facebook.com/help/contact/169486816475808 for the impersonation report form, or facebook.com/hacked if you suspect your account is compromised. These direct forms reach human reviewers faster than standard in-app reports.
For ongoing harassment that crosses into threats, Meta’s guidance is to also file a report with local law enforcement and provide them with Meta’s legal request portal at facebook.com/records. Screenshots alone are rarely enough — law enforcement needs to preserve the data through the portal before the spammer deletes their account.
Quick-Reference Settings Checklist
If you want the fastest possible cleanup, hit these five toggles in order:
- Messenger → Privacy & safety → Message delivery → set every “Others” option to Don’t receive requests.
- Messenger → Notifications & sounds → Message requests → Off.
- Messenger → Privacy & safety → Story replies → People you follow.
- Facebook → Settings → Security and login → Two-factor authentication via authenticator app.
- Facebook → Settings → Profile and tagging → Who can see what others post on your profile → Friends (limits the surface area scammers use to find you).
Most users see spam drop by 70-90% within 24 hours of applying all five. If messages are still slipping through after a week, the likely explanation is that you’re approving friend requests from accounts you don’t actually know — the settings above only protect against strangers, not against accounts you’ve personally accepted.