I assume most of you can spot a phishing attempt when you see one.
And I’m sure some of you have already come across this exact example.

Still, I’m sharing it here in case it helps even one person avoid a mistake:

This is an incredibly sophisticated phishing attempt - and I have to admit, I was genuinely impressed.

The email was sent from Facebook’s legitimate email address.
Why? Because technically, it is a real system notification.

It is simply an invitation to join a Business Manager.

The catch?

The Business Manager’s name is actually a phishing domain.

Since your email client automatically turns the Business Manager name into a clickable link inside the email, anyone not paying close attention might not realize that what looks like a standard name is actually a strange domain.

And of course, the blue “View Invitation” button takes you straight into Facebook to accept the invite - likely into an empty Business Manager created solely for this purpose.

As twisted as it is, it is also kind of brilliant.

My guess is that Facebook will eventually block the use of website domains as Business Manager names.

Or they will do absolutely nothing - which, to be fair, is also very possible.