Businesses running Facebook pages are being targeted with suspicious copyright infringement emails, supposedly sent by UK solicitors and threatening legal action over content published on their pages.
We have seen two examples sent to separate businesses on 2 November 2026. Both use almost identical legal wording, despite claiming to represent different law firms and copyright owners.
The emails accuse businesses of using copyrighted material without permission and direct recipients to links labelled “Review Evidence & Attachments” or “Download Exhibits”.
The messages show strong signs of phishing. Business owners should avoid opening the evidence links or providing Facebook login details.
What do the fake copyright infringement emails say?
Both messages use formal legal language and refer to the Copyright, Designs and Patents Act 1988.
One email carries the heading “Notice of Copyright Infringement”. The other uses “Letter Before Claim: Copyright Infringement”.
The following wording appears in both:
This conduct infringes the Rights Holder’s exclusive rights under sections 16, 17 and 20 of the Copyright, Designs and Patents Act 1988 and is actionable under section 96.
Another section states:
The Rights Holder is entitled to seek an injunction, damages or an account of profits, delivery up, and additional damages under section 97(2), together with costs.
Both messages also threaten possible proceedings in the High Court or Intellectual Property Enterprise Court.
These references to genuine UK copyright legislation give the emails an appearance of authority.
Yet neither message identifies the specific Facebook post, photograph, video or other content supposedly infringing copyright.
Instead, recipients are encouraged to click a link to review the alleged evidence.
Different solicitors, identical allegations
The two emails claim to originate from different legal practices, identified as “Nicholson Conveyancing” and “Stephens Immigration Solicitors”.
One names “Zahid Akhtar, Solicitor”, while the other names “Matilda Robson, Solicitor”.
The messages also identify different alleged copyright holders, “Alistair Johnson” and “Margaret McAuley”.
Despite these differences, the legal paragraphs, demands and threats of court proceedings are virtually identical.
Both emails arrived on the same morning and were sent from personal Gmail accounts unrelated to the legal practices named in the letters.
Recipients were also instructed to respond to unrelated personal email addresses, including addresses hosted by Blueyonder and Outlook’s Live email service.
These inconsistencies strongly suggest a shared phishing template rather than two independently prepared legal complaints.
The named individuals and firms have not been established as responsible for sending the messages. Their names might have been used without permission.
Watch out for “Review Evidence & Attachments” and “Download Exhibits”
The most concerning feature of both emails is the link presented as evidence of copyright infringement.
The links are designed to appear relevant to the legal allegation, encouraging recipients to open them to find out what their business has supposedly done wrong.
In one example, the evidence link pointed to a Google sharing URL beginning with share.google/.
The final destination and behaviour of the links have not been independently established. We therefore cannot confirm whether they lead to credential theft, malicious downloads or another form of deception.
Nevertheless, the combination of legal threats, unexplained sender identities and external evidence links is consistent with phishing tactics.
Business owners should avoid opening these links, particularly when the sender’s identity has not been verified.
What should you do if you receive one?
If your business receives an unexpected copyright infringement notice concerning its Facebook page, do not assume the allegation is genuine.
First, examine the sender’s actual email address. A letter claiming to originate from a solicitor but arriving from an unrelated Gmail account deserves closer scrutiny.
Check whether the complaint identifies the specific copyrighted work and the material allegedly copied. The absence of this information is a reason to seek clarification through independently verified channels.
Do not use contact details supplied in a suspicious email to verify the sender. Instead, check the legal practice and solicitor through the appropriate professional regulator.
Avoid opening evidence links or attachments until you have established their legitimacy.
If you have already entered your Facebook password into a suspicious website, change your password through Facebook’s official website, review active sessions and enable two-factor authentication. Check whether anyone has gained access to your business page or advertising account.
Suspicious emails should be forwarded to the National Cyber Security Centre at [email protected].
Are these copyright infringement notices genuine?
The two examples reviewed contain substantial warning signs, including unrelated sender addresses, identical legal wording and unexplained links to supposed evidence.
There is insufficient evidence to establish the identity of the people responsible or confirm the purpose of the linked websites.
Genuine copyright owners do have legal rights to challenge unauthorised use of their work. Businesses should take properly verified legal correspondence seriously. Usually though, they show you the evidence of the claim (usually an image), and don’t ask you to download the proof.
But receiving an official-looking email does not establish copyright infringement or create an obligation to click an unfamiliar link.
If you receive a message headed “Notice of Copyright Infringement” or “Letter Before Claim: Copyright Infringement” concerning your Facebook business page, verify the sender independently before taking action.
