Facebook messaged me over WhatsApp

Facebook will never contact you via WhatsApp about account security — that's the dead giveaway. These parasites impersonate legitimate platforms knowing people panic at the thought of account hijacking. Don't click links in unsolicited messages; go directly to the official app or website instead.

Stop and think before you act. If something feels urgent, threatening, or too good to be true — that urgency is the weapon. Scammers use pressure to override your judgement. Nothing is ever so urgent that you can't take five minutes to check, call back on a number you found yourself, or ask someone you trust.