Phishing, fake accounts and romance scams - the range of cybercriminals attacking their victims on social media is wide. Their activity focuses, among others, on Instagram – one of the most popular social media platforms.

ESET experts remind us that when using social media, we should never blindly trust the content shared there. The best way to protect yourself from a scam is to verify the information and messages that reach us through these channels.

Instagram scams can be encountered both while browsing content and while communicating with other users of the platform via direct messages. Here are the five most common methods used by cybercriminals.

Phishing

This is one of the most common and widespread types of fraud, one that criminals keep coming back to and exploiting. Phishing is as old as widespread internet access. The goal of this method is to obtain personal data and credentials, and then use them for illegal activities. For example, in identity theft scams or the sale of illegally obtained data on the black market. A popular phishing tactic involves creating in the victim a sense of urgency to take immediate action.

Phishing – data theft

Scammers send fake emails claiming that someone unauthorized may have logged into the victim's Instagram account. The message usually contains a link to a page with a password reset procedure. After clicking it, the victim is redirected to a fake Instagram login page, and filling it in allows cybercriminals to capture the credentials and consequently gain access to the attacked person's account. Another method is a message to the victim suggesting a copyright infringement and asking them to clarify the matter by filling out a form, accessed via a link included in the message. If we follow these instructions, we will also be redirected to a fake login page.

– It is worth emphasizing that scammers contact potential victims not only via email. They also impersonate the Instagram support department and send information via direct messages – warns Kamil Sadkowski, senior cybersecurity specialist at ESET. – To avoid falling victim to this type of scam, you should carefully analyze the messages you receive. Language and grammar errors or the use of a generic greeting instead of a personalized one are the first warning signs. The sender's email address can also herald an attempt to steal data. If the address does not contain the official Instagram domain, then we are most likely dealing with a scam – adds Kamil Sadkowski.

Fake accounts

While browsing Instagram in search of celebrity or favorite sports team accounts, you may come across fake accounts impersonating real users. This type of account cloning is not limited to famous actors, singers or athletes. Cybercriminals can also fake the accounts of ordinary users of the platform. Then, using such an account, they try to reach the victim's friends.

Fake accounts – profile cloning

In the next step, scammers will claim, for example, that the real profile has been hacked and their bank account has been emptied by criminals, or that they have some other financial problem. Using social engineering techniques, they then persuade the victim's friends to provide financial assistance, thereby extorting money. To protect yourself from losing money, you should contact the person asking for help in another way, for example via a phone call.

Blue verification badge scams

Blue verification badge

How to recognize common Instagram scams?

How to recognize common Instagram scams?

Another practice used by criminals that we should be aware of is account verification fraud. Next to the name of some Instagram profiles there is a blue badge with a white checkmark. This is proof that the account of that user has been verified by the platform. Verification is a way to authenticate a given user's profile and protect it from scammers impersonating them. It is a way for platform users to know which accounts are authentic. A verified account also means that its owner has a large audience. This opens the door to other opportunities, such as earning money from shared content under sponsorship deals.

- Cybercriminals exploit the fairly common desire to have a verification badge on Instagram. The scam is relatively simple. The criminal contacts the victim usually via direct message and offers them account verification for a fee. If the victim pays, the only thing that will be verified is the fact that they fell victim to a scam – explains the ESET expert. – It should be remembered that the only way to verify an account is the official process conducted by Instagram and set out in the platform's terms of service. Any other offer, e.g. one proposing a blue badge in exchange for a fee, is a scam – he adds.

Scams based on feelings

Romance scams

Internet users usually associate romance scams with dating apps. Unfortunately for people who have accounts on social media, they are also possible on platforms such as Instagram. This type of crime is sophisticated and requires the scammer to build a deeper relationship with the victim in order to awaken feelings and gain their boundless trust. The process most often begins with liking the potential victim's posts.

Then come the comments, and finally contact via direct messages. When the scammer is convinced that they have wrapped their target around their finger, they start asking for money. For example, they claim they need funds for treatment or to buy a ticket to meet the victim. After the money is transferred, the fake lover disappears from the victim's life. As statistics show, this type of threat cannot be taken lightly. In 2020, in the United States, losses from this amounted to $304 million.

- Fortunately, we have several options to protect ourselves from this type of scammer online. The first warning sign heralding misfortune may be the overly perfect behavior of a new acquaintance. Other concerning signs may be a constantly changing date or excuses that prevent meeting in real life, as well as avoiding video calls, which could reveal that our interlocutor does not actually resemble the person in their Instagram profile picture. When some behavior worries us, however unromantic it sounds, we can try to check the person we are talking to. For example, by reverse image searching their photos in Google – explains Kamil Sadkowski.

Fake sellers

In addition to allowing users to follow friends, celebrities and influencers, Instagram also lets brands advertise their goods and services. The user space on Instagram can fill up with more and more offers for discounted products, for example from fashion brands. Many of them are authentic, but cybercriminals also use this aspect to tempt their victims with an interesting product and an attractive price. It is worth emphasizing that unfamiliarity with a brand or seller does not always mean a scam.

Fake sellers on Instagram

An interesting offer should prompt a thorough verification of the seller, for example by checking them in an internet search engine or by reviewing opinions about a given company and its products. Victims of scams quickly share their experiences with dishonest sellers or scammers. It is also worth being alert to fake reviews, which are usually full of spelling errors, contradict all negative opinions, and describe a given product or company in nothing but superlatives.

 

Summary

Cybercriminals use Instagram for a wide range of scams – from phishing, through fake accounts and blue badges, to romantic manipulation or fictitious sellers. In 2020, in the United States, losses from romance scams reached $304 million, which shows how serious this problem is.

ESET experts advise always verifying the identity of interlocutors and sellers, avoiding clicking on suspicious links and paying attention to warning signs such as language errors or requests for urgent action. It is also key to remember that the only way to obtain a blue badge is the platform's official process.