Recent Instagram and Facebook Scam Targets Users With Fake Verification and Urgent Messages

San Francisco — A sophisticated scam campaign is spreading rapidly across Instagram and Facebook, tricking users into surrendering login credentials, financial details, and even personal identification documents through deceptive tactics that exploit trust in familiar brands and social connections. Security researchers and platform officials have confirmed a surge in reports over the past three months, with victims ranging from teenagers to small business owners who rely on the platforms for income, and communication.

Unlike traditional phishing emails, this latest wave of fraud does not arrive in your inbox. Instead, it unfolds directly within Instagram and Facebook’s own messaging systems, using fake verification badges, urgent security alerts, and impersonation of friends or customer support teams to pressure users into immediate action. Once access is gained, scammers often lock victims out of their accounts, demand ransom payments, or apply the hijacked profiles to target others in the victim’s network.

“The speed and emotional manipulation involved in these scams are alarming,” said a spokesperson for Meta, the parent company of both platforms, in a recent security advisory. “We’re seeing a shift from broad, generic attacks to highly personalized ones that play on fear, urgency, and familiarity.”

How the Scam Works: A Step-by-Step Breakdown

While tactics vary, security experts have identified several common patterns used in the current wave of Instagram and Facebook scams. Here’s how they typically unfold:

1. The Fake Verification Badge

Victims receive a direct message (DM) from an account claiming to be Instagram or Facebook support. The message often includes a blue verification badge, mimicking the official checkmark given to verified accounts. The text usually states that the user’s account has been flagged for suspicious activity and must be verified within 24 hours or risk permanent suspension.

A link in the message leads to a fake login page that looks nearly identical to Instagram or Facebook’s real site. When users enter their credentials, the scammers capture them and immediately change the password, locking the victim out. In some cases, the fake page also requests two-factor authentication (2FA) codes, which scammers use to bypass additional security layers.

Meta has repeatedly warned that official verification requests never come through DMs. The company only communicates verification status through in-app notifications and official emails sent to the address on file. “If you receive a message claiming to be from us asking for your password or 2FA code, it’s a scam,” the company stated in its April 2026 security update.

2. The “Friend in Distress” Impersonation

Another common tactic involves scammers hacking into a user’s friend or family member’s account and sending urgent messages. These messages often claim the friend is stranded, in legal trouble, or needs emergency financial help. The scammer may ask for gift card codes, wire transfers, or even cryptocurrency, playing on the victim’s trust in the compromised account.

In one recent case reported by BBC News, a college student in the UK sent £1,200 to a scammer posing as her best friend, who claimed to be stuck in a foreign country without access to funds. The friend’s account had been hacked the day before, and the scammer had spent hours studying her chat history to craft a convincing message.

3. The Fake Giveaway or Brand Partnership

Scammers also pose as well-known brands, influencers, or even Meta itself, offering fake giveaways or exclusive partnership opportunities. Victims are told they’ve won a prize, a free product, or a chance to collaborate with a major company—but must first pay a “shipping fee” or “verification deposit.” In some cases, victims are asked to fill out a form with personal details, including government-issued ID numbers, which scammers then use for identity theft.

“These scams are particularly effective because they exploit the aspirational nature of social media,” said cybersecurity researcher Dr. Elena Vasquez of the Center for Internet Security. “People want to believe they’ve been chosen for something special, and scammers recognize how to push those emotional buttons.”

Who Is Most at Risk?

While anyone can fall victim to these scams, certain groups are being targeted more frequently:

• Small business owners and influencers: Scammers impersonate brands or potential sponsors, offering fake collaborations that require upfront payments or sensitive business information.
• Teenagers and young adults: Less experienced users are more likely to trust urgent messages from friends or authority figures, even when the requests seem unusual.
• Older adults: Scammers often target users who may be less familiar with digital security practices, using fear-based tactics like fake account suspensions.
• Non-native English speakers: Messages with poor grammar or awkward phrasing are sometimes overlooked as scams, especially if the sender appears to be a trusted contact.

According to a 2026 report from the U.S. Federal Trade Commission (FTC), social media-related fraud accounted for nearly 38% of all reported scams in the first quarter of the year, with losses totaling over $1.2 billion. Instagram and Facebook were the most frequently cited platforms, responsible for 62% of those cases.

How to Protect Yourself: A Checklist

Security experts and platform officials recommend the following steps to stay safe:

1. Verify the Source

• Never trust a DM claiming to be from Instagram, Facebook, or any other company. Official communications will only come through in-app notifications or emails sent to your registered address.
• Check the sender’s profile carefully. Scammers often use handles that look similar to official accounts (e.g., “Instagram_Support” instead of “Instagram”).
• Look for the blue verification badge—but don’t rely on it alone. Scammers can create fake badges using emojis or edited images.

2. Slow Down and Question Urgency

• Scammers rely on urgency to bypass your critical thinking. If a message demands immediate action, grab a step back and verify the request independently.
• If a friend or family member sends an unusual request, contact them through another channel (e.g., a phone call or text message) to confirm it’s really them.

3. Secure Your Account

• Enable two-factor authentication (2FA) using an authenticator app (like Google Authenticator or Authy) rather than SMS. SMS-based 2FA can be intercepted by scammers.
• Use a strong, unique password for each of your social media accounts. A password manager can help you generate and store these securely.
• Regularly review your account’s login activity for any suspicious sessions. On Instagram, go to Settings > Security > Login Activity. On Facebook, go to Settings > Security and Login.

4. Report and Block Suspicious Accounts

• If you receive a suspicious message, report it to Instagram or Facebook immediately. On Instagram, tap the three dots in the top-right corner of the message and select Report. On Facebook, click the gear icon in the chat and choose Report.
• Block the account to prevent further contact. This also helps platforms identify and remove fraudulent accounts more quickly.

What to Do If You’ve Been Scammed

If you’ve already fallen victim to a scam, act quickly to minimize the damage:

1. Change your password immediately. If you can still access your account, update your password to something strong and unique. If you’ve been locked out, use the platform’s account recovery process.
2. Revoke access to third-party apps. Scammers may have used your account to authorize malicious apps. On Instagram, go to Settings > Apps and Websites. On Facebook, go to Settings > Apps and Websites.
3. Report the scam to the platform. Both Instagram and Facebook have dedicated forms for reporting hacked accounts. For Instagram, visit this link. For Facebook, use this form.
4. Notify your contacts. If your account was used to send messages to friends or followers, let them know you were hacked and to ignore any suspicious requests.
5. Monitor your financial accounts. If you shared payment information or sent money to a scammer, contact your bank or credit card company immediately to report the fraud and request a chargeback if possible.
6. File a report with authorities. In the U.S., report the scam to the FTC and the FBI’s Internet Crime Complaint Center (IC3). In the EU, report to Europol’s EC3. Other countries have similar reporting mechanisms.

Why These Scams Are Getting Harder to Spot

Scammers are increasingly using artificial intelligence (AI) to make their attacks more convincing. Tools like deepfake audio and video, AI-generated text, and even AI-powered chatbots are being deployed to create highly personalized and realistic interactions. In some cases, scammers use AI to mimic the writing style of a victim’s friends or family members, making their messages nearly indistinguishable from the real thing.

“The barrier to entry for scammers has dropped dramatically,” said Dr. Vasquez. “You no longer need to be a skilled hacker to run a convincing scam. With AI tools, even novice criminals can create messages that look and sound authentic.”

Meta has acknowledged the challenge and is rolling out new AI-powered detection systems to identify and remove fraudulent accounts more quickly. However, the company has also emphasized that user vigilance remains the first line of defense. “No system is perfect,” the company stated in its April advisory. “We’re investing heavily in detection and prevention, but users must also stay informed and cautious.”

Key Takeaways

• Scammers are targeting Instagram and Facebook users with fake verification requests, urgent messages from “friends,” and fake giveaways. These scams often start with a DM and escalate quickly.
• Never trust a message that demands immediate action or asks for sensitive information. Always verify the request through another channel before responding.
• Enable two-factor authentication (2FA) and use a password manager. These simple steps can prevent most account takeovers.
• If you’ve been scammed, act fast. Change your password, revoke third-party app access, report the scam to the platform and authorities, and notify your contacts.
• AI is making scams harder to detect. Scammers now use deepfakes, AI-generated text, and other tools to create highly convincing messages. Stay skeptical of any unusual request, even if it appears to come from someone you trust.

What’s Next?

Meta has announced plans to introduce new security features later this year, including enhanced account recovery options and AI-driven scam detection for direct messages. The company is also working with law enforcement agencies worldwide to track and dismantle scam networks.

In the meantime, users are urged to stay informed about the latest scam tactics and to share this information with friends and family. “The best defense is awareness,” said Dr. Vasquez. “Talk about these scams openly, and don’t assume it won’t happen to you. Everyone is a target.”

For official updates on platform security, follow Meta’s Instagram blog and Facebook Newsroom. If you’ve been affected by a scam, consider sharing your story (anonymously, if preferred) to help others recognize the warning signs.

Have you encountered a suspicious message on Instagram or Facebook? Share your experience in the comments below, and let’s keep the conversation going. Stay safe online!