Phishing Scams: Don't Click That Link in Your DM

You receive a direct message on Instagram. The sender has a blue verification tick and the username resembles "Instagram Help Center". The message claims that a copyright complaint has been filed against your account, and you have 24 hours to appeal by clicking the link provided, or your account will be permanently deleted.

Panic sets in. You click the link, enter your username and password to "appeal," and just like that—you've handed the keys to your digital life directly to a hacker. Welcome to the modern era of DM Phishing.

1. The "Copyright Infringement" Trap

In 2026, the copyright infringement trap is the #1 method used by hackers to hijack high-value business and creator accounts. Hackers buy already-verified (blue tick) accounts on the black market, change the profile picture to the Meta logo, and mass-send these threatening DMs.

• The Urgency Trick: Phishing relies on fear and urgency. They give you a tight deadline (e.g., 24 or 48 hours) so you act emotionally rather than logically.
• The Fake Login Page: The link takes you to a website designed to look exactly like the real Instagram login page. Once you type your credentials, a script instantly logs into your real account, changes the email, turns on 2FA, and locks you out.

2. How Instagram Actually Communicates

Here is the golden rule you must memorize: Instagram and Meta will NEVER send you a Direct Message regarding account security or policy violations.

If your account is genuinely at risk of deletion, or if a real copyright strike occurs, Instagram communicates this through in-app pop-up notifications or via official emails (ending in @mail.instagram.com or @support.facebook.com). You can independently verify any official email sent to you within the app by going to: Settings > Accounts Center > Password and Security > Recent Emails.

3. What to Do if You Already Clicked

If you clicked the link but didn't enter your password, you are generally safe. Clear your browser cookies just in case. However, if you typed in your password, time is of the essence:

1. Go to the real Instagram app immediately and change your password. This forces all other devices to log out.
2. Turn on Two-Factor Authentication (using an Authenticator app, not SMS).
3. Check your connected email address in settings to ensure the hacker hasn't changed it to their own.

Too Late? Account Hijacked?

If the hacker acted fast and you are completely locked out of your account, the standard automated recovery tools might fail, especially if the hacker changed your phone number and email.