untrappable

Instagram scams: is that DM real?

Editorially reviewed · Last updated July 28, 2026

Yes — this is a scam. Instagram never sends you direct messages about your account — the DM itself is the tell.

Text Message · Today 11:24 AM
from @instagram.security.help
Instagram Security: We detected a copyright violation on your account. Your account will be permanently deleted in 24 hours unless you verify ownership here: ig-verify-appeal.com/restore
The Text message, as received

Other versions you might get: The same account-panic DM arrives as a copyright strike, a “your account will be deleted” notice, a blue-tick verification offer, or a password-reset code someone asks you to read back. Then there's the other half of the category: a friend's hacked account asking you to vote in a contest, a stranger who moves fast to romance, a “guaranteed” crypto or stock tip, and shop ads for high-priced items at impossible prices. Different bait, one shape — someone you didn't contact wants something now.

What to do right now

  1. Don't reply, don't tap, don't send anything. Instagram's guidance for a suspected scam is one line: don't respond, report it.
  2. Check the claim where it can't be faked. Instagram's account warnings appear in the app, not in DMs — and you can view the official Instagram emails sent in the last 14 days inside your Instagram Settings. If it isn't listed there, nobody from Instagram sent it.
  3. Report the account. Use Instagram's in-app reporting or the report form, then file at [reportfraud.ftc.gov](https://reportfraud.ftc.gov).
  4. If you entered your password: change it immediately from the app, turn on two-factor authentication, and check for logged-in devices and email addresses you don't recognise. Change it anywhere you reused it too.
  5. If you sent money: contact your bank or the payment app right away, and report it to the FTC. Then ignore anyone who offers to recover it for a fee — that's the second pass of the same scam.

How to make sure it never bites you

Scammers work social profiles because your profile does the research for them. The FTC's advice is to limit who can see your posts and contacts, so there's less to build a story out of — and never let someone you met on social media direct your investment decisions. For the wider habit, see how to lock down your accounts.

Untrappable · Public service advisory

Stop the next one at the source

You got this because your details are on lists that get bought, sold, and leaked. You can't unspill that, but you can make it useless to a scammer. Start with the free steps — they do most of the work.

Optional — if you'd rather it was handled for you

If you'd rather have it watched for you, an identity-protection service monitors your accounts, SSN, and the dark web, warns you the moment something new appears, and helps you recover if someone gets through.

See identity protection →

Affiliate link — we may earn a commission at no extra cost to you. It never changes our verdicts. Why we can still be trusted.

Keep this · forward it to someone who needs it

Frequently asked

Does Instagram ever DM you about your account?
No — and this single fact kills most Instagram scams. Instagram's own help page states it plainly: “Instagram will never send you direct messages about your account in the Instagram app.” So a DM warning you about a copyright strike, a policy violation, or a pending deletion is fake no matter how official the profile looks. If you want to check whether Instagram actually contacted you, open the app, go to your Instagram Settings, and view the official Instagram emails sent in the last 14 days. If the message isn't there, it never came from Instagram.
An account says it's Instagram security and wants my login to fix my account — is that real?
It's a scam, and Instagram names this behaviour directly in its list of warning signs: people claiming to be from Instagram security asking you to provide account information like your username or password, or offering you account verification services. Nobody at Instagram needs your password — they can already see your account. Treat “I can restore it for you,” “I can get you verified,” and “send me the code” as the same request: hand over your account. Don't send it, and report the profile.
My friend DM'd me asking for a vote or a code — is it really them?
Probably not. Compromised accounts are the most convincing version of this scam, because the message really does come from your friend's profile. The pattern is a small favour first — vote in my contest, click this link for me, tell me the code you just received — and the code is a password reset for *your* account. Verify on another channel: call or text them on a number you already have. If they've been hacked, they'll be grateful you asked; if it's a scammer, they'll pressure you not to.
Why do they always want to move the conversation off Instagram?
Because on Instagram they can be reported and removed, and off it they can't. Instagram lists “people asking you to move your conversation off Instagram” as a warning sign for exactly this reason — WhatsApp, Telegram, email, or a payment app puts the scam outside the platform's view, with no report button and no history for anyone to check. The request usually arrives dressed as convenience: my DMs are limited, let's talk properly, add me here. Treat the move itself as the answer.
How much do people actually lose to scams on social media?
More than most people assume. The FTC reports that people lost $2.1 billion to social media scams in 2025 alone, and that losses have been rising sharply since 2020. Shopping scams are the most reported — ads for high-priced items at cheap prices, on sites impersonating brands you know, where the item never arrives or arrives as a knock-off. More than half of the reported *losses* came from investment scams, and nearly 60% of people who lost money to a romance scam in 2025 said it started on social media. The volume is the point: it costs a scammer nothing to send the next DM.

Related scams

Sources

A public service

Help protect someone else

Scams spread because people stay quiet about them. If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. Passing it on is the easiest good thing you'll do today. It's safe to forward, and stands on its own as a record for a bank or the police.