Three checks catch nearly every fake. Channel: Instagram never raises account security in Direct, only by email. Sender: genuine security mail comes from a handful of official domains. Record: Settings › Recent emails lists everything Instagram really sent you in the past 14 days. A message demanding an urgent click to avoid a ban or deletion fails at least one of them, and that makes it phishing.
Anatomy of a fake
In Instagram's definition, phishing means a dodgy message or link built to coax personal details out of you so someone can enter your account, typically by threatening a ban or deletion if you don't comply. If the attacker succeeds, your account often becomes a spam cannon aimed at your followers.
The costumes rotate: a "copyright violation" or "community guidelines" warning with an "appeal" link, a countdown to deletion, a free verification badge, a prize. All of them lead to a page dressed up as Instagram's login.
Check 1: the channel
Account notices and security warnings never arrive in Direct; Instagram is explicit about that. A DM from something calling itself support or security, badge or no badge, is therefore never the real thing, however professional it looks. Report the profile and don't answer.
Check 2: the sender
Security email only goes to your email address, Instagram says, and only from these domains:
| Genuine sending domain |
|---|
| @mail.instagram.com |
| @support.instagram.com |
| @facebookmail.com |
| @support.facebook.com |
| @global.metamail.com |
Read the complete address after the @, not the display name, which costs nothing to fake. Extra words, hyphens or swapped letters in the domain are giveaways.
Check 3: the record
The decisive test is inside the app: the Recent emails screen, found among your password and security settings, shows the past 14 days of Instagram mail, with security and login messages in their own list. Not on the list means not from Instagram.
Habits that make you phish-proof
- Never sign in through a link. Ignore the button; launch the app on your own. Real issues show up in Account Status, the Support Inbox or your notifications.
- Never type codes into a page you were sent to. That goes for your password, login codes, backup codes, ID numbers and card details.
- Slow down. Instagram's own three rules for suspected scams: take your time, because urgency is the scammer's tool; double-check details before clicking or downloading; and remember that serious organisations don't insist on instant payment.
Took the bait? Damage control
- Still have access? New password immediately, unknown sessions signed out, two-factor switched on. The security checklist covers every setting.
- Locked out? Go straight to the hacked-account steps.
- Reused that password elsewhere? Change it on your email account too.
- Tell your followers that anything sent from your account in the meantime wasn't you.
- Forward the email to phish@instagram.com, Instagram's address for suspicious mail; fake profiles get reported in the app.
Soon after, paid "recovery agents" tend to show up. They're usually act two of the same scam: recovery scams.
Common questions
Will Instagram ever DM me about my account?
No. Instagram states that it doesn't use Direct for account matters or profile security. Report such messages and leave their links alone.
Which domains send genuine Instagram security emails?
Only @mail.instagram.com, @support.instagram.com, @facebookmail.com, @support.facebook.com and @global.metamail.com, and only to your email address.
What's the surest way to check an email?
Look it up under Recent emails in your security settings. It covers 14 days of genuine Instagram mail; anything missing there didn't come from Instagram.
I typed my password into a phishing page. What now?
With access: new password, sessions cleared, two-factor on. Without: the hacked-account steps, now. In both cases, forward the bait to phish@instagram.com.
Clicked, and now you're locked out?
Describe the bait and every change you've noticed on the account. A free reply names your realistic official route. Passwords and codes stay with you.
Sources
- Protect yourself from phishing on Instagram (Instagram Help Center) help.instagram.com
- Review recent emails sent from Instagram (Instagram Help Center) help.instagram.com
- Avoid getting scammed on Instagram (Instagram Help Center) help.instagram.com
- If you think your Instagram profile has been hacked (Instagram Help Center) help.instagram.com