This appears to be a phishing scam like I've never encountered before.
I received an email from
firstname.lastname@example.org to an email address I rarely use, but I noticed it because messages get forwarded to my main email address. The subject is: New login to Instagram from Instagram app on Apple iPhone.
Well, that wasn't me. I haven't used Instagram in ages, and never did I use it with the email address in question. I take a closer look. It's not my Instagram account, but the email shows a username that is my real name with extra characters. I don't live in San Francisco where the login supposedly occurred, and I definitely didn't set up this account. Someone got my real name from that email address I seldom use and has set up an imposter account.
There are several other messages from
email@example.com in the inbox of this rarely used email address with the subject Verify Your Account and those too seem authentic, although I suppose the domain could be spoofed (not a subject I know much about). If these are phony email messages, they're unusual phonies, because all the links (for password reset, etc) point to
https://instagram.com URLs. I found it alarming that the one email appears to confirm a successful login to this imposter account that I never verified.
It gets stranger. I decide to take a look at this user, this imposter me's Instagram profile page (
https://www.instagram.com/username). They have:
- 0 posts
- over 1000 followers
- several hundred 'followed'
- profile picture blacked out
This is an actual live Instagram account, no doubt about it.
One link in the email is: Not your account? Remove your email from this account.
Actually the full URL is longer, followed by a string of about 80 more characters after
report_wrong_email/. I will not post that part because I don't know whether or not it could help a scammer uniquely identify me.
After checking that the domain was
https://instagram.com/ I followed that one link in an attempt to remove my email from the imposter account. It led to Instagram's site, just not a valid page.
The shortened URL from the link above (
https://instagram.com/accounts/remove/report_wrong_email/) led me to a page looking like this:
The full URL led me to a page looking like this:
This page just by itself is weird, having both a Log Out link and a Log In link shown simultaneously on different parts of the page. It's part of Instagram's official site though. Highly suspicious for such an important link to be broken, pointing to the email being a fake.
This definitely smells of a scam, but I can't figure out how the scam is supposed to work or how worried I should be. I have already reset the password on the email address the messages were sent to. What's the best way to handle this? I could try to reset the fraudulent Instagram account password, reclaim the account, and shut it down, but maybe that's exactly what the scammer wants me to try if it's a phishing thing. And what's with all the followers? Instagram's Help Center is pretty useless, with apparently no way to report account fraud to a human being.