My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account.
We have the full phone number and email address the hacker is using to change the info to. The country code has the number origin to Nigeria.
We've contacted Instagram 3 times now by sending a video of her proving her identity. Everytime Instagram has unlocked the account for her.
These are the things she's done everytime she's gotten back into the account, but the hacker has somehow regained access, including by somehow bypassing and deactivating 2FA without 2FA asking for confirmation!
- Change phone number back to hers (she has an iPhone)
- Change the email address to a completely unrelated separate account.
- Added 2FA to her phone number, which the hacker is somehow getting back into the account without triggering a 2FA code to be sent to her phone - we have confirmed the 2FA was setup correctly as it asked her for a code when I attempted to login
- Manually logged out all other sessions on the Instagram account.
- Changed password to a completely random string of characters (includes letters of varying case, numbers, and symbols)
- Password of the old email account was also changed, before then completely changing the email address for the Instagram account.
Somehow the attacker has regained access everytime and has locked my friend out. We're unsure how the attacker is still gaining access, especially with all the info changed (except the username and phone number) and 2FA being enabled. All info on the account gets replaced by the attacker, including 2FA being disabled (we also know that the attacker is also re-enabling 2FA on their device afterwards).
I remember reading years ago about how some attackers had gained access to intercept/receive all messages on someone's phone, thus allowing them to take control of their social media (I don't recall who, but I believe it was a famous tech figure such as Zuckerburg). Perhaps a little far-fetched here as there's nothing significant about the Instagram account (few hundred followers as it's a personal account). We have tried sending text messages to her phone number, both with iMessage enabled and disabled, and she received them. She also received the 2FA code triggered by me when I attempted to login to the account.
How can we regain access for the last time and securely lock down the account and perhaps lock down whatever route the attacker is using to get in and take control. We're really out of ideas now.