Phishing DMs imitate brands, crush-bots, giveaway pages, and even “support agents.” The goal is usually a password, a one-time code, wallet seed phrase, or remote access to your device.
No reputable platform support will ask you to confirm your password in a DM or to move the chat to Telegram/WhatsApp to “verify.”
Common patterns
- Urgent fear — “Your account will be deleted in 24 hours, verify now.”
- Unexpected prizes — “You won — pay shipping / share login to claim.”
- Job offers — especially on LinkedIn and Instagram, asking for fees or identity documents via chat.
- Romance or friend impersonation — a familiar name with a new account asking for money.
- Fake copyright claims — links to lookalike login pages.
How to inspect a suspicious message
- Do not tap the link. Ask: did I initiate this?
- Check the username carefully for extra characters.
- Open the official app or type the official domain manually instead of using the DM link.
- Never share SMS/authenticator codes — those codes are keys.
- Report and block inside the platform.
One-time codes are keys
If someone asks you to “read the code you just received,” they are trying to complete login as you. Real support does not need that. Hang up, close the chat, and change passwords from a bookmark you trust.
Business-specific risks
Invoice fraud and vendor payment-change emails often accompany social recon. Verify bank detail changes on a known phone number, not on the thread that requested the change. Train anyone with Page admin access.
If you already interacted
- Change passwords and enable 2FA on the affected accounts
- Revoke sessions and third-party apps
- Contact your bank if you shared payment data
- Warn contacts if your account sent spam
- See recover a hacked account
Why DMs are fertile ground for scams
Direct messages feel personal and urgent. Attackers exploit that intimacy. Unlike public posts, DMs are less likely to be community-noted or mocked, so bad links spread quietly through networks of trust. Compromise one mid-size creator and hundreds of fans may receive the same phishing pitch from an account they already follow.
Mobile screens also hide full URLs. A link preview may show a brand color while the underlying domain is wrong. Develop the habit of long-pressing links to inspect them — or better, not pressing them at all when the message is unsolicited.
Lookalike domains and profiles
Scammers register domains that swap letters (rn vs m), use different top-level domains, or add hyphenated prefixes like “support-secure-”. Profiles add invisible characters or use brand names with “Help Desk” appended. When in doubt, search the brand’s site from your own browser bookmark and find support pages yourself.
Verified badges help but are not perfect, and badge products change. A badge does not make a surprising financial request safe. Evaluate the request itself.
Crypto, gift cards, and deposit scams
Any instruction to pay in gift cards, cryptocurrency, or wire transfers to “release” funds, unlock an account, or hire a recovery hacker is a scam. Platforms do not fix accounts in exchange for Google Play cards. Hang up and stop the chat.
Investment DMs promising guaranteed returns — often with fake screenshots of profits — are classic social engineering. Real brokerages do not onboard you through Instagram comment threads.
Job and collab scams
Fraudulent recruiters may send professional-looking briefs, then ask for an “onboarding fee,” bank details for a “kit,” or nude images for “wardrobe sizing.” Legitimate employers do not require you to pay to be hired. Collaborate only after contracts and payment paths you recognize.
On LinkedIn especially, check company pages, employee graphs, and whether the domain in email matches the company’s real domain. See our LinkedIn guide for privacy and security basics.
AI-assisted scams
Voice clones and face-swap videos make celebrity and family-emergency scams more convincing. Agree on a household code word for emergency money requests. Call the person back on a known number rather than responding inside the suspicious thread.
Team playbooks for brands
Write a one-page rule: who can approve outbound DMs with links, how to verify vendor payment changes, and how quickly to post “we were compromised” notices if needed. New interns should not have unrestricted Page inbox access on day one.
Related reading: account recovery · privacy checklist.
Thirty-second DM checklist
- Did I expect this message?
- Does it demand urgency or secrecy?
- Does it ask for money, codes, remote access, or passwords?
- Does the profile match the brand’s real handle elsewhere?
- Can I fulfill the request by opening the official app myself without their link?
If any answer feels wrong, stop. Report. Delete the thread. Confirm with the real organization through a channel you already trust.
How to warn your community without amplifying the scam
When you post a warning, avoid reprinting the full malicious URL when possible — people tap out of habit. Describe the pattern (“fake copyright DM with a login link”) and show a cropped screenshot with the bad domain partially redacted if needed. Tell people to navigate manually to official support.
Talking with teens about phishing
Teens may encounter gaming skin giveaways, “report nude” extortion, or fake talent scout DMs. Practice role-play: what would you tap, what would you ask an adult? Extortion involving intimate images needs calm, immediate adult support and platform reporting — shame keeps scams alive. See parental controls and the mental health hub if distress is high.
For creators: scam DMs scale with growth
As follower counts rise, so do impersonators and collab fraud. Pin a comment or Story highlight that states how you never DM first about payments. That single clarification can save your audience thousands of dollars collectively.
Frequently asked questions
Can I get scammed just by opening a DM?
Opening a text message is rarely enough on its own on up-to-date apps. The risk comes from tapping links, downloading attachments, entering credentials, or following instructions. Keep apps and your phone OS updated so known vulnerabilities are patched, and do not tap unexpected links.
What if the message comes from a friend’s real account?
Compromised accounts are the most convincing delivery method. Contact your friend through a different channel, such as a phone call, before acting on anything involving money, codes, or links. If they were hacked, point them to our recovery guide.
Should I reply to tell the scammer I know?
There is little upside. Replying confirms your account is active and may invite more attempts. Report, block, and move on.
Where should I report phishing?
Use the in-app report option on the message or profile. In the US you can also report fraud to the Federal Trade Commission at reportfraud.ftc.gov. If money was lost, contact your bank or payment provider immediately.
Related articles
- How to Recover a Hacked Social Media Account
- Social Media Privacy Checklist
- How to Download and Backup Your Social Media Data
Independent educational content. Not affiliated with any platform. Last reviewed October 2026.