Instagram says it never contacts you about your account's security through Direct Messages, and that security emails only go to your email address, from a short list of official domains. You can check any email against the Recent emails screen in your settings, which lists everything Instagram sent you in the last 14 days. A message that threatens to ban or delete your account unless you click a link right away is almost always phishing.
What Instagram phishing looks like
Instagram describes phishing as someone trying to get into your account by sending a suspicious message or link that asks for your personal information. These messages often claim your account will be banned or deleted if you don't follow their instructions. If the sender gets in, they may use your account to send spam to your followers.
Common disguises include a warning about a "copyright" or "community guidelines" violation with a link to "appeal", a notice that your account will be deleted within hours, an offer of a verification badge, or a prize. The link leads to a page that looks like Instagram's login screen.
Rule 1: security warnings don't arrive as DMs
Instagram says it will never send you Direct Messages about your account in the Instagram app, and never contacts you about your profile's security through DMs. A DM from "Meta Support", "Instagram Security" or a profile with a blue badge in its profile picture is not Instagram, however official it looks.
Report the profile in the app and don't reply.
Rule 2: check the sender and Recent emails
According to Instagram, security emails are only sent to your email address and come from addresses ending in:
- @support.facebook.com
- @support.instagram.com
- @facebookmail.com
- @mail.instagram.com
- @global.metamail.com
Look at the full address after the @, not just the display name, which anyone can fake. Lookalike domains with extra words or hyphens are a red flag.
The most reliable check is inside the app: Instagram shows the emails it sent you in the last 14 days under Settings › Accounts Center or Meta Account › Password and security or Login and security › Recent emails. Security and login emails are listed separately from other emails. If a message isn't there, Instagram didn't send it.
Rule 3: never log in from a link
Instagram's advice is not to click links or open attachments in a suspicious email or message claiming to be from Instagram. If something might be real, close the message and open the Instagram app yourself. Anything you genuinely need to do will be in Account Status, your Support Inbox or your notifications.
Never type your password, login codes or backup codes into a page you reached from a message, and never answer messages asking for your password, ID number or card details.
Rule 4: slow down
Instagram suggests three simple rules when something might be a scam:
- Slow down. Scammers create urgency or threaten you with losing your account. Take time to think it through.
- Spot check. Double-check the details before clicking links or downloading files. Does the story make sense?
- Don't send. Scammers pretend to be from familiar organisations. No reputable organisation demands payment on the spot.
Already clicked or typed your password?
- If you can still log in, change your password straight away, log out of any device you don't recognise under Where you're logged in, and turn on two-factor authentication. Our security checklist walks through each setting.
- If you're locked out, follow the official steps for hacked Instagram accounts as soon as possible.
- Change the password of your email account too, if you used the same one anywhere else.
- Warn your followers that messages sent from your account were not from you.
- Report the phishing email to phish@instagram.com, the address Instagram gives for strange emails, and report fake profiles in the app.
Be careful with "recovery agents" who contact you afterwards offering to get the account back for a fee. They are usually the second half of the same scam: see how to spot recovery scams.
Frequently asked questions
Does Instagram send messages about my account through DMs?
No. Instagram says it never sends Direct Messages about your account in the app and never contacts you about your profile's security through DMs. Report such messages and don't click their links.
Which email addresses does Instagram use for security emails?
According to Instagram, security emails only go to your email address and come from addresses ending in @support.facebook.com, @support.instagram.com, @facebookmail.com, @mail.instagram.com or @global.metamail.com.
How do I check whether an email is really from Instagram?
Open the Recent emails screen in your Instagram security settings. It lists the emails Instagram sent you in the last 14 days. If the email isn't listed, it didn't come from Instagram.
What should I do if I entered my password on a phishing page?
If you can still log in, change your password, log out of unknown devices and turn on two-factor authentication. If you're locked out, use Instagram's hacked-account steps right away, and report the phishing email to phish@instagram.com.
Lost the account after a phishing message?
Tell us what the message said and what has changed on the account since. We'll tell you for free which official route is realistic. We never ask for your password or codes.
Sources
- Protect yourself from phishing on Instagram (Instagram Help Center) help.instagram.com
- Review recent emails sent from Instagram (Instagram Help Center) help.instagram.com
- Avoid getting scammed on Instagram (Instagram Help Center) help.instagram.com
- If you think your Instagram profile has been hacked (Instagram Help Center) help.instagram.com