Fake Instagram Copyright Strike Phishing
Fraudulent messages claim your Instagram account has received a copyright strike or DMCA notice and will be deleted unless you verify your identity through a link — which leads to a credential-harvesting page.
Part of: Copyright Strike & Takedown Phishing
Last reviewed: 7 June 2026
Instagram enforces copyright under the DMCA and its own Community Guidelines, which means a copyright strike is a plausible and frightening event for any content creator. Scammers leverage this familiarity to send convincing fake strike notices to creators, brands, and ordinary users alike.
The fake notice typically arrives via email — styled to look like an official Instagram policy notification — or occasionally via a direct message from an account pretending to be the 'Instagram Copyright Team'. The urgency is amplified by a short window: 'appeal within 24 hours or your account will be permanently removed'.
For professional creators whose income depends on their Instagram audience, this threat can prompt rushed, uncritical action — which is exactly when credential-harvesting succeeds.
How this scam works on the Instagram brand
Instagram's real copyright violation communications arrive from @mail.instagram.com email addresses and direct users to help.instagram.com or to a notification inside the app itself. When a real DMCA takedown occurs, Instagram shows the affected post as removed within the app, and the appeal process is completed inside the app or through the official counter-notification form at help.instagram.com.
Fake copyright strikes mimic the style of Instagram's transactional emails. The appeal button links to a page at something like instagram-copyright-appeals[.]net, which displays a polished replica of the Instagram sign-in page. After entering credentials, the page may ask for a two-factor code, then redirect to a generic 'your appeal has been submitted' confirmation to delay suspicion.
Some variants embed the phishing link inside a direct message from an account impersonating the 'Instagram IP Support Team'. Real Instagram staff do not reach out by DM about copyright issues.
Common red flags
- Email sender is not from a @mail.instagram.com or @facebookmail.com address
- The appeal link leads to a domain that is not instagram.com or help.instagram.com
- You receive a direct message from an account claiming to be the Instagram Copyright Team
- There is no corresponding removal notification when you open the Instagram app
- The message demands action within 24 hours to avoid permanent account deletion
- The appeal form asks for your Instagram password rather than routing you through an already-logged-in appeal
How to protect yourself
- Open the Instagram app first — real copyright actions show as notifications inside the app
- Access copyright appeal forms only through help.instagram.com, not via links in emails or DMs
- Log into Instagram via instagram.com directly if you want to check account status
- Keep your Instagram login email address private to reduce targeted phishing attempts
- Enable two-factor authentication so even a stolen password alone cannot unlock your account
- Report fake copyright claim emails to Instagram and to [email protected]
How to report it
- Forward the phishing email to [email protected]
- Report the impersonating DM account using Instagram's in-app 'Report' feature
- Report to the FTC at reportfraud.ftc.gov (US) or Action Fraud actionfraud.police.uk (UK)
- Submit the phishing URL to Google Safe Browsing at safebrowsing.google.com/safebrowsing/report_phish
Frequently asked questions
How does a real Instagram copyright strike work?
When Instagram receives a valid DMCA takedown request, it removes the specific infringing post and sends a notification inside the app and to the registered email address. The affected post shows as removed in your profile grid. Appeals are filed through the in-app notification or at help.instagram.com.
Can a copyright strike delete my entire Instagram account?
A single copyright notice typically results in removal of the specific post. Repeated violations can lead to account disabling under Instagram's repeat-infringer policy. However, this process happens through the app and official communications — not through a single urgent email demanding immediate action.
I entered my password on the fake appeal page. What now?
Log into Instagram immediately via instagram.com and change your password. Check that your recovery email and phone number have not been altered in Settings > Account > Personal Information. Enable or review two-factor authentication. Report the incident to Instagram through the Help Center.