Is my Instagram account at risk if someone DMs me a suspicious link?

Instagram account takeover fraud usually begins with a direct message — often from a compromised account belonging to someone you follow — containing a link. Clicking the link typically leads to a fake Instagram login page that harvests your username and password. Once the attacker has your credentials, they change your password and email, locking you out and using your account to repeat the scam to your followers, run fake brand promotions, or sell the account. Attacks also arrive through fake copyright infringement warnings, collaboration offers, and DMs asking you to vote for someone in a competition. Enable two-factor authentication and never enter your Instagram credentials on any site that is not instagram.com.

Compromise cascades through social graphs: each hijacked account lends its credibility to attacks on every follower, which is why the most dangerous link is one from a friend whose account fell an hour earlier. Messages riff on trust — 'is this you in this video?', voting requests, giveaway tags — and the fake login page finishes the job. Creators and small businesses are prime targets because monetised accounts resell and their audiences can be scammed at scale.

Recovery becomes a race once attackers change your email and password, so prevention is disproportionately valuable: two-factor authentication, no credentials entered from any DM link, and immediate password changes if a link was followed. If a friend's account sends something odd, tell them through another channel — early warning shortens every chain of compromise.