'Verify Your Badge' Instagram DM Scam Examples
A direct message impersonating Instagram support claims your account has been selected for a verification badge and asks you to complete a form, capturing your username, password, and two-factor code. The scammer's real goal is full account takeover, which they use to lock you out, run further scams on your followers, or hold the account for extortion. The lever is the appeal of status and exclusivity — being 'selected' for verification feels flattering and legitimate. Instagram never requests your password or 2FA codes through DMs to verify accounts; only ever enter login credentials inside the official Instagram app or website.
Last reviewed: 1 June 2026
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Hello! This is the [platform] verification team. Your account has been selected for a blue badge based on your follower count. Complete the form at [fake link] within 24 hours before the slot is given to another creator.
Congratulations — your profile has been flagged for Official Verification. To proceed, log in at [fake link] with your credentials and enter the code sent to your phone. This is confidential.
Hi, I work at [platform] partner support. We are rolling out badges this week and you qualify. I just need your username and the 6-digit code you just received. Do not share this with anyone else.
What the scammer wants
To steal your Instagram or social media account credentials and authentication codes so they can lock you out, extort you, or use the account to run further scams on your followers.
Red flags in the message
- DM about a badge from an account that is not itself verified or official
- Link to a login page that is not the platform's real domain
- Request for a two-factor authentication code
- Urgency — 'accept within 24 hours'
- Instruction to keep the process confidential
A safe response
Real verification processes are managed entirely within the platform's official app under Settings. Never enter login credentials or share OTP codes via DM. Report the account as a phishing attempt.
What not to send
- Your password
- Two-factor authentication codes
- Any personal identification documents
What to do if you already replied
- If you shared your password, change it immediately from a different device
- Revoke third-party app access via the platform's security settings
- Report the compromise to the platform's official support channels
Evidence to preserve
- Screenshot the full message or call details
- Note the sender number, email, or profile
- Save any links (without clicking) and payment details
- Record dates and times
Frequently asked questions
I entered my password and 2FA code — is my account still mine?
It may already be compromised or about to be, so act immediately: go to Instagram's official app and try to change your password right away. If you're already locked out, use Instagram's official 'hacked account' recovery process via their help centre, and check any linked email for a login notification you didn't make.
Can they use my hacked account to scam my friends and followers?
Yes, this is very common — scammers often use a freshly hacked, trusted-looking account to send the same or similar scam DMs to your entire follower list. Warn close contacts as soon as you're able, and report the account as compromised to Instagram.
How do I know if a verification request from Instagram is real?
Genuine verification requests, if you've applied, are handled entirely within the app under settings, and Instagram never asks for your password or 2FA code via a DM or external form. Any message asking you to 'confirm' your login credentials outside the app itself is fraudulent.
Can I get my account back if it's already been taken over?
Often yes, though it can take time — use Instagram's in-app 'I think my account was hacked' recovery flow immediately, which may require photo ID verification. Recovery success and speed vary, so act as quickly as possible and check your linked recovery email regularly for further instructions.