New Instagram Phishing Scam Uses Familiar (But Fake) 2FA Codes to Trick Victims

Scammers use familiar verification methods to establish credibility and lull the victim into a false sense of security to compromise Instagram accounts.

This scam is brilliant. It uses a number of very familiar factors:

  • People are used to receiving notifications about use of their account (a good example is Google – every time you sign on anywhere new, they send you a notification email)
  • People are used to seeing two-factor authentication codes being sent to both phones and email.
  • People are relaxed about receiving emails from the social platforms they use.

Put all these together and you have the makings of a very creative scam. Researchers at security vendor Sophos spotted this scam in the wild. An email is received purportedly from Instagram stating “Someone tried to log in to your Instagram account. If this wasn’t you, please use the following code to confirm your identity.” The email then provides a six-digit code and a link to verify your credentials.


Victims are taken to a spoofed logon page, complete with an SSL certificate, and are asked to both login and provide the verification code.

It’s a clever execution of a credential harvesting scam with just the right amount of urgency, familiarity, and credibility to elicit a response from potential victims. This is a great example of just how close scammers are getting to looking like the vendors they mimic. It’s one of the reasons organizations can no longer consider quarterly or breakroom training to be enough. Users require continual Security Awareness Training specifically to elevate their sense of security while working. The scam above hopes that users won’t find it odd that they are being taken to a domain other than Users that have undergone continual training are taught to be vigilant and would always scrutinize an email’s content, the domain name linked within the email, etc.

Stopping scams like this isn’t about addressing each specific execution or tactic; the answer lies in elevating the user’s security awareness.

Free Social Media Phishing Test

Would your users fall for a phishing email that looks like it originated from a credible social media site such as Facebook, LinkedIn or Twitter? Attackers use social media to target both your brand, your users, and even your customers by distributing malware or using social engineering to phish for credentials. These platforms have become a goldmine for the bad guys to carry out social media phishing attacks against your organization. Don't get hacked by social media phishing attacks!

SPT-monitorHere’s How the Social Media Phishing Test works:

  • Immediately start your test with your choice of three social media phishing templates
  • Choose the corresponding landing page your users see after they click
  • Show users which red flags they missed or send them to a fake login page
  • Get a PDF emailed to you in 24 hours with your percentage of clicks and data entered

Go Phishing Now!

Don't like to click on redirected buttons? Copy & paste this link into your browser:

Subscribe To Our Blog

Weak Password Test Contest

Get the latest about social engineering

Subscribe to CyberheistNews