Scammers use familiar verification methods to establish credibility and lull the victim into a false sense of security to compromise Instagram accounts.
This scam is brilliant. It uses a number of very familiar factors:
Put all these together and you have the makings of a very creative scam. Researchers at security vendor Sophos spotted this scam in the wild. An email is received purportedly from Instagram stating “Someone tried to log in to your Instagram account. If this wasn’t you, please use the following code to confirm your identity.” The email then provides a six-digit code and a link to verify your credentials.
Victims are taken to a spoofed logon page, complete with an SSL certificate, and are asked to both login and provide the verification code.
It’s a clever execution of a credential harvesting scam with just the right amount of urgency, familiarity, and credibility to elicit a response from potential victims. This is a great example of just how close scammers are getting to looking like the vendors they mimic. It’s one of the reasons organizations can no longer consider quarterly or breakroom training to be enough. Users require continual Security Awareness Training specifically to elevate their sense of security while working. The scam above hopes that users won’t find it odd that they are being taken to a domain other than Instagram.com. Users that have undergone continual training are taught to be vigilant and would always scrutinize an email’s content, the domain name linked within the email, etc.
Stopping scams like this isn’t about addressing each specific execution or tactic; the answer lies in elevating the user’s security awareness.