A Norton, the cybersecurity brand from Gen™, warns about a new and sophisticated scam that is working frighteningly well and has been circulating via direct messages on Instagram. The focus of cybercriminals is influencers, small businesses, and content creators, who may have their accounts hijacked after interactions with fake profiles posing as ‘Meta’ technical support.
According to Iskander Sanchez-Rola, Director of AI and Innovation at Norton, this type of scam poses a significant risk to those who rely on Instagram as their main channel to increase visibility, generate revenue, and stay connected with their audience.
“We are dealing with a very well-architected scheme that accurately mimics communication from the ‘Meta Advertising Support Center’ (Meta’s Advertising Support Center). By posing as Meta representatives, scammers exploit the emotional vulnerability of those who fear losing their profile to induce hasty and thoughtless actions. The impact can be devastating for those who use Instagram as a strategic business channel,” says Iskander.
How the scam works
The scam begins with a message sent directly to the victim, appearing to be legitimate and sent from the ‘Meta Advertising Support Center’ (“Meta’s Advertising Support Center”). The message claims that the account has violated Meta’s policies and will soon be deactivated. The communication often includes external links and an alarmist tone designed to instill fear and urgency.
Upon clicking the link, the person is redirected to a page mimicking the ‘Meta Advertising Support Center.’ Victims are asked to ‘Request Review,’ which means entering their Instagram username, password, and in many cases, even their two-factor authentication code.
With these credentials in hand, the scammer can quickly take control of the account, lock out the owner, and exploit the stolen profile’s audience. To do this, the cybercriminal may adopt different strategies: from targeted frauds aimed at the profile’s followers—such as promoting fake investments or phishing links—to demanding a financial ransom to return the profile to its owner. There are also cases where accounts are sold in underground markets on the deep web.
Some signs can help users identify these scam attempts. Messages sent from accounts without verification badges and with few followers are one indication. The use of urgent, threatening language about account deletion or policy violations, with grammatical errors and poor wording, should also raise red flags, as should any request to click on external links promising account ‘verification.’
Iskander Sanchez-Rola recommends some best practices to protect against this type of scam:
- Never click directly on links from messages sent by unknown accounts. Meta and Instagram will never ask you to verify your account via private message.
- Check the sender’s profile. Meta’s official accounts are verified and will not have names like advertisingsupportcenter0798.
- Use two-factor authentication on your accounts, to prevent unauthorized access.
- Report the account to Instagram if you receive one of these messages.
- Consider using a security solution designed for small businesses, if you manage social media accounts as a team or use shared devices. Tools like Norton Small Business offer social media monitoring to help prevent account takeovers by administrators.
- Educate your team. If you manage your account with others, ensure everyone knows how these scams work.
With the growth of digital businesses and the influence of social media in brand building, scams like this are becoming increasingly dangerous. Awareness and the use of appropriate tools are essential steps to protect digital identities and avoid financial and reputational damage online. ‘Norton continues to closely monitor the evolution of these threats and reinforces its commitment to the digital security of small businesses and content creators,’ concludes Sanchez-Rola.
