Cybercriminals are using a clever trick to target Instagram users. You receive an email that looks like an official security alert from Instagram that claims that someone tried to log in to your account. The email contains instructions to “Report this user” and provides a link for you to select. This situation seems urgent, and you may be tempted to act quickly.
But the link in the email doesn’t lead to a website. If you select it, the link will automatically open your email app and even load a new email that is ready for you to send. The new email is already addressed and contains text that says “Report this user to secure your account.” If you send the email, it won’t go to Instagram’s support team, but a cybercriminal will receive it instead. They will then reply to your email and pretend to be an official support agent so they can try to trick you into sharing your password or other personal information.
Follow these tips to avoid falling victim to a phishing scam:
Be suspicious of any security alert that asks you to send an email. Legitimate organizations such as Instagram will not ask you to secure your account by starting an email conversation.
You should never send information like passwords, account details, or other personal information over email. Instagram support would never ask you to provide this information to them.
If you receive what appears to be an urgent message about your account, stop and think first. Scammers often create a sense of urgency to get you to act impulsively.
A vigilant workforce is the most effective defense against these attacks. Reach out to access training and simulations that empower your team to recognize and respond to attacks like this one.
