How to Spot a Fake Instagram DM: Scams, Bots and Copycats

Almost every fake Instagram DM is one of five things: a copyright warning, a verification offer, a giveaway win, a brand collaboration, or a friend whose account was taken over. Once you know the five, spotting them takes seconds.

This guide covers each pattern, the tells that give it away, what to do if you already clicked, and how to stop your own brand being impersonated. It is part of our wider guide to Instagram DMs.

One rule underpins all of it: Instagram does not ask for your password, your code or your payment details in a DM. Ever.

Table of Contents

Key Takeaways

Instagram never DMs you about your account. Official notices appear in the app, not in your inbox.

Urgency plus a link is the signature of almost every scam DM.

A blue tick in a message means nothing; anyone can type one.

Never share a login code, even with someone who seems to be a friend.

Real brand deals do not arrive with a fee to pay first.

The Five Fakes You Will Actually Receive

Nearly every scam DM is a variant of one of these. The tells are consistent.

Different stories, one structure: urgency, then a link or a code request.
Type	What it says	The tell
Copyright violation	Your account will be deleted in 24 hours	Instagram uses in-app notices, never DMs
Verification offer	We can get you the blue badge	Verification is never sold or offered by DM
Giveaway win	You won – click to claim	You never entered, and there is a fee
Brand collaboration	We want to pay you to post	They ask you to pay shipping or a fee first
Hacked friend	Can you help me with a code?	Nobody legitimate ever needs your code

The Tells That Work Every Time

You do not need to recognise the specific scam. These signals catch essentially all of them.

It arrives as a DM at all. Instagram communicates account issues through in-app notifications, not messages. Check the official help pages if you are unsure.
Urgency with a deadline. Twenty-four hours, immediately, final warning. Real processes are not this dramatic.
A link that is not instagram.com. Look at the actual domain, not the display text.
Any request for a code. Login codes are the entire security model; no legitimate party asks for one.
Money before money. Paying a fee to receive a payment is always a scam.
An account created recently with few posts and a follower count that does not match its claims.

Anatomy of a fake Instagram DM highlighting the urgent deadline, the misspelled sender handle, the blue tick typed as text — Five tells, all visible before you tap anything.

How to Check a Suspicious DM in 30 Seconds

A quick sequence that settles it without clicking anything.

Read the Handle Character by Character

Impersonators use lookalikes: a zero for an O, an added underscore, a doubled letter. The display name is easy to fake; the handle is where the tell lives.

Open the Profile, Not the Link

Check the join date, the post count and the follower ratio. A brand account created last month is not a brand account.

Check for the Real Verification Badge

A tick inside the message text is just a character someone typed. Only a badge beside the handle on the profile counts.

Long-Press the Link to See Where It Goes

Preview the destination without opening it. Anything other than instagram.com is not from Instagram.

Verify Through a Channel You Chose

If it claims to be a brand or a friend, contact them somewhere else. Do not reply in the thread to ask whether the thread is real.

What to Do If You Already Clicked

This happens to careful people. Speed matters more than embarrassment.

Change your password immediately, from the app rather than any link in the message.
Turn on two-factor authentication if it is not already on. This is the single highest-value step.
Check active logins in your security settings and remove anything you do not recognise.
Check for a changed email or phone number – attackers change these first to lock you out.
Warn your followers if messages were sent from your account.
Report the original DM so Instagram can act on the sender.

Real Brand Outreach vs Fake

Genuine collaboration offers do reach creators by DM, which is why this one fools people. The differences are consistent.

A real brand will never need money from you before paying you.
Signal	Real	Fake
The ask	Discuss a campaign	Pay a fee or click to claim
Account	Established, verified where expected	New, few posts, odd handle
Detail	References your actual content	Generic, could be anyone
Process	Contract, brief, invoice	Immediate link or payment
Pressure	Normal business timelines	Reply today or lose it

This is also why legitimate outreach is written carefully. The patterns that make Instagram DM outreach work are the opposite of the ones scammers use.

Five recovery steps after clicking a fake Instagram DM link: change the password from inside the app — If you clicked, order matters. Contact details are what attackers change first.

Stopping Impersonation of Your Own Brand

If you run a business account, the more damaging version of this is someone copying you and messaging your customers.

Search your own name periodically for lookalike handles.
Report impersonation through Instagram’s dedicated form rather than a generic report.
Tell customers how you actually contact them, and put it somewhere public.
Never ask customers for payment in a DM – it makes impersonation trivially easy.
Reply fast to real enquiries; an unanswered inbox is where impostors get traction. That is where a managed inbox pays for itself.

An Answered Inbox Is Harder to Impersonate

DMpro answers real customer DMs, comments and mentions in your own tone across six channels, so genuine enquiries get a fast reply and your customers learn what your real voice sounds like.

It runs in your own session and never asks for your password. Free plan with 250 conversations a month; see pricing.

DMpro Features

Answers real enquiries so customers learn your genuine voice
Runs in your own session and never asks for your password
Flags and holds anything that looks like a scam thread
One inbox across six channels, so impostors have less room
Saved replies for the questions scammers imitate

DMpro Pros

No password means no credential risk
Fast replies leave impostors less space
Keeps a record of every real conversation
Free plan, no card

DMpro Cons

Will not remove an impersonating account for you – that needs Instagram’s form

Conclusion

Fake Instagram DMs come in five flavours and share one structure: urgency, then a link or a request for a code. Instagram does not contact you about your account by DM, and no legitimate party ever needs your login code.

Check the handle character by character, open the profile rather than the link, and verify through a channel you chose yourself.

If you clicked, change the password and enable two-factor authentication now – and if you run a business account, remember that an unanswered inbox is exactly where impostors do their best work.

Reply Before an Impostor Does

Start free with DMpro and answer every genuine enquiry automatically across six channels.

Secure your inbox, free

Frequently Asked Questions

1. Does Instagram Ever Send You a DM?

Not about your account. Instagram delivers account notices, copyright claims and policy warnings through in-app notifications and the official support flow, never as a direct message. Any DM claiming to be from Instagram about your account is fake, regardless of how official it looks.

2. How Do I Know If an Instagram DM Is a Scam?

Look for urgency plus a link, a handle with a lookalike character, a blue tick typed inside the message rather than shown on the profile, a recently created account, or any request for a login code or an upfront fee. Any one of those is enough.

3. What Happens If I Clicked a Link in a Fake DM?

Change your password from inside the app immediately, turn on two-factor authentication, then check your active login sessions and your registered email and phone number. Attackers change contact details first to lock you out, so verifying those matters as much as the password.

4. Why Do Scammers Ask for a Verification Code?

Because the code is the account. A login code sent to your phone is the second factor protecting you, so anyone who obtains it can sign in as you. No legitimate person or company will ever ask for it, including friends whose accounts have already been taken over.

5. Are Brand Collaboration DMs Real?

Some are, which is why this scam works. Real offers reference your actual content, come from established accounts and follow a normal process of brief, contract and invoice. Fakes ask you to pay shipping or a fee first. A brand paying you never needs your money first.

6. How Do I Report a Fake Instagram DM?

Open the conversation, use the report option in the thread, and choose the reason that matches such as spam or pretending to be someone else. If the account is impersonating you or your business, use Instagram’s dedicated impersonation form rather than a general report.

7. How Do I Stop Someone Impersonating My Business?

Search your brand name periodically for lookalike handles, report impersonation through the dedicated form, publish how you actually contact customers, and never request payment in a DM. Replying quickly to genuine enquiries also reduces the room impostors have to operate.

[elementor-template id="24702"]