My followers are getting scam messages from my Instagram

Somebody messages to ask about the investment opportunity you sent them, and you have sent nothing. This is the most common way people find out, and if you can still get into the account you can end it in about ten minutes. The important part is the step most people miss, which is not the password.

Last checked: 15 August 2026. Every official Facebook, Instagram and Australian government link on this page was opened and confirmed working on that date. If you find one that no longer works, please tell us and we will fix it, because a dead link on a page like this is worse than no page at all.

Do this first, and do not stop at the password

Ending the other sessions is the step that stops the messages. Changing the password does not always close a session that is already open, which is why people change it, watch the messages carry on, and conclude nothing works.

1. Change the password, and change it anywhere else you used the same one. If that password was also on your email or your banking, those come first, before the social account.
2. Check the recovery email address and phone number on the account and remove anything you do not recognise. This is the step people skip, and it is the reason accounts get taken a second time a week later.
3. Sign out of all other sessions, so a device the attacker is still holding gets kicked off.
4. Turn on two factor authentication, so a stolen password on its own is no longer enough.
5. Look at what was posted or sent while they had it, so you know what your friends and family received.
6. Tell the people who were messaged, ideally somewhere other than the account that was taken.

What they are sending, and why it works

The messages come from you, to people who know you, which is the entire value of a stolen account. The usual scripts are a cryptocurrency or investment opportunity that has worked well for you, a competition win that needs a small fee to release, and a request to help with a verification code.

That last one is worth understanding properly, because it is how the theft spreads. The message asks your friend to receive a code and pass it on to you. The code is not yours at all, it is the login code for their account, and forwarding it hands their account over too. That is why one stolen account quickly becomes several among the same circle of friends.

How to warn people properly

• Use another channel where you can. A text message or a phone call, because a message from the account itself may not be believed, and may not even be from you yet.
• Be specific about money. Say plainly that any request for a payment, a gift card or a cryptocurrency transfer is not from you.
• Warn them about codes. Nobody should ever pass on a verification code, however convincingly you appear to be asking.
• Post it publicly once on the recovered account, because followers who were messaged will look there to check.

If a follower has already lost money

Tell them to ring their bank today, because the window in which a payment can sometimes be stopped is measured in hours rather than days. Then Scamwatch and ReportCyber, and IDCARE on 1800 595 160 if they would like to talk it through with somebody. It is worth telling them plainly that it is not their fault, because embarrassment keeps people quiet and silence only helps the person who did it.

The offers of help you are about to get

• Anyone offering a phone number. There is no Meta support line. A number is the clearest single sign you are being scammed.
• Paid recovery agents. Services that promise to get your account back for a fee. They have no access Meta does not give you for free, and the usual outcome is that you pay and nothing happens.
• Anyone who messages you offering to help after you post that you have been hacked, especially on Instagram. Watching for those posts is exactly how they find people.
• Anyone asking for an upfront fee, a gift card, a voucher or a cryptocurrency payment. No legitimate service is paid this way.
• Anyone asking for your password or your two factor code. No real Meta process ever asks a person for these. Sharing the code is how the second theft happens.
• Anyone asking to remote control your computer to fix it for you, unless it is somebody you already know and trust.
• A friend asking you to receive a code for them. That friend has already been taken over, and the code is for your account.

Related pages on this site

• Start at the router , if this is not quite your situation.
• There is no Meta phone number , and what the numbers really are.
• Paid recovery services , why none of them are real.
• The full Instagram page .
• The same thing on Facebook .
• Is this message a scam , a 30 second checklist.