It’s estimated that just one in 100 Instagram users are verified – so it’s easy to understand why people want to get a blue tick and join this exclusive club.
Hackers know that tens or hundreds of millions of people yearn to undergo the blessing of verification and are always on the lookout for tips or shortcuts which will allow them to join the online elite.
Tech experts have issued a warning about a series of new scam ‘phishing’ websites which claim to offer verified accounts but are in fact designed to steal victims’ identities.
In one website discovered by researchers at the website security and protection firm Sucuri, people were asked to give login login details for their Instagram and email accounts.
If the target is gullible enough to hand these over, the cybercrooks can sidestep Instagram’s security system, which closes down accounts if it detects any dodginess.
If hackers have access to their victim’s email account, they will be able to bypass the protections and reactivate the account.
‘The login information is sent via email to the hackers,’ the tech firm explained in a blog about the research.
‘This provides them with unauthorized access to the victim’s social media page. Instagram employs fingerprinting and a variety of other methods to determine suspicious account logins. If detected, they lock down the account with a “Suspicious Login Attempt” warning.
‘In order to avoid this account lockdown, attackers need one of two things: access to the phone number used to register the account (if applicable as Instagram doesn’t require a phone number for signup) or access to the email address associated with the profile.
‘This explains why hackers also target associated email login information on this phishing page. It allows them to reset and verify ownership of the phished Instagram account should the “Suspicious Login Attempt” warning be triggered.’
Once inside a victim’s Instagram account, criminals could target them in various ways. They might, for instance, seize their nudes and threaten to release the images to all someone’s contacts unless a ransom is paid.
Sucuri said the hackers were preying on people’s thirst for the beatification offered by a blue tick.
‘While the majority of users may want the verification symbol for bragging rights, having the symbol can also help monetize a social media page,’ it added.
‘This is driving some users to pursue any way possible to obtain the coveted verification checkmark for their profiles.’
The tech security firm summed up the appeal of an Instagram verified account in the following statement: ‘I crave that blue check next to my name.
‘Why? Basically, because none of my friends are verified, so the verification will prove I’m better than them; which I always suspected.’
