A fake Instagram support DM asks for a code: stop the handoff

A message that says a blue badge, copyright complaint or account appeal is pending may use a logo and a short deadline to pressure you into sending a one-time code. Meta says Instagram does not send account-security instructions by DM. The code is often the final piece needed to sign in or change a password. Even if the sender appears verified, the badge identifies an account category, not authority to collect your login details.

Before you start​

Do not reply with a password, one-time code, backup code, selfie or identity document. Avoid opening an attachment or installing a 'support' app. If you already sent a code, act as if the account may be compromised, even if the other person says the process failed.

Do it step by step​

1. Capture the sender's handle and message text if needed for a report, without tapping its link. Open Instagram's settings on your own device and inspect Emails from Instagram or the Support Inbox for a matching official notice.
2. Report the suspicious DM from the conversation and block the sender. If they used a lookalike account, report the profile as impersonation or scam as appropriate. Do not post their link publicly to warn friends.
3. If you revealed a password or code, change the Instagram password from the genuine app immediately. Use a unique password and change any reused copy on other sites. Secure the connected email account and its recovery methods.
4. Review Where you're logged in, sign out unknown sessions and check whether the account email, phone or two-factor method changed. Enable or repair two-factor authentication and keep backup codes in a separate secure location.
5. Check outgoing messages, posts and profile links for attacker changes. Let contacts know through another channel if the account sent them requests for money, codes or suspicious links. A private warning is more useful than repeating the scam URL.
6. If access has already been lost, use Instagram's official hacked-account help. Keep evidence of the message and transaction if money or documents were sent, and contact the relevant financial institution directly using its known number.

Check the result​

No account settings or sessions remain unexplained, and the sender is reported through Instagram's own controls. Your contacts have a clear warning if they received messages from your account.

If something goes wrong​

If the in-app email history is empty, that supports treating the DM as fake; do not keep trying its link. If the account is locked, recovery may ask for ownership verification. Be wary of replies offering paid recovery; these are often a second scam aimed at victims.

Know the limit​

Blocking the DM stops contact from that profile but cannot revoke a code already shared. A verified badge is not a license to request credentials. Reports may take time, and the same actor can create another account, so protect the login route rather than relying on one block. Instagram's no-security-DM warning Verified-badge explanation