What it means
Instagram's Emails from Instagram area records direct account communications that Meta identifies as authentic within the app. A DM from a profile called Support is user-generated content, even if it uses a logo or a verified badge. Meta explicitly says Instagram does not send account-security instructions by DM. The sender address shown in an email can be spoofed or visually imitated, so a familiar-looking address alone is weak evidence.
A real-world example
A person receives a DM saying their account will be disabled unless they send a six-digit code. They also receive an email with the same story. Neither the DM nor the email button should be treated as the path to act; they open Instagram independently and inspect its account notices and settings.
What to do
Open the app from its normal icon, inspect Emails from Instagram or the Support Inbox, and check the relevant security setting directly. Report the DM, do not share a code, and review sessions if you already interacted. If an actual account change appears, secure the account through Meta's recovery controls.
The distinction that matters
An authentic communication record shows what Instagram sent; it does not guarantee that every alleged account change is safe or that a message will stay in the history forever. A genuine notice can describe a malicious change. A verified-looking sender profile, a mail logo and a countdown cannot substitute for checking the account itself.
Meta Instagram security advice
