The 'copyright violation' message that steals Instagram accounts: how the scam works and what to do if you clicked

It arrives in the evening, usually. A message, sometimes a story mention, from an account with a blue tick in its profile photo and a name like “Meta Copyright Center” or “Instagram Support Team”. Your account, it says, has been reported for copyright infringement. Unless you appeal within 24 hours through the link provided, it will be permanently deleted. The link opens something that looks exactly like Instagram’s login screen.

We have now seen this message in eleven languages. It is the single most common way the accounts we recover were lost.

The kit, step by step

The operation is industrial. Phishing kits that impersonate Meta’s copyright notices are sold as packages: a lookalike domain, a copy of the login page, a script that forwards credentials to a Telegram channel in real time, and a template message in the target’s language. The person messaging you is often not the person who will use your password.

The sequence is consistent:

1. The hook. A copyright accusation, chosen because it is plausible to almost anyone who has ever posted music or a photo, and a deadline, chosen because urgency stops people checking.
2. The page. A near-perfect copy of Instagram’s login at a domain like instagram.com-help-center.net or a shortener that hides it. Some kits now ask for the two-factor code on a second screen, which defeats SMS-based protection entirely.
3. The takeover. Within minutes the attacker logs in, changes the email, then the phone, then the password, and enables their own two-factor authentication. If you had an authenticator app rather than SMS, they usually cannot complete this step, which is why the app matters.
4. The use. Depending on the buyer: crypto and “investment” stories sent to your followers, a rename and resale, or the same phishing message sent from your account to everyone who trusts it.

How to tell it is fake in ten seconds

Meta does not deliver copyright notices by direct message, story mention or comment. Official notices appear in the app’s support inbox (Settings, then Help, then Support requests) and in email from domains ending in meta.com, instagram.com or facebookmail.com. Everything else is a costume.

Other tells, in the order you will notice them:

• The sender’s account was created recently or has few posts, no matter how official the name or the badge in the profile photo looks.
• The link does not start with https://www.instagram.com/ or https://help.instagram.com/. Anything before or after those, including instagram.com.appeal-form.org, is a different site.
• The deadline is hours. Real intellectual property processes give days and provide a reference number.
• The message asks you to log in to “verify” or “appeal”. Instagram never needs your password to process an appeal; you are already logged in.

If you clicked and typed your password

Speed matters more than anything else. The attacker is working the same minutes you are.

Still logged in? Change your Instagram password now, from inside the app. Then go to Settings, Security, Two-factor authentication and switch to an authenticator app. Then change the password of the email account attached to Instagram and check that inbox for forwarding rules you did not create.

Already locked out? Open the email account that was attached to Instagram and search for messages from Instagram about changed details. Each carries a link to revert the change. Use it immediately; those links do not last. If they are gone, go to instagram.com/hacked and run the identity check: a code to your original contact if the attacker left one attached, a video selfie, or an ID check for business accounts. Secure the email account first or the codes will be read by the wrong person. The full sequence is in our hacked account recovery guide.

Followers being messaged from your account? Tell people from a channel you still control that the account is compromised. Ask a few close contacts to report the account as hacked from within the app. Screenshot the scam content with timestamps; it supports both the recovery and any later disable appeal.

What to do with the message itself

Report it from the message thread as a scam, then block. If the sender impersonates Meta, add a report through the impersonation form as well; those accounts come down faster when several targets report them. None of this recovers your account, but it shortens the sender’s run.

Why this keeps working

The scam borrows Instagram’s own vocabulary. Copyright strikes are real, deadlines are real, appeals are real. The kit inverts one detail, the delivery channel, and counts on the fact that most people have never seen an official notice and cannot compare. The defence is boring: know where real notices live, use an authenticator app, and never type a password into a page you reached from a message.

When to get help

If the attacker has changed every recovery detail and the identity check has failed, or if the account was disabled for scam content while hijacked, the order of steps starts to matter in ways that are easy to get wrong. That is the casework behind our hacked account recovery service: evidence prepared for a one-pass review, filed through Meta’s official channels in the right order, with a written record. No hacks, no insider contacts, no guaranteed outcomes, and a free case review before anything else.