Instagram scam steals your selfies to trick your friends

What would you do if a friend of yours set up a NSFW account, and then used it to follow you on Instagram? Would you check it out?

We recently learned of a group of friends who had to ask themselves exactly that. Fortunately, they realised that something was off. The account wasn’t the real owner’s, it just used her identity and left her with a mess to clean up.

A scam “NSFW” profile using safe-for-work pictures stolen from a legitimate account

We learned about the scam from Malwarebytes’ former social media guru, Amanda, who was one of its targets. She graciously allowed us to use her screenshots in this article in the interests of teaching others about the scam.

It started with Amanda’s real Instagram account, her name, her pictures, and her followers. The scammers used them to create a simple “NSFW” Instagram account designed to look like it belonged to her, and then tried to lure her friends into visiting it by following them.

Friends who checked out the new account saw a face they recognised in a context they didn’t: An Instagram account that promised it’s “NOT SAFE FOR WORK” and “FOR YOUR EYES ONLY”. The public account had no posts, just a story with another stolen picture and a caption urging visitors to “VISIT MY PROFILE ON NAKED SITE”, where they were promised access to a limited number of slots for “exclusive content”. The profile included the URL of a Wix.com website that described itself as “my secret account”.

Scammers know that their websites are unlikely to stay up for long before being blocked, so services like Wix that make it easy to create professional-looking sites quickly, for free, are used to create “burner” websites that are here today and gone tomorrow.

The site featured another photo stolen from Amanda’s Instagram account as its profile picture, surrounded by NSFW and pornographic stock art.

Of course, this wasn’t a “secret account”, there were no “FREE LIVE SHOWS”, and there was no “private content”. In fact there was barely a site. There was just enough to lure in anybody whose curiosity had got the better of their critical thinking skills.

A Wix “burner” website using a stolen profile picture

Click on a link (any link at all) and you’d end up at a different domain, at an unbranded “age verification” page hungry for an email, username, and password, so you could “JOIN NOW”.

If you’d found yourself here and wondered why it looks nothing like the site you started on, the clue is in the URL: The long SID parameter is likely an affiliate code. This tells the owner of this site which affiliate sent the traffic here (and who they should pay for providing it). The affiliate stole Amanda’s identity to get you here, but the owners of this site may not know about that, and may not care.

Eagle-eyed readers will also have noticed that an email, username, and password don’t say anything about how old you are, and this rabbit hole didn’t end here.

An unbranded age verification page

What the scammers really wanted, all they ever wanted, was your credit card number. Underneath the bold “Free Verification” banner, the small print reveals what this is really all about—tricking people into joining expensive subscription services.

Your access to Nightly Encounter includes a 2 day free trial promo to Locating Someone Special Nearby. If you choose to remain a member of Locating Someone Special Nearby beyond the trial period, your membership will renew at thirty nine ninety nine.

Fortuantely for us, a fake credit card was enough to get us through the door and explore a bit further without rewarding the scammers.

The “Free Verification” page wants your credit card details

If you’d got this far, the scammers would have known a number of very important pieces of information about you. Your ID and credit card details, obviously, but also something else that’s valuable too—that you are willing to hand those things over.

And if they got you to do it once, why not try to do it again?

Handing over your credit card wouldn’t get you to the long-ago promised NSFW content starring your friend, or even Nightly Encounter or Locating Someone Special Nearby, whatever they are.

Instead, you’d find yourself on a different site, entering yet another username, password and email into a different “Secure Billing Platform” so another affiliate gets paid for serving you up on a platter.

Yet another “secure billing platform”

Your reward? Another request for your credit card details, for another subscription you didn’t need.

At this point (and to no small relief) our fake credit card details lost their magical powers of persuasion and would couldn’t go any further.

The end of the road

It’s not unusual for victims to double down as doubts start to creep in, and the scammers are ready to squeeze every last penny, and every last vestige of hope, from their victims.

If you are the victim of an ID theft like this, report the scam accounts and sites to the platforms operating them. The Instagram account used in this scam is gone and, to its huge credit, Wix removed the scam site within literal seconds of being alerted to it.

If photos you own are used without your permission then the scammer has violated your copyright. You can take action by filling in a DMCA takedown form.

Unfortunately we can’t offer you much for the shock and alarm of finding your public persona twisted by scammers in search of a few affiliate dollars, but you have our sympathy.