Deepak Gupta

Instagram "copyright violation" DM: is it a scam?

Do not click it. Instagram says it will never contact you about your account's security through Direct Messages. Check Recent emails in your settings to see what Instagram really sent. If you already entered your password on the link, go to instagram.com/hacked right away and follow the on-screen instructions.

Do these 3 things now

1Do not click the link or reply. Instagram does not send account warnings by DM.Read to them:“Do not click the link or reply. Instagram does not send account warnings by DM.”
2If you typed your password into the link, go to instagram.com/hacked now, or change your password if you can still log in.Read to them:“If you typed your password into the link, go to instagram.com/hacked now, or change your password if you can still log in.”
3Do not reply to anyone offering to "fix" your account or the copyright problem for you.Read to them:“Do not reply to anyone offering to "fix" your account or the copyright problem for you.”

Secure your account at instagram.com/hacked

Official link: www.instagram.com

I am helping someone else

Helper mode: each step is written for you to read aloud. Let them tap and type on their own device; never ask them to send you a code. Send them this first.

01Is this you?

A DM or email says your account broke copyright or community rules and will be deleted soon.
The message pushes you to click a link and log in, or fill in a form, to "appeal" or "verify".
The sender is an account named like Instagram, Meta, a support team or a copyright office.

Not quite? Instagram really disabled my account · I entered my password and now I am locked out · Fake support and recovery scams

02Official recovery path

Do not tap the link. Instagram says not to click links or attachments in any suspicious email or message claiming to be from Instagram.Read to them:“Do not tap the link. Instagram says not to click links or attachments in any suspicious email or message claiming to be from Instagram.”source
Check what Instagram really sent: click More > Settings > Meta Account > Login and security > Recent emails. Security emails from the last 14 days are under Security.Read to them:“Check what Instagram really sent: click More > Settings > Meta Account > Login and security > Recent emails. Security emails from the last 14 days are under Security.”Websource
To see if any of your content was actually removed, click More > Settings > Account Status.Read to them:“To see if any of your content was actually removed, click More > Settings > Account Status.”Websource
Report the message as a scam to Instagram. Forward suspicious emails to phish@instagram.com.Read to them:“Report the message as a scam to Instagram. Forward suspicious emails to phish@instagram.com.”source
If you entered your password, change it now and log out devices you do not recognize in Password and security > Where you're logged in.Read to them:“If you entered your password, change it now and log out devices you do not recognize in Password and security > Where you're logged in.”source
If you can no longer log in, go to instagram.com/hacked and follow the on-screen instructions.Read to them:“If you can no longer log in, go to instagram.com/hacked and follow the on-screen instructions.”source

Did that get you back in?

Yes

Lock it down now. Change the password, turn on two-step, sign out other devices. It takes about 15 minutes.

No

A.If the hacker already changed your email or phone, follow the email and phone changed steps.Read to them:“If the hacker already changed your email or phone, follow the email and phone changed steps.”source
B.Turn on two-factor authentication so a stolen password alone is not enough next time.Read to them:“Turn on two-factor authentication so a stolen password alone is not enough next time.”source

Then: how long it takes

03How long it takes

No published timeline

Instagram does not publish a timeline. Act fast: change your password as soon as you know you typed it into a fake page.

04Warn your contacts

Send this from another account or by text, so nobody falls for messages sent in your name.

Heads up: fake "Instagram copyright" DMs are going around. If you get one, do not click the link. If my account sends you anything like that, it is not me.

More templates: email, followers, customers

05Watch out for recovery scams

People who just lost an account are the main target of fake helpers. Only Instagram's own app or website can restore your account.

Fake "copyright violation" or "verification" messages that say your account will be deleted unless you click a link and log in. How it works
DMs from accounts calling themselves Instagram or Meta support. Instagram says it will never contact you about profile security through Direct Messages. How it works
People claiming to be from Instagram security who ask for your username or password, or offer to verify your account. Instagram lists both as signs of a scam. How it works

All recovery scams and how to spot them

06Once you're back in: lock it down

0 of 9 doneAbout 18 minutes total

Change your password to one you use nowhere else2 minOn the web, click More > Settings > Accounts Center > Password and security > Change password, pick the account, and enter your current and new password. Instagram says to use at least 6 numbers, letters and punctuation marks. Changing it logs out every other device.source
Turn on two-factor authentication with an authentication app4 minClick More > Settings > See more in Accounts Center > Password and security > Two-factor authentication, then pick your account. Choose Authentication app, which Instagram recommends over text message. You can only turn on the app method from the Instagram app for iPhone or Android.source
Save your backup codes somewhere safe2 minIn Password and security > Two-factor authentication, pick your account, then click Additional methods > Backup codes. Save them offline. A backup code gets you in when a login code cannot reach you.source
Log out devices you do not recognize2 minIn Password and security, click Where you're logged in, pick your account, then click Select devices to log out. Select anything you do not recognize and click Log out.source
Check your email and phone number are yours1 minConfirm the email address and phone number in your account settings are correct and that only you can reach them. These are where Instagram sends login links and codes.source
Remove linked accounts you do not recognize1 minOpen Accounts Center and check which Facebook, Instagram and Meta accounts are added. Remove any account you do not recognize.source
Remove third-party apps you do not trust2 minClick More > Settings, then below Your app and media click Website permissions > Apps and Websites > Active. Click Remove next to anything you do not use or trust, especially apps that promised likes or followers.source
Secure the email account tied to Instagram3 minInstagram says anyone who can read your email can probably get into your Instagram too. Give that email account its own strong, unique password and turn on its two-step sign-in.source
Learn where to check real Instagram emails1 minClick More > Settings > Meta Account > Login and security > Recent emails. Security emails from the last 14 days are listed there. If a "security" email is not in the list, it did not come from Instagram.source

Then do the 24-hour cleanup.

Free toolExposure CheckSee what of yours is already public.Free toolPassword Breach CheckCheck if a password shows up in known leaks.ReadHow to set up two-factor on all your accounts ReadPasskeys vs passwords

07How it probably happened

Most likely
Phishing DMs or emails built to look like an official Instagram warning.
How this scam works
Also common
A fake login page that copies Instagram and steals the password you type.
How this scam works
Less common
A friend's hacked account asking you to vote, join a contest, or send a code. The code is usually a login link or reset code for your own account.
How this scam works

Account taken, recovery details swapped

08Report it

Report an Impersonation Account on Instagram or Threads

Lost money, being blackmailed, or someone is using your account to scam others? Report it to your country's cybercrime service too. If you are in danger, call your local emergency number.

United States

FBI Internet Crime Complaint Center (IC3)Report online crime, including account takeovers that led to money loss or extortion. The IC3 never contacts you first and never asks for money.
FTC ReportFraudReport the scam to the Federal Trade Commission.
IdentityTheft.govUse it if someone used your Social Security number or opened accounts in your name. You get a recovery plan.

United Kingdom

Report Fraud (England, Wales and Northern Ireland)Run by the City of London Police. It replaced Action Fraud on 4 December 2025. In Scotland, call Police Scotland on 101 instead.
Forward scam texts to 7726Free on most UK networks. Your provider can look into the sender and block it.
Report a scam email to the NCSCForward the email to report@phishing.gov.uk before you delete it.
Report Fraud: 0300 123 2040England, Wales and Northern Ireland. In Scotland, call Police Scotland on 101.

India

National Cyber Crime Reporting PortalRun by the Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs. Reports go to state and UT police.
Chakshu on Sanchar SaathiReport suspected fraud calls, SMS or WhatsApp messages to the Department of Telecommunications. It is not for money already lost: call 1930 for that.
National Cyber Crime Helpline: 1930Toll free, 24 hours. Call fast if money left your account: it can help freeze the transfer.

Canada

Canadian Anti-Fraud Centre: report onlineVictims and witnesses can report fraud or cybercrime online. Also contact your local police as soon as you can.
Canadian Anti-Fraud Centre: 1-888-495-8501Toll free. The CAFC does not contact people to ask for money.

Australia

ReportCyberReport cybercrime to police. Your report may go to your state or territory police or the AFP.
ScamwatchReport a scam, even if you lost no money. The AFP also points people worried about identity theft to IDCARE, a free support service.
ReportCyber phone line: 1300 292 371Report concerns about cybercrime or cyber security incidents. If life is at risk, call 000.

09Questions people ask

Does Instagram send copyright warnings by DM?

Instagram says it will never reach out to you about profile security through Direct Messages. Official security messages go to your email, and you can check them in Recent emails in your settings.

Which email addresses does Instagram really use?

Instagram lists @support.facebook.com, @support.instagram.com, @facebookmail.com, @mail.instagram.com and @global.metamail.com for security emails.

I clicked the link but did not log in. Am I hacked?

Instagram's phishing advice is about entering your username or password into a strange link. If you did not, do not go back to the link, report the message, and turn on two-factor authentication for extra protection.

I typed my password in. What now?

Change your password right away and log out devices you do not recognize. If you cannot log in, go to instagram.com/hacked.

How are real copyright reports made?

Instagram takes copyright reports from rights owners through its own report form. Its copyright help pages are on help.instagram.com.

Sources and last check

Last verified: October 16, 2026. Steps checked against the platform's own help pages listed below. Device testing is ongoing; steps marked unconfirmed are still waiting for it.

Instagram Help: Protect yourself from phishing on Instagram (read 2026-10-16)
Instagram Help: Review recent emails sent from Instagram (read 2026-10-16)
Instagram Help: Check your Account Status on Instagram (read 2026-10-16)
Instagram Help: Avoid getting scammed on Instagram (read 2026-10-16)
Instagram Help: View your recent Instagram login activity (read 2026-10-16)
Instagram Help: Two-factor authentication (read 2026-10-16)
Instagram: My Instagram was Hacked (read 2026-10-16)
Instagram Help: Hacked Instagram account (read 2026-10-16)

Wrong step or changed screen? Report it. Never include passwords or codes.