Instagram Users Losing Money to Fake Copyright Claim Scams

The BBC reports that Instagram users are being targeted by scammers who send fake copyright infringement notices, then demand payment to avoid account suspension. The scam works by impersonating Instagram's official copyright reporting process, sending messages that appear to come from Meta and warning that the user's account will be suspended unless they respond quickly. Victims are then directed to fake support channels where they are asked to pay a fee or provide payment details. The BBC reports that users are losing money and in some cases having their accounts suspended anyway, while Meta's systems struggle to identify and remove the scammers quickly enough to prevent harm.

Why this matters for UK organisations

This is a social engineering attack that exploits the fear of losing access to an account that may have significant personal or business value. For UK businesses that use Instagram for marketing, customer engagement or brand presence, the risk is that staff managing those accounts may fall for these scams, leading to financial loss, account compromise or reputational damage. The broader issue is that platform-based scams like this are difficult to defend against through traditional technical controls, because they rely on convincing users to take action outside the normal security boundaries of the organisation. The defence relies on awareness, clear processes for verifying unexpected account warnings, and making sure that staff know how to escalate suspicious messages rather than responding directly. The fact that Meta's own systems are struggling to identify and remove these scams quickly enough highlights the challenge of relying solely on platform-level protections.

What to review

For UK businesses with Instagram accounts managed by marketing or communications teams, make sure those teams know how to verify unexpected copyright or account suspension warnings, and that they have a clear route to escalate suspicious messages rather than responding under pressure. Consider documenting what legitimate Instagram copyright notices actually look like, and where they come from, so staff can compare suspicious messages against known good examples. Review whether your organisation has a process for managing social media account security incidents, including who to contact if an account is compromised, how to regain access, and how to communicate with customers if the account is used to post malicious content. Consider whether social media account credentials are managed through a password manager, whether multi-factor authentication is enabled, and whether access is limited to only those staff who need it. Review whether your organisation has considered the business impact of losing access to key social media accounts, and whether contingency plans are in place.

Source: BBC News