The "verification link" scam is phishing. Someone messages you claiming to be Instagram, Meta or TikTok, saying a blue badge, a partnership or a violation appeal is waiting for you, and the link leads to a fake login page that steals your password and your confirmation code. Platforms never send offers like that in direct messages. If you have already typed your details in, you have a few minutes. Change the password, end the intruder's sessions and go through the official flow for hacked accounts.
How the mechanism works
The variants look different at first glance, but they nearly all follow the same sequence.
- You get a direct message, an email or a comment. It says your account has been approved for a blue badge, that a copyright violation has been found and you have 24 hours to appeal, or that a brand wants a paid partnership with you. The tone almost always pairs a reward or a threat with urgency.
- The link opens a page copied almost pixel for pixel from the real one. The logo, the fonts and even the privacy text are the same. The address is different, though. Instead of instagram.com you see something like instagram-verify-badge.com, meta-support-help.net, or a shortened link that hides where it really goes.
- You enter your email and password, and the page also asks for the six-digit "confirmation" code. That is your two-factor code, and the moment you type it in, it reaches the scammer, because they are logging in with your real password at that exact moment.
- Within minutes the email and phone number on the account are changed, your sessions are ended, and the profile is often renamed. Messages then go out to your contacts with the same bait, or a ransom demand comes your way instead.
The whole cycle from the click to losing access takes under ten minutes.
The signs that give a fake message away
- The platform messages you first in DMs. Instagram, Meta and TikTok communicate through in-app notifications and email from their own domains, not through profiles like "Meta Support Team 2026".
- The address is not the real domain. The genuine ones are instagram.com, facebook.com, tiktok.com and their subdomains, and anything with an extra hyphen, word or ending belongs to someone else. On a phone, press and hold the link to see the full address before you open it.
- There is pressure to act immediately. This is a warning sign, but genuine procedures can have deadlines too. Verify the notice through the app or official help centre.
- A confirmation code is requested. A 2FA code only ever gets entered in the app itself or on the official site at login, and anywhere else asking for it is stealing it.
- The wording is slightly off, though this sign has become less reliable now that scammers draft their messages with language models.
Other variants of the same scam
The verification link is only the most popular version. The same mechanism turns up in the following forms as well.
- A copyright violation message claiming your page will be deleted within 24 hours over a complaint, with a link to "appeal". It plays on fear and works particularly well against business pages. A genuine copyright claim looks quite different and shows up in a specific place inside the app, see removal on a claim.
- An advertising or partnership invitation from a familiar-sounding brand, paired with a file that contains malware or a link that asks you to log in with your account.
- A Business Manager invitation. This is a genuine Meta feature, but if you accept an invitation from an unknown "partner", you give them a role over your assets. Check every invitation in Business Settings before accepting it.
- A message claiming someone has requested your username and you must "confirm ownership". No platform runs a procedure like that.
- A "Help Center Team" profile that appears in the comments under a post where you are complaining about a problem, offering to help over direct message. Real support does not operate that way.
Every one of these variants is chasing the same goal. They want you off the platform and onto their link, typing in your details, while everything genuine happens inside the app itself.
If you manage client accounts
For agencies and freelancers the risk multiplies, because one successful phishing attempt against you gives access to every client account you manage as well. As a minimum we recommend the following.
- A separate work profile for access, with no public visibility.
- Roles through Business Manager instead of shared passwords. Never send passwords over chat, whatever the circumstances.
- Two-factor authentication on every account.
- A monthly check of who has access to what.
It also helps to have a client agreement that settles in advance who is responsible if a breach happens.
If you have already clicked the link
What to do next depends on how far you got.
You only opened the page without entering anything. The risk here is small. Close it, do not download anything from it, and change your password through the app as a precaution.
You entered a password but not a code. Change the password right away, from the app or the official site, then review the active sessions in your security settings and end anything unfamiliar. Turn on two-factor authentication if you still do not have it.
You entered both a password and a code, or you can no longer log in at all. Work through this in order.
- Try logging in and "Forgot password" straight away, because if your email is still attached to the account, you will beat the change.
- Search your inbox for an email-address change notice and verify the sender and link destination. If an official reversal option is available, follow its instructions. Do not assume the link remains valid for days.
- Go through the official flow for hacked accounts, instagram.com/hacked or facebook.com/hacked. You log in with a username or an old email and reach identity verification, including a video selfie for accounts with photos of your face.
- On TikTok, use the feedback form describing the issue as "hacked account" along with your profile details.
- Tell your followers through another channel that scammers are posting from your profile, so nobody else falls for it.
Do not pay an unverified contact promising guaranteed recovery. Payment does not establish that the person has platform access or can restore the account.
Making the next attempt fail
Human error sits behind most breaches; recent editions of the annual Verizon DBIR report put it at roughly two thirds of incidents. A handful of technical habits cut the risk considerably.
- Two-factor authentication through an app, such as Google Authenticator or Authy, rather than SMS, since SMS codes are vulnerable to SIM swapping and get typed into fake pages out of habit.
- A passkey wherever the platform offers one. It cannot be entered on a fake site, so phishing does not work against it.
- A unique password for every platform, kept in a password manager, so a password leaked from an old forum does not open your Instagram account too.
- A review of connected apps every few months, removing anything you no longer use.
- Open the app or help centre independently and verify the message there. The sender’s name and logo do not establish identity.
If the profile is already stolen, the email has been changed and the standard forms keep going in circles, that is exactly the kind of case we handle every day. Describe the situation in as much detail as you can and send it in for a free assessment. With hacked accounts timing matters, so note down exactly when the breach happened.
Official sources
Checked on 15 October 2026.