Instagram has become the preferred setting for a new wave of virtual scams which, in recent weeks, have left dozens of people without their savings. methodology and, which combines misleading advertising, identity theft and social engineering, has as its target steal bank details and access the victims' accounts to empty them in a matter of minutes.
Instagram Stories, commonly used to display personal or advertising content, have become a gateway for these cybercriminals. Those targeted are, above all, older adults, people with urgent economic needs or those who have less experience in managing digital platforms.
How the virtual scam unfolds on Instagram
El fraud starts with fake ads embedded between stories that any user sees. The images, which look almost identical to official notices—some even created with the help of artificial intelligence—promise unrepeatable offers from recognized banks, with alleged 50% discounts in fuel, services or digital purchases.
By clicking on the button "More information", the user is directed to a website that perfectly simulates that of the real financial institution. There, under the pretext of obtaining the benefit or discount, the entry of personal and banking data: from the ID document to the password and username. Once entered, criminals gain unhindered access to the bank account, from where they make transfers, manage loans and empty funds before the victim can react.
Los recent cases reflect that this modality is extremely fast and efficient. For example, a retired 73 years old She ended up transferring millions of dollars and arranging a loan after being contacted via WhatsApp, after clicking on one of these fake Instagram ads. Another user suffered a loss of $11.000 when his wife entered a token on a fraudulent page, believing it to be a legitimate banking transaction.
How to recognize scam campaigns on Instagram
Detecting these campaigns is possible if you pay attention to some characteristic signs. The main warning signs include:
- Profiles of dubious authenticity: Newly created accounts, with few followers or posts.
- Spelling errors or inconsistencies in the text of the images and descriptions.
- Exaggerated promises: Unusual offers, massive discounts not usually offered on social media, and messages with a strong tone of urgency, such as “limited-time promotion.”
In many cases, fraudulent accounts mimic the names of real banks and companies, adding symbols or spelling mistakes to make them appear authentic.
What to do to avoid falling for a virtual scam on Instagram
Avoiding being a victim of these scams is possible by following a series of basic recommendations:
- Automatically distrust offers that are too good or exclusive promotions shared through unofficial channels.
- Always check the bank's website by entering the address manually in the browser, never from links received via Instagram, WhatsApp, or email.
- Do not share personal information or passwords by any means other than the official channel of the bank or company.
- Enable two-step authentication both on electronic banking platforms and on social networks.
- Do not act under pressure: Scammers want the victim to decide quickly, without thinking.
Where to report if you've been a victim of a virtual scam on Instagram
It's fundamental act quickly if you have fallen into the trap and file a complaint with the relevant authorities. In Spain, you can go to:
- Nearest police station or prosecutor's office.
- Technological Investigation Brigade of the National Police.
- Incibe-CERT, the computer security incident response center (https://www.incibe.es/protege-tu-empresa/incidentes).
- La Internet Security Office (OSI), from where they can guide you through the next steps.
Why Instagram is fertile ground for online scams
La visual, dynamic, and massive nature of Instagram This makes it a very effective channel for the dissemination of these scams. Stories, due to their ephemeral format, generate trust and are often consumed quickly, without the user being able to deeply analyze the legitimacy of the content.
Although Meta, the parent company of Instagram, insists that its regulations expressly prohibit these practices, the constant creation of fake accounts and the sophistication of the methods used make it difficult to completely eradicate the problem. Therefore, prevention and digital education become indispensable.
The role of social engineering and identity theft
The social engineering techniques They play a fundamental role here. Criminals manipulate emotions, exploit trust, and use messages that appeal to urgent needs, such as solving a financial problem or taking advantage of an incredible discount. In many cases, the victim is convinced they are dealing with official staff from a bank or a well-known company.
The response of the authorities and the platforms
Public bodies and technology companies are looking for new ways to combat these fraudsPartnerships with platforms like Meta have intensified to detect suspicious patterns, quickly block fake accounts, and create automated verification and alert systems.
In the case of Spain and the European Union, the registration of trademarks and the improvement of authenticity protocols are also being promoted, with the aim of preventing official bodies, banks or companies are impersonated and that users can easily distinguish between a real offer and a fraud.
Who are usually the main victims?
The older people And those experiencing economic vulnerability are among the main targets of these campaigns. Their poorer command of digital tools, coupled with the allure of "unmissable" offers, makes them easy targets for scammers.
In fact, a large part of the recent allegations involve retirees who, after seeing a fake promotion on Instagram, lost their savings and went into debt on loans they never voluntarily requested.
The proliferation of virtual scams through Instagram continues to grow, driven by increasingly sophisticated techniques and the lack of caution of many users. It is essential to stay informed, be wary of any unusual offers and never provide personal data or passwords unless you are absolutely certain that you are operating on the entity's official channel.
