Hacker News Reader

Comment by nicoburns | Hacker News Reader

I got a similar scam via instagram DMs recently. They claimed to need me to confirm a code so that they could log in, but actually just triggered my own password reset. Message sent from an actual friend's account (which they had presumably successfully scammed) too.

Certainly made me think about how password reset emails are worded!

View on HN

Most of those are crypto scams. The IG account starts posting about how they got rich on crypto. This is a very prevalent scam.

I see a lot of these too. They take over regular people's accounts, e.g. people from school I still follow, probably brute forcing passwords, then they post all this content how they are self made off crypto but the person in the videos doing the prostelyzation is in no way shape or form the same person who previously held the account.

Clearly they do this to get a decent follower count initially for their spam bots, but my word is anyone who follows John Doe actually going to believe a scam video that is clearly not John Doe coming from John Doe's account claiming to be him? There has to be more effective angles.

I would hope that Instagram has some counter-measures to prevent brute-forcing, at least restricting the number of failed login attempts.

It might be instead that your friends re-used a password that was leaked/stolen from somewhere else; anyone with a non-trivial number of online accounts using the same email will be listed in multiple leaks on aggregators like https://haveibeenpwned.com/.

Part of it is they're just looking for the lowest hanging suckers that won't notice, easier victims mean less wasted effort on someone who might bite initially but won't convert into real cash. Also I'm betting it's to legitimize their existing spam accounts with follows from (formerly) authentic users.

Reply on news.ycombinator.com