You get a DM from a friend’s account asking if you got the money they sent, or a message from “support” saying your account will be suspended in 24 hours. Your stomach drops a little, and your thumb is already moving toward the reply box. That split second, the one between seeing the message and reacting to it, is exactly where scammers want you. Slow down and it usually falls apart.
Direct messages have become one of the easiest ways for scammers to reach people, mostly because DMs feel personal and private in a way email doesn’t. A message from a “friend” on Instagram or a “brand” on X carries built-in trust that a random email never gets. Scammers know this, and they lean on it hard.
Here’s how to size up a DM before you tap, reply, or type anything.
Check Who’s Actually Sending It
The display name is the easiest thing to fake. A profile can say “Sarah Johnson” and use your actual friend’s photo, but the account behind it can be brand new and based nowhere near her.
Look past the name to the account itself. Tap the profile and check a few things:
- How old is the account, and does it have a normal posting history, or does it look freshly created with almost nothing on it?
- Does the follower-to-following ratio look strange, like thousands followed and almost no one following back?
- Are there small differences in the username, like an extra underscore or a swapped letter, compared to the account you think you know?
- Does the profile photo look like something pulled from a public post, maybe as a reverse image search would show?
If a message claims to be from a company, that account should be verified or clearly linked from the company’s real website. Real support teams also don’t usually slide into your DMs first. If you didn’t contact them, be skeptical that they contacted you.
Notice the Pressure, Not Just the Words
Scam messages are built to make you act before you think. Whatever the wording, the goal is the same: get you moving before you can consider it.
Watch for these pressure tactics:
- A deadline that’s suspiciously short, like “respond in the next hour or your account is locked”
- A reward that requires quick action, like a giveaway that expires today
- A problem that sounds urgent and scary, like a claimed security breach or a frozen payment
- Language that discourages you from checking with anyone else, like “don’t tell anyone, this is time-sensitive”
Real organizations rarely need an answer in minutes. If a message is pushing you to hurry, treat that pressure itself as a warning sign, separate from whatever the message claims is happening.
Be Wary of Links, Even From People You Know
A link in a DM can lead to a page built to steal your login, not the site it claims to be. A stolen login is often the whole point: once a scammer gets into one account, they can send the same message out to that person’s friend list, and it looks legitimate because it’s coming from someone real.
Before tapping any link in a DM:
Hover or long-press to preview the actual URL, if your app allows it, rather than trusting the visible text. A link that says “instagram.com” in the message can point somewhere else entirely.
Check for lookalike domains. Small substitutions like “arnazon” instead of “amazon,” or an extra word tacked onto a real brand name, are common and easy to miss on a small phone screen.
Assume any login page reached through a DM link is fake until proven otherwise. If a message says to log in to verify your account, open the app or site yourself instead of clicking through. For more on catching a fake page before you type anything into it, see How to Spot a Fake Login Page Before You Type Your Password.
If a friend’s account sends you a link that feels out of character, even something small like a strange writing style or a link with no context, reach out to them through a different channel to check it’s really them. A quick text asking “did you just send me something on Instagram?” takes ten seconds and can save both of you a headache.
Recognize the Common Scam Setups
A few patterns show up over and over across platforms, just with different costumes.
The compromised friend. A message from someone you actually know, but their account has been taken over. It might ask you to click a link, vote in a contest, or send money urgently. The account is real; the person behind it right now isn’t.
The fake giveaway or brand promo. A company account, often impersonating a real brand, says you’ve won something and just need to “verify” your details or pay a small shipping fee. Real brand giveaways don’t usually ask winners to pay anything upfront.
The romance or relationship approach. A new follower strikes up a friendly conversation that turns personal fast, eventually leading to a request for money, gift cards, or personal information. Adults are targeted this way regularly, and similar trust-building tactics show up when predators target kids online. If you’re a parent, it’s worth understanding how predators use shared interests to build trust with kids, since the two patterns have real overlap.
The fake job offer. A DM offers easy pay for simple work, often “reshipping” packages or “processing payments,” and eventually asks for personal or banking details. Job seekers, including students looking for part-time or seasonal work, are common targets; see Job Scam Alerts as Students Look for Part-Time Work This Fall for more on how those specifically play out.
The tech support impersonation. A message claims to be from the platform itself, warning about a policy violation or security issue, with a link to “resolve” it. Platforms almost never initiate contact this way.
What to Do Before You Respond
A short mental checklist covers most situations:
- Don’t click any link or download any file until you’ve verified the sender through a separate channel.
- Don’t give out a verification code, password, or personal information in a DM, ever, regardless of who’s asking.
- Report and block accounts that show clear scam patterns rather than engaging with them.
- If the message claims to be from someone you know, confirm with that person directly, outside the DM thread.
- If you’ve already clicked something or entered a password, change that password right away and check your account’s login activity. A password you can actually remember, built the right way, makes this kind of recovery easier; see Choosing a Strong Password That’s Actually Easy to Remember.
Keeping your accounts patched matters here too. Platforms regularly close off the exact tricks scammers use to hijack accounts, which is part of why turning on automatic updates, even when the timing feels annoying, is worth doing.
A scam DM only works if it gets a fast, unguarded reaction. The moment you pause to check who’s actually sending it, whether the pressure is real, and where a link actually leads, most of these messages stop working. That pause is the whole defense, and it costs you nothing but a few seconds.
A quick safety note
This article is general information, not professional security, legal, or medical advice. No single tool or setting makes anyone completely safe; security works in layers. If you are dealing with a live incident, such as active fraud, ransomware, or a child in danger, contact the appropriate professionals or authorities. For a threat to a child, report it to the NCMEC CyberTipline at report.cybertip.org and to local law enforcement.
