Got an email or message saying you’ve been selected for an Instagram verification badge? Before you click anything, you should know this is one of the most well-documented Instagram verification badge scam patterns in circulation, and security researchers have been tracking it for years. This article explains exactly how the scam works, names real documented cases, and shows you the one simple fact that exposes every version of it instantly. See more app and account safety checks on our Apps reviews page.
Instagram Verification Badge Scam: The One Fact That Exposes It
Here is the single most important thing to know: Instagram verification is requested only from inside the app itself, through Settings > Account > Request Verification. Instagram does not send emails inviting users to apply for a badge, does not pre-approve anyone by email, and never asks for your password or a government ID over email to grant one. If a message like this reaches your inbox claiming otherwise, it is, without exception, a scam attempt — regardless of how official it looks.
Instagram Verification Badge Scam: Real Documented Cases
This isn’t a hypothetical warning. Security researchers at Trend Micro documented a long-running Instagram verification badge scam campaign that used emails asking users to “confirm their account” in order to receive a verified badge. Clicking the “Verify Account” button led to a phishing page that harvested the victim’s email address, password, and date of birth — after which attackers would change the account’s linked email and phone number to lock the real owner out entirely.
A separate campaign tracked by email-security firm MailGuard in 2025 specifically targeted business and influencer accounts, sending messages from an address designed to look official — meta@verifiedbadgescenter.com — claiming the account had been “reviewed” and met the criteria for a verified badge. The link led to a fake domain, verified-badgescenter.com, with a login page built to closely copy Instagram’s real design, despite having no connection to Meta or Instagram whatsoever.
More recent tracking of Instagram phishing in 2026 has identified fake sender addresses like security@instagram-alerts.com and noreply@ig-security.net, linking to look-alike domains such as instagram-secure-login.com — all following the identical pattern of a fake urgency message followed by a convincing but entirely fraudulent login page.
How the Instagram Verification Badge Scam Works
- An unsolicited email or DM arrives, claiming your account “qualifies” for verification based on your followers or engagement.
- A “Verify Account” or “Apply Now” button is included, creating urgency to act before the “offer” expires.
- Clicking the link opens a fake login page built to closely resemble Instagram’s real design, often on a domain with “instagram,” “verified,” or “badge” worked into an otherwise unofficial address.
- Entering your username and password hands them directly to the attacker, who can then change your account’s linked email and phone number, locking you out within minutes.
- The hacked account is then reused for further scams — fake giveaways, DM-based fraud, or being sold outright, particularly if it previously had a large following.
Instagram Verification Badge Scam: Red Flags to Check
| Signal | Genuine Instagram process | Scam pattern |
|---|---|---|
| How verification is requested | Only inside the app: Settings > Account > Request Verification | Via an unsolicited email, DM, or text message |
| Sender | No verification-related emails sent at all | Addresses designed to look official (e.g. containing “verified,” “badge,” or “instagram-alerts”) |
| What’s requested | Nothing — the request happens entirely within your own account | Your username and password on an external “login” page |
| Urgency | None — there’s no expiring “offer” | Pressure to act quickly before the badge “offer” disappears |
What to Do If You Clicked the Link or Were Hacked
- Don’t enter your password if you’ve landed on a page you’re unsure about — close it immediately.
- If you already entered your credentials, change your Instagram password immediately from a device you trust, and check if your linked email has also been changed.
- If you’re locked out, use Instagram’s official account recovery process at instagram.com/hacked — this is the only legitimate recovery channel.
- Turn on two-factor authentication once you regain access, so a stolen password alone isn’t enough to take over your account again.
- Report the phishing email or message within Instagram, and if financial loss or identity theft resulted, report it at cybercrime.gov.in or call the national cybercrime helpline, 1930.
Final Word on the Instagram Verification Badge Scam
The verification badge is a status symbol precisely because it signals trust — which is exactly why scammers keep reusing it as bait, from the earliest documented phishing campaigns to the fake domains being tracked today. The rule never changes: Instagram verification is requested inside the app only, never by email. If a message tells you otherwise, close it, don’t click, and go straight to your own account settings instead. Read our disclaimer for how we present safety information like this.
Want us to check another app or scam pattern? Request a review.
FAQs
Does Instagram really email people offering verification badges?
No. Instagram verification can only be requested from inside the app under Settings > Account > Request Verification. Any email offering a badge is a scam.
What happens if I click the fake verification link?
You’ll typically be taken to a fake login page designed to steal your username and password, which attackers then use to change your account’s linked email and phone number, locking you out.
How do I recover a hacked Instagram account?
Use Instagram’s official recovery tool at instagram.com/hacked — this is the only legitimate recovery channel, and you should use it immediately if you suspect your account has been compromised.
How can I protect my account from this scam in future?
Never click a verification link sent by email or DM, and enable two-factor authentication so a stolen password alone can’t be used to take over your account.
