# Friends Receiving Scam Messages From Your Instagram > Friends say your Instagram is scamming them? Regain access, warn followers, remove scam DMs and posts, and tell victims to report and call 997 if they paid. - URL: https://www.awarexone.com/research/friends-receiving-scam-messages-from-your-instagram - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-11-09 - Topics: Instagram, Content removal, Scams, Malaysia - Related service: Instagram account recovery: https://www.awarexone.com/social-media-recovery/instagram-account-recovery ## Short answer If friends receive scam messages from your Instagram, treat it as a takeover. Secure your email, use instagram.com/hacked, change the password, turn on two-factor authentication, and delete fraudulent posts and DMs. Warn contacts on another channel. Tell anyone who paid to call their bank and 997. Meta decides reinstatement. ## Summary - Scam DMs from your handle usually mean takeover, not a glitch, until you prove otherwise. - Secure the linked email before you reset the Instagram password. - Warn friends from SMS, WhatsApp or another network you still control. - Friends should report the scam messages inside Instagram once, not mass-report your whole profile. - Victims who paid need their bank and 997, not your login code. - Meta decides whether disabled accounts return after scam bursts. Three friends message you on WhatsApp: your Instagram just asked for a TNG transfer or sent a phishing link. You open the app and you cannot log in, or you can log in but the Sent folder shows DMs you never wrote. Your reputation is on the line while Meta's systems may flag the account for spam. You need access back and a clear warning to everyone who trusts your name. This guide covers both. Last checked: 9 November 2026. ## Quick Answer Secure the email linked to Instagram, then use [instagram.com/hacked](https://help.instagram.com/368191326593075) and the steps on [I think my account was hacked](https://help.instagram.com/149494825257596). Change the password, revoke suspicious apps, and enable two-factor authentication. Post a warning on another social account or by SMS. Delete scam DMs and posts. Tell victims who paid to use [997](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline) and their bank. Friends can [report the messages](https://help.instagram.com/192435014247952) without reporting your entire profile. ## What Friends Should Do - Do not send money or forward login codes. - Report the individual message or conversation through Instagram's report menu. - Screenshot the scam DM with your username visible for their own records. - Call you on a number they already know, not a number the scammer just sent in chat. *Friends pick the closest report reason; one report per thread is enough.* | Message type | Risk | Report category | | --- | --- | --- | | Fake giveaway DM | Phishing link | Spam or scam | | Loan request in your voice | Payment fraud | Scam or fraud | | Link to unknown shop | Card theft | Spam | | Video call blackmail | Sextortion | Harassment or blackmail routes | ## Why Instagram May Disable You Next Instagram's page on [unauthorised content](https://help.instagram.com/230786120405165) says unexpected comments or DMs suggest a compromised password. Burst spam can trigger limits or disables. If a disable notice appears, see [account disabled Malaysia](https://www.awarexone.com/research/instagram-account-disabled-malaysia) and mention the hack dates in any appeal. ## Warn Followers Without Making Spam Worse Instagram's [scam guidance](https://help.instagram.com/514187739359208) says compromised accounts deceive friends. One clear story post after recovery beats twenty panic DMs while you are still locked out. Use WhatsApp Status, Facebook, or your business website. ## What Not to Do - Asking fifty friends to mass-report your own profile. - Paying commenters who offer instant unban. - Sharing a screenshot of your government ID in public recovery groups. ## Collecting Evidence While Locked Out Ask friends to forward screenshots with your username, the scam text, and the time visible. If they already paid, they should keep transfer slips separately from your recovery work. You may need those screenshots for a police report even before Meta restores access. If you still have one logged-in device, check Settings, then Apps and websites, and revoke anything unfamiliar before you change the password. Old third-party app access sometimes explains DMs you never typed. ## Malaysia: NSRC and Police for Victims Friends who sent money should call 997 and their bank without waiting for you to regain Instagram. Your public warning post should repeat that message so victims act on money first. ## Securing the Account After You Get Back In 1. Change password to a unique long passphrase. 2. Turn on two-factor authentication. 3. Review login activity in Accounts Centre. 4. Remove apps linked under Apps and websites. 5. Delete scam posts and revoke story shares. 6. Send a follow-up apology post with safer contact methods. ## Stories and Comments Used in Scams Some hijackers post scam links as Stories or replies under your older posts, not only in DMs. After recovery, open your archive and delete Stories from the takeover window. Check tagged photos and comments for phishing URLs friends might click without opening their inbox. Turning on login alerts in Accounts Centre gives you earlier warning if the attacker returns. Romance and investment scammers often reuse scripts across hacked accounts. Friends who almost paid may still need emotional support and a nudge to report to their own bank even after you regain control. If Instagram limits your account for spam while you are still cleaning up, avoid sending the same warning DM hundreds of times; one public post plus SMS to close contacts is enough. ## Helping Friends Report Without Drama Give friends a short template they can paste into Instagram report boxes: this conversation is from a hacked account and the link is fraudulent. That keeps reports factual and avoids exaggerated claims that slow moderation. ## What Victims Should Tell Their Bank - They paid because they trusted your account. - The request arrived by Instagram DM. - They have screenshots with timestamps. - They already reported the message in the app. - They called 997 if required in Malaysia. - They did not share their own OTP with anyone. - They blocked further DMs from your handle until you confirm by phone. - They will not accept new payment requests on Instagram alone. Save a draft warning post in your notes app now, before a hack happens, so you can publish quickly from another network while Meta processes your recovery. Update your bio with a temporary note pointing people to your website for official contact while you rebuild trust after a takeover. Add two-factor authentication backup codes to a physical safe if Meta offers them for your account type. Consider posting your official contact channels on a simple link page you control, then point your Instagram bio to that page after recovery so friends have a stable place to verify you even if DMs are still messy. If you run a small business through Instagram DMs, switch urgent orders to email or your website checkout until you confirm no fraudulent payment links remain in old threads. Rotate any reused password immediately, because attackers often test the same one on your email and bank apps next. Turn on login alerts in Accounts Centre so the next unknown sign-in emails you before another blast of scam DMs goes out to your contacts again. ## When a Case Review Makes Sense Creators and shops with large follower lists may need coordinated recovery and victim communication. SocialSafe by AwareXone reviews those cases through official Meta processes only and never asks for OTPs. See [Instagram account recovery](https://www.awarexone.com/social-media-recovery/instagram-account-recovery) and [Trust Center](https://www.awarexone.com/trust). ### Should friends block my account? They can mute or block temporarily, but reporting the scam messages is more useful for enforcement. ### Will deleting scam DMs delete them for friends too? Usually unsend or delete removes them on both sides when you control the account again. ### Can I see who received the scam DMs? Check Instagram inbox Sent and Requests folders after recovery; export if Meta offers download tools. ### Am I liable if a friend lost money? That is a legal question on facts. A prompt hack report, warning post and police report show you acted responsibly. ### Does AwareXone message my friends for me? No. You warn contacts yourself; we help review official recovery if DIY stalls. ## Official sources - [Instagram Help: Hacked accounts hub (read 9 November 2026)](https://help.instagram.com/368191326593075) - [Instagram Help: Unauthorised content (read 9 November 2026)](https://help.instagram.com/230786120405165) - [Instagram Help: Avoiding scams (read 9 November 2026)](https://help.instagram.com/514187739359208) - [Instagram Help: Report something (read 9 November 2026)](https://help.instagram.com/192435014247952) - [Instagram Help: I think my account was hacked (read 9 November 2026)](https://help.instagram.com/149494825257596) - [MyGOV: NSRC 997 (read 9 November 2026)](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline) --- AwareXone is an independent provider serving clients worldwide, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.