Vote for Me Instagram DM Scam: What to Do if You Clicked

A direct message arrives from someone you know. They are in a competition, a design contest or a talent search, and they need one more vote. The link opens a page that looks like a voting site and asks you to sign in with Instagram, Facebook or your email account to cast your vote. It feels like a small favour for a friend. This scam turns that favour into a stolen login. This guide covers the pattern on all three platforms, how to tell whether you are affected, and what to do depending on how far you went.

Last checked: 21 October 2026.

#Is the Vote for Me Message a Scam?

Treat it as one unless you can confirm with your friend through another channel, such as a phone call. Instagram's page on how to protect yourself from phishing describes phishing as someone trying to get access to your account by sending a suspicious message or link that asks for your personal information. It says that if they get into your account, they may use it to send spam. That is the loop behind this scam: a hijacked account messages its friends, and each new login handed over can feed the next round.

#How the Scam Chain Works

1. An account belonging to someone you know is taken over, or a lookalike account is set up with their name and photo.
2. That account sends you a short, friendly message asking for a vote, with a link.
3. The link opens a page styled as a contest or voting site, with a button to log in with your social account.
4. The login screen is a copy. Whatever you type goes to the scammer, not to the platform.
5. Switzerland's National Cyber Security Centre describes fake pages that always say your password is wrong, so you try another account or your email login too.
6. With your password and code, the scammer can try to log in and change your email, phone and password.
7. Your account then sends the same vote message to your friends.

The wording and the contest change. Switzerland's National Cyber Security Centre has described this pattern, with a fake voting page that asks you to log in with Instagram, Facebook or an email account, and it names Facebook, Instagram, X and Snapchat among the networks targeted. The safe rule does not change: never log in to a social account through a link someone sent you.

#Why It Fools Careful People

This scam does not rely on a stranger. The message comes from a name and photo you trust, the request is small, and voting feels harmless. The login button on the fake page looks like the ones you see on real sites every day. None of that makes you careless. The useful habit is simple: a link that asks you to log in to a social account is a reason to stop, close it and open the app yourself instead. If your friend really is in a contest, they will understand a short delay while you check with them.

#Clicked, Entered a Password or Entered a Code?

#What to Do on Instagram

Instagram's phishing page says that if you accidentally entered your username or password into a strange link, someone else might be able to log in. If you can still log in, it says to reset your password and log out of any devices you do not own. Instagram's page on securing your account adds two-factor authentication and checking that your email account is secure, since anyone who can read your email can probably also access your Instagram account.

If you are already locked out, Instagram's page if you think your profile has been hacked says to check for an email from security@mail.instagram.com about a changed email address, which may let you undo the change, and to request a login link from the login screen. If you can still log in, it says to change your password, turn on two-factor authentication, confirm your email and phone number are correct, check Accounts Centre, or Meta Account settings if that is what your app shows, and remove any linked accounts you do not recognise and revoke access for suspicious third-party apps. If the email and phone have already been changed, our guide on an Instagram hacked with the email and phone changed goes further.

#What to Do on Facebook

Facebook's page on what to do if you've been phished says to first report your account as compromised, and that you can do this whether or not you can still log in. If you can still log in, it lists resetting your password, removing logins and devices you do not recognise, reviewing your activity log, checking recent emails from Facebook and deleting posts you did not make. If you think a financial account was accessed or payments were made, it says to contact your bank straight away.

#What to Do on X

X's page help with my compromised account lists signs such as unexpected posts, Direct Messages you did not send and a password that no longer works. Its steps are to change your password, make sure the email address on the account is secure, revoke connections to third-party applications you do not recognise and update your password in trusted apps. If you still cannot log in after a password reset, it says to submit a support request using the email address linked to the account and to include your username and the date you last had access.

#If Your Account Already Sent the Message to Friends

• Post a story or message from a secure account, or ask a family member to, telling friends not to click any vote link from you.
• Contact close friends by phone or in person, since a message from your hacked account will not reassure them.
• If anyone sent money because of a message from your account, tell them to contact their bank straight away and keep screenshots.
• Keep a record of dates, the link you were sent and the messages your account sent.

Our guides to a hacked account messaging your friends and to friends scammed from your hacked account in Malaysia cover the follow up in more detail.

#How to Stop the Next One

• Turn on two-factor authentication on Instagram, Facebook and X.
• Use a different password for each account and for your email.
• Open the app yourself rather than logging in through a link.
• If a friend asks for a vote, call or text them on another channel before doing anything.
• Facebook's phishing guidance says to report suspicious links to phish@fb.com, and Instagram says you can report strange emails to phish@instagram.com.

#When a Case Review Makes Sense

If you caught it early and reset your password, you may not need any help. A review can help when the scammer has changed your email and phone, when the account was used to ask friends for money, or when the platform's own routes have not worked. SocialSafe by AwareXone works through the platforms' official recovery routes only and never asks for passwords, codes or browser data. See our Instagram account recovery page for how a review works and the Trust Center for what we never ask for.

#Frequently Asked Questions