Hacked social media account
A friend's hacked account messaging you to 'vote' or claim a prize.
How it works
A friend messages asking you to vote in a competition or claim a giveaway via a link. The link captures your Instagram/Facebook login and your account is then used to scam your friends.
Common scenarios to watch for
This scam shows up in several different shapes. Recognise the pattern, not just one message.
'Vote for me' link
A hacked friend's account asks you to vote in a contest. The link captures your Instagram login.
"Hey! Vote for me in this contest — takes 2 sec 🙏 link.contest-vote.app"
Red flags to spot
- Did a friend send an unusual link asking you to vote or sign in?
- Does the link ask for your social media login credentials?
- Is the message out of character for that friend?
- Can you verify with the friend through another channel before clicking?
SMS-code handover
A friend asks you to forward a code 'sent to your phone by accident'. It's actually the password-reset code for your account.
"Hey, I sent a code to your phone by mistake — can you paste it back? It's for work."
Red flags to spot
- Did someone ask you to forward a code that arrived on your phone?
- Is the code from a platform you use (bank, email, social media)?
- Could this be a password-reset or 2FA code for your own account?
- Did the person make the request through an unusual or new contact method?
Crypto-giveaway hijack
A hacked verified account posts a 'giveaway' — send 0.1 ETH, get 1 ETH back. The wallet never sends anything back.
"🚀 Giving back to my followers — first 100 to send 0.1 ETH get 1 ETH back. Wallet: 0x…"
Red flags to spot
- Is an account promising to multiply your crypto if you send some first?
- Does the post use urgency (limited spots, first 100)?
- Is the wallet address one you can't verify?
- Does the message style differ from the account's usual posts?
Red flags
- 🚩Friend suddenly asking for a code sent to your phone
- 🚩Link to a 'vote' or 'crypto giveaway'
- 🚩Tone of message feels off
- 🚩Message arrives at an odd hour
What to do
- 1Never share SMS codes — that's how accounts get taken over.
- 2Call or voice-message your friend to check.
- 3Turn on 2FA for every social account.
Who's targeted
- Active Instagram, Facebook and TikTok users.
- Friends of recently-hacked accounts.
Why it works
- Messages come from real friends' real accounts.
- The 'favour' sounds tiny — just click a link.
Common variations
Different shapes of the same scam — recognise the pattern.
- 1Vote-for-me competition link.
- 2Crypto giveaway requiring you to log in.
- 3'Help me recover my account' request for a code.
If you've already been scammed
- 1Change passwords and revoke active sessions on every social account.
- 2Turn on 2FA — preferably an authenticator app, not SMS.
- 3Warn your contacts so they don't fall for messages from your account.
Frequently asked
What's the code they're asking for?▾
It's your account's password-reset code. Sharing it hands over your account.
Should I click to 'help' a friend?▾
No — call or voice-message them first to confirm.
How do I recover a hacked Instagram?▾
Use Instagram's compromised account flow at instagram.com/hacked.
Questions people ask about this scam
- How does the hacked social media account work?
- A friend messages asking you to vote in a competition or claim a giveaway via a link. The link captures your Instagram/Facebook login and your account is then used to scam your friends.
- What are the warning signs of a hacked social media account?
- Watch for: Friend suddenly asking for a code sent to your phone; Link to a 'vote' or 'crypto giveaway'; Tone of message feels off; Message arrives at an odd hour.
- How can I tell if this is a scam?
- Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.
- What should I do if I clicked the link or replied?
- Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Never share SMS codes — that's how accounts get taken over. Call or voice-message your friend to check. Turn on 2FA for every social account.
- What should I do if I already sent money?
- Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.
- Where should Australians report this scam?
- Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.
General scam awareness information. ScamShield AI cannot guarantee that every scam will be detected or that a message is legitimate.
Related scams
Connected patterns you should also learn — ranked by how much they overlap with this one.
Fake job offer
'Easy money' jobs that ask for an upfront fee or your bank details.
Read guideRental bond scam
Fake landlords asking for a bond before you inspect.
Read guideEducation fee scam
Fake 'agents' offering tuition discounts via wallet transfer.
Read guideSubscription trap
'Free trial' offers that quietly bill your card every month.
Read guideFake event ticket scam
Sold-out concert and sports tickets that don't exist.
Read guideLoan / advance-fee scam
Guaranteed loans that need an upfront 'insurance' or 'processing' fee.
Read guide