Over the last week, Instagram scammers have been posting images offering fake lottery winnings to followers. They have convinced users to share the posts, give up personal information, and even send money back to the scammers.
In this scam, a number of Instagram accounts have been created to impersonate real-life lottery winners from the UK and US. These accounts claim to offer US$1,000 to each Instagram user who follows them and leaves a comment with their email address.
Figure 1. Instagram accounts impersonating real-life lottery winners
The accounts impersonating lottery winners have been extremely successful, and have gained anywhere from 5,000 to 100,000 followers.
Once they have amassed a certain number of followers, they reveal a secondary Instagram account belonging to their “accountant”, who is in charge of delivering the US$1,000 to users—with a catch.
Figure 2. Fake “accountant” profiles asking users for money
The previous figure shows the “accountant” profiles asking Instagram users to send US$0.99 through a large payment processing service to cover the postage fees for mailing out the checks.
Figure 3. Users who have fallen for the lottery scam
Even though a number of red flags were present for users, the scam has proven to be a success. Each account has gained thousands of followers, with users willingly divulging their email addresses, and some users sending scammers US$0.99 for the supposed postage fees.
The main goal of this scam campaign was to collect accounts with thousands of followers for personal use or resale. During our research, we also found that user names associated with some of the impersonation accounts had performed an account pivot. This means the avatar, user name, and user biography section were changed to preserve the account from being flagged for spam. This allowed the scammers to continue to use or sell the account.
Figure 4. Instagram impersonation accounts have reappeared with fewer followers
Shortly after the account pivot, the impersonation accounts reappeared, but with fewer followers than before. One of the accounts even claimed that it was “hacked” and asked followers to be patient.
It’s clear that these accounts are fraudulent, but users continue to believe that they will be given US$1000 just for following Instagram accounts.
Symantec advises users with the following precautions:
- Do not believe everything you read, especially on social networking sites
- Be skeptical when you come across such offers. As we have previously pointed out, free stuff on social networks is not free
- Do not willingly give up personal information
- Do not send money to somebody you do not know or trust
Always remember that if it sounds too good to be true, it is.