Social Media Scams: What to Watch Out For
A friend of mine had her Facebook account taken over last year. She got a message from someone she knew, or thought she knew, saying "OMG is this you in this video?" She clicked the link, saw what looked like a Facebook login page, and typed in her details. Within minutes the scammers had changed her password, her recovery email, and her phone number. Then they used her account to send the same message to all 600 of her friends. Three of them fell for it before I could warn everyone in our group chat.
Social media platforms have become one of the most common places where Australians encounter fraud, the ACCC's Scamwatch reported social media as a leading contact method for scam reports in recent years. The reason is simple: social media is built on trust and engagement, and scammers exploit every one of those behaviours. Here's what to watch out for.
Scam Ads and Fake Shopping Sites
Scam advertisements are everywhere on social media. You see an ad for a product you want at an unbelievable price, designer clothing at 90% off, viral gadgets at a fraction of the cost, or luxury items you've been eyeing for months. The ad looks professional, has engaging photos or videos, and might even show customer testimonials. But the website behind the ad is fake.
These scam stores either deliver nothing at all, deliver a cheap knockoff that looks nothing like the photo, or, worst case, steal your credit card information for future fraudulent charges. They appear most frequently on Facebook and Instagram, where anyone can create and run ads.
How to protect yourself: Research any unfamiliar store before buying. If you've never heard of the brand, search for reviews on Google, Trustpilot, or Reddit. Be deeply suspicious of discounts above 50-60%, especially on brand-name products. Check the URL with our URL scanner before entering payment details. For more tips, see our full guide: How to Tell If an Online Shopping Site Is Fake.
Account Takeover Through "Login" Pages
One of the most common social media scams involves fake login pages. You receive a message, sometimes from a friend whose account has already been hacked, saying something like "Is this you in this video?" or "Someone is posting photos of you" with a link. The link takes you to a page that looks exactly like Facebook, Instagram, or another platform's login page. When you enter your credentials, the scammer captures them and takes over your account.
Once they have your account, they use it to send the same scam to all your friends, creating a chain of compromised accounts. They may also use your account to run scam ads, send phishing links, or contact your friends pretending to be you and asking for money.
⚠️ SCAM EXAMPLES
"OMG is this you in this video?? 😱" [link to fake login page]
"I just saw someone using your photos on their profile" [link to fake login page]
"Your account will be disabled for violating our terms. Verify here within 24 hours" [link to fake login page]
How to protect yourself: Never enter your login credentials after clicking a link from a message. Instead, open the app directly or type the URL yourself. If a friend sends a suspicious link, contact them through another channel (call or text) to verify they sent it. Enable two-factor authentication on all social media accounts, even if someone gets your password, they can't access your account without the second factor.
🔗 Received a suspicious link on social media?
Copy the URL and check it before clicking. Our scanner detects phishing, fake login pages, and other threats.
Check a URL, FreeFake Giveaways and Contests
You see a post claiming a celebrity, brand, or influencer is giving away iPhones, cash, gift cards, or other prizes. All you have to do is follow, like, comment, share, or click a link. Sometimes they ask you to fill out a "registration form" that collects personal information. Other times, you "win" but need to pay a small "shipping fee" or "processing fee" to receive your prize.
These scams are incredibly common on Instagram, Facebook, TikTok, and X. They often use the names and photos of real celebrities or brands without their permission. The scammers gain followers, steal personal information, or collect small payments from thousands of "winners."
How to protect yourself: Verify the account is actually the official account for that brand or person (look for verification badges). Legitimate giveaways never require payment to claim a prize. If you need to share personal information beyond a name and email to enter, be suspicious. If it seems like everyone commenting is "winning," it's fake.
Cryptocurrency and Investment Scams
Social media is flooded with "get rich quick" crypto and investment scams. These take several forms. Fake investment "gurus" post screenshots of massive profits and offer to teach you their method, for a fee or by directing you to a fake trading platform. Impersonators of famous people (Elon Musk, MrBeast, and others) promote "crypto giveaways" that require you to send crypto first. Fake trading groups create an illusion of a profitable community to lure new investors into Ponzi schemes.
AI-generated deepfake videos have made these scams even more convincing. You might see what appears to be a video of a well-known figure endorsing a specific investment platform, but the video is entirely fabricated.
How to protect yourself: No legitimate investment guarantees returns. Never send cryptocurrency to someone promising to send more back. In Australia, check ASIC's investor alert list and verify any investment opportunity through official financial regulatory databases. Be sceptical of anyone showing off "guaranteed" profits on social media. This is what frustrates me most about social media scams, platforms like Facebook, Instagram, and TikTok have the technology and resources to detect and remove scam ads and fake investment schemes before they reach users, yet they consistently prioritise engagement and ad revenue over user safety, leaving millions of ordinary Australians to fend for themselves against increasingly sophisticated fraud operations.
Romance and Relationship Scams
While dating apps are the primary venue, romance scams also thrive on Facebook, Instagram, and other social platforms. A stranger sends a friend request, starts a conversation, and gradually builds a relationship. They're attentive, charming, and always available to chat. After building emotional trust over weeks or months, they start asking for money, typically for a medical emergency, travel to visit you, or a business problem.
Scammers use stolen photos (often of attractive military personnel, doctors, or models) and invest significant time in each victim because the payoff can be enormous. Some victims have lost hundreds of thousands of dollars before realizing the relationship was fake.
How to protect yourself: Be cautious with friend requests from strangers, especially those with new profiles and few mutual connections. Do a reverse image search on their profile photos. Never send money to someone you haven't met in person. Be suspicious if they always have reasons why they can't video call.
Fake Customer Service Accounts
When you publicly complain about a company on social media, scammers posing as customer service representatives may respond. They create accounts with names similar to the real company's support account and offer to "help" via direct message. Once in a private conversation, they ask for your account details, login credentials, or payment information to "resolve your issue."
How to protect yourself: Verify that the account responding to you is the company's official account (check for verification marks, account creation date, and follower count). Legitimate support accounts don't ask for passwords. When in doubt, contact the company directly through their official website.
Quizzes and Apps That Steal Data
Fun personality quizzes, "What would you look like as an anime character?" apps, and "See who viewed your profile" tools often exist to harvest your personal data. When you authorize these third-party apps, you may be granting access to your profile information, friend list, photos, email address, and more. This data can be used for targeted phishing, identity theft, or sold to marketers and data brokers.
How to protect yourself: Be selective about granting permissions to third-party apps. Regularly review and revoke apps connected to your social media accounts (usually found in Settings > Apps or Connected Apps). If an app asks for more permissions than it needs for its stated purpose, don't authorize it.
How to Secure Your Social Media Accounts
These settings and habits protect you from the vast majority of social media scams:
Enable two-factor authentication on every social media account. This is available on Facebook, Instagram, X, TikTok, LinkedIn, and virtually every major platform. Use an authenticator app rather than SMS when possible.
Use strong, unique passwords for each platform. If you use the same password everywhere and one platform gets breached, all your accounts are at risk. A password manager makes this easy.
Review your privacy settings. Limit who can see your friend list, posts, and personal information. The less information that's publicly visible, the harder it is for scammers to target or impersonate you.
Be skeptical of links in messages, even from friends. If a link seems unusual or the message doesn't sound like your friend's normal writing, verify through another channel before clicking.
Regularly review connected apps. Revoke access for any third-party apps you no longer use or don't recognize.
📧 Received a suspicious email about your social media account?
Upload the email to our analyzer. We'll check sender authentication and scan for phishing indicators.
Analyze an Email, FreeFrequently Asked Questions
How do social media accounts get hacked?
The most common methods are phishing (fake login pages), leaked passwords from data breaches, "account verification" scams, malicious third-party apps, and social engineering. Strong unique passwords and 2FA prevent most hacks.
What should I do if my social media account is hacked?
Use the platform's account recovery process immediately. Change your password, revoke third-party app access, alert your followers, enable 2FA, and report the hack to the platform.
Are ads on social media safe to buy from?
Not always. Scam ads are common, especially those with extreme discounts. Research the company, check external reviews, verify the website, and use a URL scanner before buying.
How can I tell if a social media profile is fake?
Look for recently created accounts, few posts with many followers (or vice versa), stock or AI-generated profile photos, generic posts, and artificial engagement. Reverse image search the profile photo.
What I Tell Everyone Now
After watching my friend lose her Facebook account, I went through every social media account I own and turned on two-factor authentication with an authenticator app. Took about fifteen minutes. Then I messaged my family group chat and told them to do the same, because the scammers who took my friend's account used it to target her mum next, and her mum very nearly fell for it. Slow down before you click anything. If a message has urgency and a link, that's the pattern. Recognise it, and you won't fall for it.