Social media phishing: protecting your account from theft

A social account, a valuable target

A profile on a social network is far more than a personal shop window. It gives access to your contacts, your image, sometimes a professional page or advertising revenue. That is why scammers put so much effort into seizing one. Their favourite method is still phishing, a message that pushes you to hand over your login details yourself.

Three scenarios that keep coming back

The pretexts vary, but they all aim to provoke a quick reaction.

The fake deletion notice is the most common. A message announces that your account breaks the rules and will be deleted within forty-eight hours unless you confirm your details through a link. The threat of losing everything pushes you to act without thinking.

Fake badge verification targets those who want a verified account. You are offered the coveted badge by filling in a form that asks, conveniently, for your password.

The fake copyright claim is aimed mainly at pages and creators. An official-looking message accuses you of an infringement and invites you to dispute it immediately, on a page that is anything but official.

In all three cases the mechanics are identical: create fear, then offer a solution that runs through entering your login details.

The URL reflex

Before you type a single credential, look at where you really are. A fraudulent login page imitates the look of the real network, but its address gives the game away: a slightly altered domain, a misleading subdomain, or a shortened link hiding the destination.

Get into the habit of pasting the doubtful address into the URL checker to see where it truly leads. A legitimate login page is always on the platform's official domain, never on a vague address received in a message.

Locking down your access

The most effective protection comes down to two complementary moves.

First, turn on two-factor authentication in the settings of each network. That way, even if a scammer obtains your password, they will still be missing the second code to get in. Never share that code with anyone.

Second, never log in from a link received in a message. Open the app or type the network's address into the browser yourself. If a genuine alert concerns you, it will appear in your notifications once you are logged in.

If you think you have been caught out, change your password immediately and check the connected devices. You can report the attempt and find help through a national fraud reporting service such as Action Fraud.

To place these attacks in the broader context of message-based fraud, see the Email and SMS phishing guide.