Account cloning is a deceptive technique used by scammers to create a copy of an individual's Instagram account without their consent. They copy the name, profile photo, personal information, and perhaps even some old posts to make the account seem as authentic as possible. The bad actors then use this cloned account to make follow requests to that person's real contacts, fooling them into connecting. And once they've lured your friends in, cybercriminals try to exploit this trust for monetary scams or hacking their Instagram credentials.
To be clear, Instagram account cloning is not hacking. No one was able to access your real account, and it is not a sign that your username and password were stolen. The scammers are simply using your public information to create a fake you. And understanding how these attacks take place is the key to preventing them.
How to prevent Instagram account cloning
Set your account to private
For scammers to benefit from account cloning, they need to have access to your follower list. On Facebook, it is easy to prevent this by setting the privacy of your Facebook friends to "Friends" or "Only me."
Unfortunately, Instagram doesn't give you a way to just hide your followers from strangers. The only way to prevent scammers from seeing this information is to set your entire account to Private. When you do this, only followers you manually approve can see your posts and your followers.
To set your Instagram account to private:
- Click on your profile picture in the Instagram app.
- Click the menu icon (triple bars) and go to Settings & Privacy.
- Scroll down to Account privacy and select Private account.
- Toggle on Private account.
Once your account is set to private, review your followers' list and remove any accounts you don't recognize or trust. This ensures that only genuine friends and family are allowed to see your posts and follow your updates.
Be mindful of follower requests
If you've set your account to private, be cautious about accepting follow requests from unfamiliar accounts. Remember, anyone you accept will be able to access your follower list. And you should verify that any requests coming from friends are coming from their real accounts and not a cloned account. Look for a history of posts on their account that confirms your friend is who they say they are. And if you are still unsure, contact your friend directly and ask them.
Limit profile information
Avoid sharing excessive personal information in your Instagram profile. Even if your account is set to Private, your profile information is available to everyone on Instagram. Revealing details like your full name, contact information, or location may make it easier for cybercriminals to clone your account successfully. Be cautious about sharing sensitive data, even in your bio or captions, as this can be used against you and your friends.
Limit tagging and mentions
When followers tag or mention you in their posts, those posts may become visible to people beyond your immediate circle. Impersonators could then use these photos of you to add an appearance of validity to any cloned account they create. You can prevent being tagged in others' photos with the "Manually Approve Tags" option in your privacy settings.
To control how you are tagged by others on Instagram:
- Click on your profile picture in the Instagram app.
- Click the menu icon (triple bars) and go to Settings & Privacy.
- Scroll down and click Tags and mentions.
- Change your settings to Don't allow tags or Manually Approve Tags.
- Also, change your @mention to Don't allow mentions.
Report cloned accounts
If you or your friends come across a cloned account, report it to Instagram immediately. Instagram has a built-in reporting feature that allows users to flag accounts for various reasons, including impersonation and suspicious activity.
To report someone for impersonation on Instagram:
- Tap on the fake account to go to their account page.
- Click more actions (triple dots) next to their username on one of their posts.
- Click Report, then Report Account.
- Click It's pretending to be someone else.
- Select the type of impersonation and follow the instructions.
Regularly review connected apps
Instagram allows users to connect their accounts with third-party apps for added functionality. However, these apps might have access to your account data and the data of your friends as well. Periodically review the list of connected apps and revoke access to any suspicious or unnecessary ones to minimize potential security risks.
To review your connected Instagram apps:
- Click on your profile picture in the Instagram app.
- Click the menu icon (triple bars) and go to Settings & Privacy.
- Scroll down and click Website permissions.
- Click Apps and websites.
- Review any active apps and remove those you don't need or recognize.
Wrapping it up
Instagram doesn't provide nearly the same level of privacy controls as Facebook, making it harder to prevent account cloning and other scams. However, by adjusting your privacy settings, limiting the information you share, and staying cautious with follower requests, you can reduce the risk of becoming a victim – or, more precisely, your friends becoming victims – of this deceptive tactic.
[Image credit: Techlicious]
Josh Kirschner is the co-founder of Techlicious and has been covering consumer tech for more than a decade. Josh started his first company while still in college, a consumer electronics retailer focused on students. His writing has been featured in Today.com, NBC News and Time.
