Email from “Meta” saying your account will be deleted? Spot Instagram phishing in 30 seconds

Why are creators a popular target?

Because their account is worth money and a ban sounds threatening. If you make a living on Instagram, you react faster to "Your account will be deleted" than someone who only shares vacation photos there. That's exactly the fear scammers work with.

Phishing is also one of the most common ways into an account takeover, and a takeover can lead to a ban. A New York Times investigation from July 2026 found that of five reported "wrongful bans", Meta said two involved hacked accounts that scammers had used to post prohibited content 1. So spotting phishing doesn't just protect your password; it also protects your account from being banned.

What do Instagram phishing emails look like in 2026?

Five templates come up again and again. We describe them here rather than recreating them, so you recognize the pattern even when the wording changes.

1. The alleged copyright violation. An email or DM in Meta's look claims that one of your posts infringes copyright. Without an appeal, it says, your account will be deleted. The link leads to a fake help page, often with a fake chat in which a "support agent" asks for your password and code 2. This scam is so common because creators really can receive copyright reports. How real blackmail with fake reports works is described in Fake copyright strikes and blackmail.

2. Deletion for a policy violation. Your account has supposedly violated the Community Guidelines and will be deactivated in 24 or 48 hours. Here too, a link to an "appeal" follows.

3. The blue check. You've supposedly been selected for verification but have to "confirm" your details first. Sometimes there's a fee, sometimes they only want your login.

4. The security check from a friend's account. A DM from someone you follow asks you to vote for them, open a link or forward a code you're about to receive by text. Your friend's account has in fact already been taken over. The code is your own login code.

5. The brand deal. A well-known brand wants to work with you and sends you to a "collaboration platform" where you're supposed to sign in with your social media login. The security company ESET described a campaign like this in October 2026: the login page captured the password and one-time code. So far it has targeted YouTube creators 3. Sometimes, instead of a link, you get a "media kit" as a file that contains malware.

On top of that, there's a special case that isn't phishing but looks like it: the real reset email (see below).

How does the 30-second check work?

You ask four questions before you click anything. A single "yes" to question 3 or 4 is enough to classify the message as a scam.

1. How did the message arrive? Meta sends warnings through the app and by email, not via WhatsApp, Telegram or a DM from an account called "Meta Support". If the email comes from a Gmail or Outlook address, or an oddly stitched-together address, it's not from Meta.

2. Where does the link go? Long-press the link or hover over it without clicking, and read the address from right to left up to the first single slash. Real links end in instagram.com, facebook.com or meta.com. Watch for typos, extra words and constructions where "instagram" only appears at the front as part of someone else's address.

3. Does the message put you under pressure? "Within 24 hours", "final warning", "or your account will be permanently deleted". Consumer protection agencies name short deadlines and threats as a classic warning sign 4.

4. Does it want your password, a code or money? Your password, a 2FA code, a backup code, a payment or a video selfie outside the app. That's the surest sign. No real support team needs your login code to help you. Anyone who asks for it wants to log in themselves.

Senders can be faked, so a sender name like "Instagram" proves nothing. A personal greeting with your name isn't proof of authenticity either, because scammers often know names from public profiles or data leaks 4.

How do you check in the app whether an email from Instagram is real?

You open Instagram yourself and check whether the message shows up there too. If it's not in the app, it's not real.

• Emails from Instagram: Instagram keeps a list of the security emails it has sent you recently, for example about password changes or new logins. According to reports, it covers the last 14 days and separates security emails from other emails 5. If the email that's worrying you isn't in that list, it didn't come from Instagram.
• Account Status: Real warnings, removed content and restrictions show up in your profile's Account Status. How to read it is explained in Instagram shadowban.
• In-app notifications: You'd also see a real deletion threat in the app, not just by email.

Important: open the Instagram app directly from your home screen, or type instagram.com into your browser yourself. Never through the link in the suspicious message.

What about real reset emails you didn't request?

Ignore them. Anyone who knows your username or email address can click "Forgot password" on Instagram. You then get a real email from Instagram, even though you didn't do anything.

In early 2026 there was a whole wave of these emails. At the same time, a large data set of Instagram profile data surfaced on hacker forums. Meta said it had fixed the problem and that its own systems had not been breached. The German consumer protection agency Verbraucherzentrale advised ignoring unrequested reset emails and using a unique password 6.

An email like that on its own doesn't mean someone has your password. But it's a good reason to check your security settings. How to do that in 15 minutes is in Secure your Instagram account.

What should you do if you already clicked?

It depends on how far you got.

Only clicked, didn't enter anything: Close the page. If you downloaded a file, don't open it, delete it. Consumer protection advice is to scan the device with up-to-date antivirus software and install updates 4.

Entered your password:

1. Change your password immediately, in the app, not through a link.
2. Log out of all other sessions under login activity.
3. Check 2FA: Is there a phone number or authenticator app that isn't yours? Remove it and set up your own.
4. Check the email address and phone number on the account.
5. Change the same password everywhere else you use it.

Gave away a code or backup code: Then the scammer may already be in. Go through the steps above and generate new backup codes.

Already locked out: Then Instagram hacked: the first 60 minutes is where you need to be. Everything there starts with your email inbox.

Report it: Don't forward phishing emails to friends; report the DM or the account in Instagram instead. In Germany, the consumer protection agency Verbraucherzentrale collects phishing emails in its Phishing-Radar, and you can forward suspicious emails you received to phishing@verbraucherzentrale.nrw 8. In Austria and Switzerland, check your national consumer protection or cybersecurity agency for its reporting address.

How do you protect yourself, even if you do fall for it once?

With a passkey or an authenticator app, a secured email inbox, and the rule of never passing on codes.

A passkey is tied to the real Meta site and can't be used on a fake page. Meta has supported passkeys for Instagram too since April 2026 7. App-based two-factor authentication helps if only your password was captured. Against a phishing page that also captures your one-time code, it only helps if you don't enter the code there.

And a habit that does more than any technology: every message that puts you under pressure gets checked in the app, not in the link.

Checklist: the 30-second check

• [ ] Did the message come through the app or by email, not via WhatsApp, Telegram or a "support" DM?
• [ ] Does the link really end in instagram.com, facebook.com or meta.com?
• [ ] Does the message create time pressure or threaten deletion?
• [ ] Does it want a password, code, backup code, money or a video selfie?
• [ ] Is the email in Instagram's list of emails it has sent you?
• [ ] Does Account Status show a real warning?

Frequently asked questions

Our takeaway

Phishing works because it scares you. If you remember one rule, make it this one: anyone who pressures you and asks for your password, a code or money isn't Meta. Check everything in the app, and you'll be ahead of most scams.

If you'd like support for your channels that keeps security in mind, you can apply now. It's no-obligation. How to recognize a trustworthy agency is in How to spot a legit OnlyFans agency.