{"id":29384,"date":"2021-08-18T20:57:23","date_gmt":"2021-08-18T18:57:23","guid":{"rendered":"https:\/\/www.kaspersky.co.za\/blog\/?p=29384"},"modified":"2021-08-18T20:57:23","modified_gmt":"2021-08-18T18:57:23","slug":"instagram-ban-attacks","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.za\/blog\/instagram-ban-attacks\/29384\/","title":{"rendered":"Instagram ban attacks block users for no reason"},"content":{"rendered":"<p>If you run a popular blog and promote your business through Instagram, an account ban simply isn\u2019t in the plan. For responsible users, the idea of being banned for, say, displaying suicidal content or trying to impersonate someone else might seem like a bad dream or a cruel joke, but it\u2019s quite real for victims of the new wave of so-called ban attacks. Here\u2019s how these attacks work, how to defend against them, and what to do if your account has been hit.<\/p>\n<h2>How cybercriminals block Instagram profiles<\/h2>\n<p>It\u2019s all quite simple: Detractors or competitors can pay a fee (the amount depends on the seller or even the number of followers) to have your profile blocked.<\/p>\n<p>Such attacks began <a href=\"https:\/\/algorithmwatch.org\/en\/facebook-instagram-mass-report\/\" target=\"_blank\" rel=\"nofollow noopener\">last fall<\/a>, but of late they\u2019ve become particularly high-profile. Recently, online magazine <em>Motherboard<\/em> connected with a cybercriminal group and learned how they exploit Instagram\u2019s policy to <a href=\"https:\/\/www.vice.com\/en\/article\/k78kmv\/instagram-ban-restore-service-scam\" target=\"_blank\" rel=\"nofollow noopener\">make money through ban-as-a-service offerings<\/a>.<\/p>\n<p>The group\u2019s favored tactic is the fake impersonation complaint, which involves verified accounts, identifiable by the blue check next to the username. The attackers use verified accounts to create a full copy of the victim\u2019s profile, right down to the avatar and description. Then they file a complaint against the original, accusing the owner of impersonation. If the victim\u2019s account is not verified, the support service bans the victim.<\/p>\n<p>The second blocking method is to inundate tech support with messages alleging that the victim\u2019s profile contains images of suicide or self-mutilation. In many cases, Instagram takes the easier path, blocking accounts on the basis of such complaints without first checking their actual content.<\/p>\n<p>Unlike <a href=\"https:\/\/www.kaspersky.com\/blog\/instagram-hijack\/23585\/\" target=\"_blank\" rel=\"noopener nofollow\">phishing and other similar schemes<\/a> that still require action from the victim \u2014 clicking a dangerous link, for example \u2014 a ban attack works with no victim participation whatsoever. The target, who might never even dream of violating the terms of use, simply finds their account blocked.<\/p>\n<p>According to the <em>Motherboard<\/em> reporters, the service is inexpensive, running about $5 to $60, so the cybercriminals have no shortage of customers.<\/p>\n<p>However, not all users who abuse Instagram\u2019s moderation practices are in it to make money. Malicious scripts are freely available, and any online hooligan can use them to settle a personal score or silence a disagreeable blogger.<\/p>\n<h2>Instagram unblocking for a fee<\/h2>\n<p>In fact, blocking Instagram accounts opens up another money-generating avenue: restoring them. Unblocking carries a far higher fee than blocking \u2014 reportedly up to $3,500\u2013$4,000.<\/p>\n<p>Whether the same people are behind the banning and the unblocking services, or whether it\u2019s an accidental symbiosis, remains unclear for now. Some users do receive an offer to reinstate their account just a few minutes after the blocking, however, and those offers often come from followers of the accounts from which the original complaints came.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"ksc-trial-generic\">\n<h2>What to do if your Instagram profile gets blocked<\/h2>\n<p>If you\u2019re already the victim of a ban attack, contact Instagram support immediately with an explanation of what happened. Bans are <a href=\"https:\/\/help.instagram.com\/366993040048856\" target=\"_blank\" rel=\"nofollow noopener\">appealable only through the app<\/a>. To do so, you will need to enter your username and password, then follow the instructions.<\/p>\n<p>If anyone comes knocking with an offer to restore your account for money, don\u2019t pay! First, you have no guarantee that anything will come of it. Second, doing so supports confirmed miscreants \u2014 perhaps even the ones who got your account banned in the first place. Third, the official recovery procedure through Instagram support is free.<\/p>\n<h2>How to protect your Instagram profile<\/h2>\n<p>Unfortunately, users tend to learn about a ban attack only after the fact. Instagram told <em>Motherboard<\/em> that it plans to sniff out cybercriminal accounts on the platform, and asks users to report any suspicious activity, but that approach is time-consuming. In the meantime, we suggest you take some measures to protect yourself.<\/p>\n<h3>Verify your account<\/h3>\n<p>The ban-attack business centers on accusations of impersonation, so the best way to protect yourself is to convince Instagram that you are you before anything happens. In other words, you should verify your account now.<\/p>\n<p>The social network won\u2019t check every user, but you may have some points in your favor. For example, if you or your business has been mentioned in <a href=\"https:\/\/help.instagram.com\/312685272613322\" target=\"_blank\" rel=\"nofollow noopener\">multiple news sources<\/a>, that helps. To get the coveted blue check mark, you\u2019ll want to complete your profile and delete any old accounts to avoid arousing suspicion. Naturally, the account must also be public and not violate Instagram\u2019s terms of use.<\/p>\n<p>Once you\u2019ve ensured your account is ready, <a href=\"https:\/\/help.instagram.com\/854227311295302\/\" target=\"_blank\" rel=\"nofollow noopener\">send a verification request<\/a>. You can do it directly through the app:<\/p>\n<ul>\n<li>Go to your profile settings;<\/li>\n<li>Select <em>Account<\/em>;<\/li>\n<li>Select <em>Request Verification<\/em>;<\/li>\n<li>Enter your full name and attach required documentation;<\/li>\n<li>Follow the subsequent instructions.<\/li>\n<\/ul>\n<h3>Make your account private<\/h3>\n<p>What if you\u2019re not famous enough to pass blue-check verification? You can take the radical step of closing your account to the public. If you make your account private, then your posts, photos, and videos will be available only to subscribers, which means that an attacker won\u2019t be able to copy them and accuse you of impersonation.<\/p>\n<p>Whether in the app or a browser, it is not difficult to make your account private. See our <a href=\"https:\/\/www.kaspersky.com\/blog\/keep-instagram-secure\/11045\" target=\"_blank\" rel=\"noopener nofollow\">post on setting up Instagram security and privacy<\/a> for detailed instructions.<\/p>\n<p>Be sure to take the trouble to clean up your list of followers as well, and check future follower requests before accepting them. Bots and other barely there accounts can hide attackers, and you\u2019re under no obligation to let them in.<\/p>\n<h3>Change your profile pic<\/h3>\n<p>For business profiles that you cannot close but that aren\u2019t well-known enough for verification \u2014 or that you feel you must keep open for any other reason \u2014 there\u2019s another way to reduce the risk of ban attacks: Change your avatar.<\/p>\n<p>Fake impersonation complaints work best on profiles with a real photo of the owner. Some underground ban-attack services even refuse to target accounts with other avatars. That means putting up something that isn\u2019t your portrait complicates attempts to do harm; every bit helps.<\/p>\n<h3>Maintain a backup and update contact information<\/h3>\n<p>Instagram admins do what they can to combat wrongful complaints, but they\u2019re working against cybercriminals who continually improve their money-making schemes. In a perfect world you wouldn\u2019t have to, but here and now, you should prepare an escape route.<\/p>\n<p>First, make sure you have access to the e-mail address and phone number linked to your profile. If your account is wrongfully blocked, you can use them for recovery.<\/p>\n<p>Second, <a href=\"https:\/\/www.kaspersky.com\/blog\/how-to-delete-instagram\/25025\/\" target=\"_blank\" rel=\"noopener nofollow\">save your content<\/a> regularly. That way, if worse comes to worst, you can use it to migrate to a new account.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"ksc-trial-generic\">\n","protected":false},"excerpt":{"rendered":"<p>Cybercriminals are offering ban-as-a-service for blocking Instagram users.<\/p>\n","protected":false},"author":2581,"featured_media":29385,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2670,9],"tags":[1853,3065,765,211,98],"class_list":{"0":"post-29384","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"category-tips","9":"tag-tips","10":"tag-account","11":"tag-instagram","12":"tag-social-media","13":"tag-social-networks"},"hreflang":[{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/instagram-ban-attacks\/29384\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/instagram-ban-attacks\/23205\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/instagram-ban-attacks\/18693\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/instagram-ban-attacks\/9400\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/instagram-ban-attacks\/25232\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/instagram-ban-attacks\/23299\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/instagram-ban-attacks\/22613\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/instagram-ban-attacks\/25841\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/instagram-ban-attacks\/25353\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/instagram-ban-attacks\/31284\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/instagram-ban-attacks\/9945\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/instagram-ban-attacks\/41317\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/instagram-ban-attacks\/17494\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/instagram-ban-attacks\/17951\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/instagram-ban-attacks\/27221\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/instagram-ban-attacks\/27422\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/instagram-ban-attacks\/24256\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/instagram-ban-attacks\/29579\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.za\/blog\/tag\/instagram\/","name":"Instagram"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts\/29384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/users\/2581"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/comments?post=29384"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts\/29384\/revisions"}],"predecessor-version":[{"id":29387,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/posts\/29384\/revisions\/29387"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/media\/29385"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/media?parent=29384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/categories?post=29384"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.za\/blog\/wp-json\/wp\/v2\/tags?post=29384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}