Adam Mosseri, the head of Instagram, was locked out of his own account after a scammer was able to convince the company that he had passed away.
With the aid of Instagram’s memorialisation setting, the scammer was able to pull off the scam. The setting allows people to report to the platform that an account holder has passed away, which prevents anyone else from logging on and making alterations.
To trigger the memorialisation feature, Instagram requests a death certificate or obituary.
The scammer - known as Syenrai - created a fake obituary for Mosseri, which led to Instagram briefly disabling his account.
After getting requests from paying clients, Syenrai carried out the same scam on other, less high-profile accounts. They were able to do so by merely utilising a recent obituary of any deceased individual on the internet and then submitting a memorialisation request for the victim’s account, which takes around 1-2 days for support to process.
“As long as the obituary is recent (within the same week), the target will be memorialized. It works 98% of the time.”
A spokesperson for Instagram told VICE in an email that the platform has “online forms to help people report suspicious activity” or inform them that a loved one “passed away.”
They noted that the company hires “investigators and cybersecurity specialists” to monitor the “scammers’ tactics” so they can make the process “difficult for them.”
They also said that the teams responsible for reviewing the memorialisation requests strive to ensure that the request is genuine by using the date of birth, name, and a matching image sent in with an obituary and the account.
When users access the app, they will be given a form to fill out if they believe their account has been inaccurately memorialized.
It reads: “We’ll only be able to grant you access to this account if we’re able to verify that you’re the account owner.”
Syenrai said some accounts could take “days or maybe a week” to return but said that having your exact birth and at least one archived photo of yourself helps to identify that you are the account owner.