Instagram hackers target small businesses
ENTREPRENEURS who conduct most of their business transactions through Instagram have been warned to implement all available security measures or risk falling prey to hackers.
Several business owners have been left reeling after hackers took control of their accounts, leading to massive losses in revenue and customers.
Instagram allows users to share photographs and videos and many businesses use it to post pictures of their products.
Saturday Star spoke to a number of small business owners who fell victim to phishing attacks through fraudulent messages seeking their passwords and login details. They lost thousands of rand when their Instagram accounts were hacked and they were not able to speak to their clients or followers, sometimes for several months.
Alarmingly, the accounts contained all their personal information like credit card details, phone numbers and home addresses, which the site often requires as verification from business people.
Just over a year ago marketing manager Casey Davies and her husband started decor business Stone Sloth, which makes premium concrete candles.
Davies said at the time she wasn’t too familiar with social media and it took about a year to build up a good following on Instagram.
“I was very proud that we finally got to about 1 800 followers.”
She said it wasn’t unusual for prospective customers to ask her for more personal details, like her cellphone number,
if they wanted to discuss products.
On October 31 she received a message from a potential client who asked for her cellphone number and promised to be in touch.
Almost immediately, she received notifications via the Instagram direct messaging service saying, “there has been suspicious activity on your account”.
Another message followed: “This is Instagram, put in this code so that we can stop the suspicious activity.”
She said the prompt to put in the code was a fake, but it looked very “professional” and was sent to her cellphone number.
She tried to log into her account and a message said she no longer had access to it.
Davies soon received messages from followers telling her the hackers had posted photographs of her on the account with messages saying she had made lots of money by trading in Bitcoin.
The one saving grace was that although the hackers could access her credit card details, the card had expired and was no longer valid.
Davies was worried that by hacking into the Stone Sloth account, the people and companies she worked with would also fall prey to the hackers who never made any demands for money or contacted her personally again.
She has still not been able to regain control of her account, despite sending countless messages to Instagram and parent company Facebook for help.
Finally, someone at Facebook told them to “cut your losses” and move on.
Davies said she would go back to using email advertising because it was more secure.
She stressed the importance of using the two-step verification available on Instagram to protect your account.
“Unfortunately Instagram hacking is on the rise and I have heard of quite a few instances where people paid to get their accounts back,” said Davies.
Greyville coffee shop owner Amy Gardiner said she was taken by surprise when she received an email from Instagram one Sunday morning, asking her to enter her name, email and username.
Within seconds of inserting her details, she no longer had access to her account. And then the demands started rolling in.
The hacker wanted a $1 000 and contacted her via Instagram direct message at least three times a day, demanding to know when the money would be sent and asking if she didn’t want her account back.
They posted messages in Turkish on her page and her investigations proved the origin of the messages was Turkey.
“You feel so violated because the person has all your personal information,” said Gardiner.
She ended up negotiating with the hacker and brought down the amount he wanted to $500. She also tried to get help from Instagram and Facebook.
Gardiner said her account was “missing” for almost three months and she felt a definite impact on sales.
“If it happens to you, persistence pays off because it took me two and a half months to get through to Instagram,” she said.
Her account was restored without paying the hacker, and she now uses the two-step verification on Instagram.
Lauren (who asked that her surname be withheld) runs an online vintage, antiques and collectables store called WTF Vintage Furniture from Durban North, and said it took a “friend of a friend of a friend” who knew someone who worked for Meta, which owns Instagram, Facebook and Whatsapp, to help her regain control of her hacked Instagram account.
She said in July when her account was hacked she had almost 8 000 followers and the hacker tried to blackmail her into buying it back.
“What they do is hack other accounts through your account,” she said.
When Lauren was hacked she thought she was talking to a yoga teacher in Kloof but said the hacker was obviously using that person’s account to get to her. Lauren said the “yoga teacher” claimed their Instagram account had to be verified and wanted Lauren to help by taking a screenshot of a link sent to her via Instagram direct message and sending it back to the yoga account.
Seconds after she sent the screenshot, her Instagram account went missing.
“This person started direct messaging my clients,” she said. He took random furniture pictures, posted them on her account as if it was for sale and provided alternative bank details on the site.
She reported the matter to the police but they had no clue what to do.
“As I left the police station the hacker called me and said for R6 000 I will give you back your account.
She never paid, and after numerous attempts someone who worked for Meta finally helped her get the account back.
IT expert Dr Colin Thakur from the Durban University of Technology, said typically the attacks on Instagram accounts could be traced back to Turkey and Russia because of the telephone numbers used by hackers.
He cautioned against sharing any details with strangers or assisting anyone who had a “problem” with their account.