“When your BFF suddenly needs money… don’t click.”
🎣 That DM From Your Friend? It Might Not Be Your Friend
You open your Instagram or Snapchat and see a message:
“Hey! Is this you in this video? 😳 [link]”
Or maybe:
“I really need your help. Can you send me something through PayPal?”
It looks like your bestie. It uses their name, profile pic, maybe even emojis they’d normally use.
But here’s the deal: that message could be a phishing attack. And if you click? You’re the next target.
🐟 What Is Phishing (And Why It Works So Well)
Phishing is when someone pretends to be a person or service you trust—just to trick you into clicking, giving up info, or downloading malware.
And it works really well when it looks like it’s coming from a friend.
Hackers know that people ignore spam from strangers… but respond to friends. So they hijack real accounts—and use them to target others.
🔓 How Accounts Get Hijacked in the First Place
Here’s how it happens:
- Your friend clicks a fake link (“free concert tickets” or “claim your prize!”)
- They enter their password on a fake login screen
- Boom—the hacker has their account
- The hacker changes the recovery info and starts sending phishing DMs to their entire contact list
Within hours, dozens of accounts can fall like dominoes.
🚩 Red Flags That a DM Isn’t Real
- Weird urgency (“I need help now!”)
- Strange grammar or phrases your friend wouldn’t normally use
- Unusual links or random login pages
- Asks for money, gift cards, or crypto
- Starts with “Is this you?” and a link (classic bait tactic)
Sometimes hackers even scroll old chats and mimic your friend’s tone. So if something feels off—trust that feeling.
🛡️ What to Do When You Get a Suspicious DM
- Don’t click the link—even if you’re curious
- Don’t reply—this confirms your account is active
- Take a screenshot (don’t forward the message)
- Contact your friend through a different app to ask, “Did you just send me this?”
- Report the account if it seems fully compromised
And please don’t share the message—even to “warn” people—unless you include a clear explanation. Otherwise, you’re just spreading it further.
🔐 How to Protect Your Own Account from Being Hacked
Don’t be the one who unknowingly turns into a phishing bot. Here’s how to level up your defenses:
- Use a strong, unique password for each platform
- Turn on two-factor authentication (2FA)—this stops most account takeovers
- Don’t reuse passwords between email and social apps
- Be cautious with link shorteners—especially in DMs
- Review third-party app access and revoke anything sketchy
🧠 Don’t Feel Dumb If You Fell for It
Phishing works because it targets your trust—not your intelligence.
If you did click something weird or gave up info, here’s what to do:
- Immediately change your password
- Enable 2FA (better late than never!)
- Check account recovery settings—make sure your email and phone number are correct
- Log out of all devices (most platforms let you do this in settings)
You’re not stupid. You’re just human. And now—you’re wiser too.
🧠 Cysecsis’ Quick DM Safety Checklist
- 👀 Does it sound off? Pause.
- 🖼️ Is there a link? Don’t click it.
- 🧑🤝🧑 Does the sender ask for money or help? Verify.
- 📲 Can you confirm outside the app? Do it.
- 🔒 Got 2FA turned on? If not, do it now.
💬 Real Talk
Hackers love it when we trust too easily. But trust isn’t bad—uninformed trust is.
It’s okay to double-check. It’s okay to say “This seems weird.” It’s okay to not reply right away if your gut says wait.
Your DMs = your space. Protect them like your digital front door.
Coming next: Oversharing Online—Where’s the Line?
Because some things don’t need to be broadcast to the entire internet.
