Skip to content

Security1 publisher3 min readPublished

Fraudulent copyright strikes suspend Instagram accounts weeks before Meta unwinds them

Meta acts on copyright complaints without checking who filed them, so anyone with an email address can lock an Instagram account that earns money. The BBC found an owner who paid $50 in crypto and was hit again at once.

The Watch · Security desk

Photograph accompanying Fraudulent copyright strikes suspend Instagram accounts weeks before Meta unwinds them
Photo: livelaw.in

What happened

  • Criminals file fake copyright complaints against Instagram accounts, wait for the suspension, then move to Telegram or similar and demand payment to withdraw the complaint.
  • In an Indian court case, Meta acknowledged that 13 copyright strike notices against a single Instagram user were fraudulent, and restored that account.
  • After the BBC named specific accounts, Meta restored the affected content and added protections it did not describe, saying it fights deceptive behaviour intended to scam people.

Compiled by The WatchSomething wrong?How this is made

Why it matters

  • cost One owner told the BBC he lost brand contracts, which sets the real price of the outage far above the $50 ask and explains why the ransom is priced where it is.
  • exposure Any account with revenue attached is reachable by a stranger with an email address, with no credential theft, malware, or session hijack anywhere in the chain.
  • contradiction Meta's fix was account-specific and undescribed, so the ordering that makes the technique work stays in place for every account the BBC did not name.
  • precedent With the Delhi High Court weighing whether platforms may suspend accounts over copyright at all, the constraint on strike handling is more likely to arrive as a court order than as a product change.

Meta's rule says only rights holders or their authorized representatives may file a copyright complaint, and Meta does not check the filer's identity before acting on it [8]. Much of the processing is automated [7]. Repeated complaints against one account can trigger a temporary suspension, and enough of them can disable it [2][9]. Enforcement of the rights-holder rule therefore happens after the account is already down [21].

Then the arithmetic the victim ran. The owner of a history-focused Instagram account told the BBC he paid $50 in cryptocurrency, not because the claims were valid, but because Meta could take weeks to work through his side of it and was unhelpful at the start [5]. The scammers filed again immediately [6]. The payment bought no durable relief [19]. Law enforcement's line is to refuse, on the grounds that paying funds the crew and marks the payer as someone who pays [15].

How many accounts are affected, who runs the crew, and how large the filing volume runs remain unclear from the reporting. Malwarebytes raises the possibility that AI lowers the cost of submitting fraudulent complaints in bulk, making the scheme worth running if a handful of targets pay [16]. The documented case is the opposite shape: repeat claims against one account from the same email address [4]. That is targeting, and it is cheap enough without automation.

Malwarebytes has covered a version of this before, in which scammers abused Instagram's reporting system to get accounts taken down and then charged the owners to restore them [17]. The constant is the monetization of platform process. Fake copyright notices aimed at X users and YouTube creators worked differently, as credential phishing [18]. Here the filings are genuine submissions moving through a genuine system, and the extortion happens off-platform, on Telegram or similar [3].

The remedies available to a target are a queue. Free routes are the appeal attached to the copyright notification and Instagram's in-app Help section; paid routes include the 24/7 support agent bundled with Meta Verified, and Meta Business Support for some eligible business and advertising accounts [10]. The weeks the account owner described [5] are the only resolution interval in the reporting, and whether a paid tier clears a fraudulent strike any faster is not something the record shows.

Two-factor authentication guards the login, not the copyright complaint, so it does nothing against this technique. It helps only if the same crew also goes after the login [22]. For an account that carries revenue, the outcome hinges on the length of Meta's appeal queue, a figure Meta has never published.</body_markdown> <parameter name="what_happened_lines">["Criminals file fake copyright complaints against Instagram accounts, wait for the suspension, then move to Telegram or similar and demand payment to withdraw the complaint.", "In an Indian court case, Meta acknowledged that 13 copyright strike notices against a single Instagram user were fraudulent, and restored that account.", "After the BBC named specific accounts, Meta restored the affected content and added protections it did not describe, saying it fights deceptive behaviour intended to scam people."]

What to watch

  • A Delhi High Court ruling on whether platforms may suspend accounts over copyright claims at all.
  • Meta publishing a filer verification step, or a stated resolution time for contested strikes, rather than per-account fixes.
  • Evidence of bulk filing: one email address or template hitting many unrelated accounts in a short window.
Loading claim ledger
Loading source directory links
Loading share composer
Loading topic controls
Loading related stories