18 Types of Social Media Scams & How to Protect Yourself

Below are the most prevalent social media scams you’re likely to see this year. For each, you’ll find how it works, what to look for, and what to do instead.

1) Phishing via DMs and “Support” Messages

• How it works: An “urgent” DM claims you violated policies, your ads are suspended, or your account will be deleted unless you “verify” or “appeal.” Links lead to login clones or data capture forms.
• Tells: Recently created profiles, odd URLs (misspellings, extra hyphens), requests for 2FA codes, and threats of 24-hour bans.
• Do this instead: Don’t click. Manually open the platform’s app, navigate to Settings → Security/Help to check alerts. Never share verification codes. Enable 2FA and password-reset alerts.

2) Fake Profiles & Impersonation (friends, brands, celebrities)

• How it works: Scammers steal photos/bios to impersonate friends or staff, or spin up “brand support” accounts. They ask for money, gift cards, or login codes; or steer you to off-platform chats (WhatsApp/Telegram) to avoid moderation.
• Tells: Duplicate friend requests, few posts, strange follower patterns, generic comments, sudden private outreach from “celebs.”
• Do this instead: Cross-check via another channel (call/text the real person), inspect mutuals and account age. Report the impersonation.

3) Online Shopping & Marketplace Scams

• How it works: Professional-looking ads or Marketplace listings lead to fake storefronts or drop-shipping of counterfeits and never-shipped goods.
• Tells: Prices at 70–90% off, stock photos, only P2P or crypto payments, no real customer service footprint, just-created domains.
• Do this instead: Check domain age and company footprint, look for chargeback-friendly payments (credit card), and avoid direct Zelle/Cash App/crypto for first-time sellers.

4) Fake Giveaways & Contests

• How it works: “You’re a lucky winner!”—but you must pay a small fee, fill a data-harvesting form, or “verify” on a phishing page.
• Tells: Requests for card details “to cover shipping,” short-link forms, non-official URLs for big brands, push to DM fast.
• Do this instead: Verify on the brand’s official site. Real giveaways don’t collect payment details in DMs.

5) Romance & Catfishing

• How it works: Weeks of bonding with a too-perfect match (doctor, engineer, deployed military, aid worker). Then comes an “emergency” (medical, legal, travel) or investment “opportunity.”
• Tells: Stock-like photos, refusal to video chat, requests for secrecy, escalating money asks via gift cards/crypto.
• Do this instead: Reverse-image search profile pics, insist on video calls, never send funds, and talk to a trusted friend for a reality check.

6) Investment, Crypto, and “Forex” Doublers

• How it works: Flashy profit screenshots and celebrity “endorsements,” often from impersonated accounts. Some show small “returns” first to bait larger deposits.
• Tells: Guaranteed returns, opaque platforms, withdrawal delays, pressure to “go bigger.”
• Do this instead: Assume guaranteed gains are fake. Check regulators’ warning lists, never move funds to wallets you don’t control, and avoid connecting exchanges from links in DMs.

7) Job & Employment Scams (especially on LinkedIn/Instagram/FB)

• How it works: Unrealistic pay, “no experience,” or remote “admin” gigs. Fraudsters ask for upfront “training/equipment fees,” payroll details, or “verification” via shady apps.
• Tells: Gmail/Telegram recruiter emails, no interview process, requests for SSN/passport early, fee-first workflows.
• Do this instead: Confirm the role on the company’s careers page. Decline any upfront payment. Share sensitive info only after a legitimate offer process.

8) Quizzes, Surveys, and Personality Tests

• How it works: Fun prompts (“Which celebrity do you look like?”) double as data scrapers, collecting answers often used as security-question material.
• Tells: Requests for first pet, mother’s maiden name, hometown, or DOB; sketchy short links; “sponsored” pages with no history.
• Do this instead: Treat quizzes as public disclosures. Don’t reuse security-question answers that can be guessed from social profiles—use nonsense passphrases instead.

9) Drive-By Downloads (“Is this you in the video?” / “Look who died”)

• How it works: A link autostarts a silent malware download or prompts a bogus “video player/codec” install.
• Tells: Emotion-spiking captions, URL redirects, mobile prompts to “allow installation from unknown sources.”
• Do this instead: Keep OS/app stores locked down, disable unknown-source installs, and use reputable endpoint protection.

10) Money-Flipping & Pyramid Schemes

• How it works: “Send $100, get $1,000 in hours,” or pay to join an “exclusive” club and recruit others.
• Tells: Screenshots of payouts, refusal to meet in person or on video, tiered “memberships.”
• Do this instead: Recognize this as a classic con—report and block.

11) Tech Support Impersonation (including creator “help desks”)

• How it works: Fraudsters pose as platform support or brand help desks to gain remote access or sell fake subscriptions.
• Tells: Unsolicited DMs, requests to install remote-control tools, payment in gift cards.
• Do this instead: Support doesn’t DM first. Contact official help centers from in-app menus only.

12) Charity & Crisis Scams

• How it works: During disasters and conflicts, scammers launch fake fundraisers, sometimes cloning real NGOs.
• Tells: New pages, no charity registration, P2P/crypto only, stolen imagery.
• Do this instead: Donate via official NGO sites, not via DMs or comments.

13) Creator/Business “Ad Suspension” & Copyright Takedowns

• How it works: Emails or DMs say “Your ads are suspended” or “copyright complaint—appeal now,” sending you to a fake Meta Business or rights portal.
• Tells: Domain doesn’t match the platform, requests for screenshots + credentials, odd grammar.
• Do this instead: Open your Ads Manager/Creator dashboard independently; never resolve policy issues from a link in a DM.

14) Account Recovery / 2FA Code Scams

• How it works: A “friend” asks you to share a code “sent by mistake.” It’s the attacker attempting a password reset on your account.
• Tells: “Can you send me that code?” out of the blue.
• Do this instead: Never share codes—ever. Call the person to confirm; they’ll say they didn’t send it.

15) Loan and Quick-Cash Offers

• How it works: “Instant approval, no credit check.” Victims pay “processing fees” and get nothing.
• Tells: Fee-first, no verifiable lender, off-platform chats.
• Do this instead: Use regulated channels; if you’re asked for crypto/gift cards—walk away.

16) “Verification Badge” Sales

• How it works: Scammers sell “blue checks” or “priority verification” via DMs, then harvest card details or credentials.
• Tells: Non-official domains, Telegram contact links, limited-time “slots.”
• Do this instead: Only purchase verification directly inside the platform’s official settings.

17) Group and Community Takeovers

• How it works: Attackers phish a moderator, then post scam links from a trusted community hub.
• Tells: Sudden rule changes, mass giveaway posts, unknown admins added.
• Do this instead: Enable admin 2FA, review admin lists regularly, and use approval queues for posts.

18) Business Page Compromise → “Free” Product Campaigns

• How it works: A legitimate store’s page gets compromised. “Free shoes—just pay shipping!” leads to card skimming pages.
• Tells: Too-good-to-be-true promos on known pages, checkout on unknown domains.
• Do this instead: Navigate to the official domain you already know, not the link in the post.