Government of India warns on Instagram Account Takeover campaign using online advertisements
India’s Indian Cyber Crime Coordination Centre (I4C) has warned that fake AI trading ads on social media are being used to hijack Instagram accounts. Victims are asked to fill in a sign-up form and enter a “verification code” that is actually their Instagram login code. Citing Meta, I4C said 16,000 such cases surfaced in one month.
NEW DELHI: India’s Indian Cyber Crime Coordination Centre (I4C) has warned of a campaign that uses fake AI trading and investment ads to take over Instagram accounts.
In an advisory posted on 5 October 2026 through its CyberDost handle, I4C said the ads look like a quick sign-up offer but are built to collect phone numbers and trick users into handing over Instagram login codes. Citing Meta, it said about 16,000 such cases were reported in one month.
How the takeover works
1. A sponsored ad on social media promotes AI-driven or automatic trading, offering “free access to the signal room.” The sample shared by I4C was branded “Trade GPT” and run by a page called “Whimsical Glorious.”
2. Tapping Sign up opens an in-app form asking for investment experience, name, email and phone number.
3. The form then says a verification code has been sent to the user’s phone and asks them to enter it.
4. The code is in fact Instagram’s login verification code. Once it is entered, the scammers can take control of the account.
What happens to hijacked accounts
A captured Instagram account rarely stays idle. Scammers can lock out the owner by changing the email, phone number and password, then message the victim’s followers with fake investment tips, loan requests or phishing links that carry the trust of a known name. Accounts with large or engaged followings can be renamed and resold on online marketplaces and Telegram channels that trade in social media handles, while others are reused to run more scam ads, pose as brands or celebrities, or push the same fake trading pages to new victims. Personal photos, chats and contacts left in the account can also be used for impersonation, extortion or targeting the victim’s friends and family.
What users should do
Never enter an SMS or WhatsApp code into a form you reached from an ad, and treat any Instagram verification message you did not request as a warning sign. I4C urges victims of cyber fraud to call the national helpline 1930 or report at cybercrime.gov.in.