Threats & attacks
Spot Phishing Messages and Fake Login Pages Before You Type
Credential-harvesting scams follow a predictable script: a scary message, a link that looks official, and a login page that isn't. Learn the playbook and the fake gives itself away every time.
See how the attack worksNo password ever
We never ask for, store, or handle your passwords or login codes
Official tools only
Every step uses the platform's own settings and Help Center
Your account only
Guidance is for securing accounts you own or a consenting family member's
Defense, not attack
We explain the scam so you can spot it, never how to run one
If a message or page ever asks HackSN or 'support' for your password or code, it isn't us — we don't work that way.
How a credential-harvesting attack actually works — and where you break it
The bait
A scary 'account suspended' or 'unusual login' message manufactures urgency so you react before you check — that urgency is itself the tell.
The lookalike
The link opens a pixel-perfect login page on a near-identical domain, so you beat it by typing the real address yourself instead of tapping through.
The harvest
Whatever you type is captured in real time and sent to the attacker, which is why a password manager that refuses to autofill is a warning worth heeding.
The reuse
They immediately try the stolen password on your other accounts, so unique passwords and 2FA everywhere contain the damage to one place.
Check a suspicious message with the platform's own tools — never the link inside it
| Provider | Has a built-in log of the real security emails it sent you | Report the scam through an official Help Center form | Accepts reports at a dedicated phishing/abuse email |
|---|---|---|---|
| Instagram — Help Center | YesSettings > Password and security > Emails from Instagram lists genuine security emails | Via formReport a hacked account or scam through the Help Center form | NoNo public phishing email; report in-app or by form |
| TikTok — Safety Center | NoNo built-in log of emails TikTok sent you | Via formReport the message via in-app Report or the feedback form | NoNo dedicated phishing email address |
| X (Twitter) — Help Center | NoNo in-app log of the official emails sent to you | Via formFile a report through the Help Center form | NoNo public phishing report email |
| LinkedIn — Safety Center | NoNo built-in 'emails we sent you' log | Via formReport via the Safety Center / Help Center form | YesForward suspicious messages to [email protected] |
Red flags in the message — and what the real platform actually does
⚑ 'Your account will be permanently deleted in 24 hours — confirm your password now to keep it.'
Platforms lock or restrict accounts; they never demand your password through a link to keep the account alive.
⚑ 'Unusual login detected. Verify your identity here,' followed by a link to a sign-in page.
Genuine login alerts send you to review activity inside the app, not to re-enter your password on a page opened from the message.
⚑ 'You've been selected for a verified badge — sign in at this link to claim it.'
Verification is applied from your own settings after you log in normally, never granted through an inbound link.
⚑ The sign-in page looks identical, but the address bar reads something like 'instagram-support.login-verify[.]com'.
The real domain is the platform's own; any extra word, hyphen, or prefix before it marks a lookalike built to capture what you type.
⚑ 'Reply with the 6-digit code we just texted you so we can confirm it's really you.'
No platform and no real support agent ever asks you to read back a one-time code — that code is exactly what the attacker is missing.
✓ Real security notices also appear inside the app under Settings, not only in an email or DM.
✓ Official login pages live on the platform's own domain — type it yourself or open a saved bookmark instead of following a link.
✓ The platform will never ask you to send, read back, or 'confirm' a one-time code or password.
✓ When a message feels off, open the app directly and check your login activity and security settings yourself.
✓ A password manager only autofills on the genuine domain, so if it stays silent, treat the page as suspect.
We do
- ✓ Teach you to recognize phishing messages and lookalike login pages aimed at your own accounts
- ✓ Show how to verify a message using each platform's own official settings and Help Center
- ✓ Point you to owner recovery steps if you already entered details on a fake page
- ✓ Explain password managers, passkeys, and 2FA that make a stolen password far less useful
We never
- ✗ Build phishing pages, write scam messages, or teach anyone to trick another person
- ✗ Ask for your password, one-time codes, or logins — we never handle credentials
- ✗ Help access, monitor, or break into an account that isn't yours
- ✗ Promise we can identify the attacker or guarantee your account back
Everything here is defensive and owner-side: we describe the attacker's playbook only so you can refuse it, and we never touch a password or a code.
How it works
- 1Change your password from the real appOpen the platform's own app or type its address yourself, then set a new, unique password
- 2Sign out every other sessionIn Settings, review active sessions and log out any device you don't recognize
- 3Reset two-factor authenticationRe-enable 2FA with an authenticator app and regenerate backup codes in case the old ones leaked
- 4Check your recovery detailsConfirm the attacker didn't change your recovery email or phone number while they had access
- 5Report the scam and kill reuseReport the phishing through the platform's official form and change the password anywhere you reused it
There's no countdown here — the fake message's urgency was the trick. Work through these calmly, and if you're already locked out, switch to the full account-recovery path instead.
FAQ
How can I tell a real 'your account was suspended' message from a phishing scam?
Don't act on the message itself — open the app directly or type the platform's address yourself and check your account status and security settings there, because a genuine suspension shows up inside your account while a phishing message pushes you toward a link and asks for your password.
The login page looks exactly like Instagram — how do I know it's fake?
Check the address bar for the real domain (instagram.com with nothing added before it), and remember that a password manager only autofills on the genuine site, so if it stays silent or the URL carries extra words or hyphens, treat the page as a lookalike and type nothing.
I already entered my password on a fake page — what should I do now?
Go straight to the platform's real app, change your password, sign out all other sessions, and reset two-factor authentication, because working through those recovery steps quickly limits what the attacker can do, though no method can guarantee they didn't already act.
Does HackSN ever need my password or verification code to help?
No — we never ask for, receive, or handle your passwords or one-time codes, and any message claiming to be HackSN support and requesting them is itself a scam you should ignore and report.
Can you tell me who sent the phishing message?
No — we can't identify an attacker and we won't promise otherwise, but you can report the message through the platform's official channels and focus your energy on locking down your own account.