When a Friend's Hacked Account Messages You: Spot the DM Scam
You get a message from a close friend: "Hey, are you free? I need a quick favour." It sounds normal. But more and more, messages like this are not from your friend at all. Scammers take over one account, then use the trust built into it to reach everyone on the contact list. This pattern is widely reported by security organisations, and it works because we trust names we recognise.
How the scam usually works
Criminals get into an account through a reused password, a phishing link or a leaked login. Once inside, they read recent chats to copy the owner's style, then message friends with a request. Your friend may be locked out and have no idea it's happening.
Common requests to watch for
- "Can you vote for me?" The link leads to a fake login page that steals your details.
- "Can you send me the code you just got?" This is a verification code for your account. Sharing it hands over your login.
- "Can you buy me a gift card? I'll pay you back." Gift cards are hard to trace, which is why scammers love them.
- "Is this you in this video?" The link is bait for malware or a fake sign-in page.
- "I'm in trouble, don't tell anyone." Secrecy and urgency are classic pressure tactics.
Red flags in the conversation
- The wording feels slightly off, too formal, or unlike how your friend normally talks.
- The message comes out of the blue, often with a link and little else.
- They dodge simple questions or won't switch to a voice or video call.
- There is pressure to act right now.
- They ask for money, codes, passwords or photos.
The 4-step verification habit
- Pause. Don't tap the link or reply to the request yet.
- Check another way. Call your friend, text their phone number, or ask someone who is with them. Don't use the same chat to verify.
- Ask a personal question. Pick something only your friend would know that can't be found on their profile.
- Report and block. If it's a scam, use the app's report tool, then tell your friend by another route so they can secure the account.
If you already replied or clicked
It happens to careful people too. Act quickly and calmly:
- If you entered a password anywhere, change it right away. Do the same on any other site where you used it.
- If you shared a verification code, change your password, then log out of all other devices in the account's security settings.
- Turn on two-factor authentication using an authenticator app if the service supports one.
- If you sent money or gift card details, contact your bank or the card provider and tell a parent, guardian or trusted adult.
- Run a security scan on your device if you opened a suspicious file or installed something.
Protect your own account so you're not the "friend" in the scam
- Use a unique password for every account. A password manager makes this easy.
- Turn on two-factor authentication for email, social media and gaming.
- Never share codes sent to your phone, even with people you trust.
- Check your login history and connected apps from time to time, and remove ones you don't use.
- If you lose access, warn your friends through another channel straight away. A quick "Ignore any odd messages from me" can stop the scam from spreading.
Talk about it
Many teens feel embarrassed after being tricked, and scammers rely on that silence. Remember that these messages are designed to fool people. Telling an adult or friend early limits the damage and helps others avoid the same trap.
Where to learn more
For video explainers and downloadable guides, look at the official sites of the UK's National Cyber Security Centre (ncsc.gov.uk), Stay Safe Online (staysafeonline.org) and the US Federal Trade Commission's consumer advice pages (consumer.ftc.gov). They publish free, regularly updated material on account takeover and scam prevention. Check the date on any guide before relying on it, since apps change their settings often.
Remember: a familiar name doesn't prove it's the real person. When a message asks for money, a code or a quick click, verify first and respond second.