When a Friend's Account Is Hacked: Spotting Takeover Scams in DMs

You get a message from a close friend: "Omg is this you in this video?" followed by a link. Or maybe: "Can you do me a quick favor? I'm locked out and need a code sent to your phone." Because it looks like a friend, many teens react before they think. That reaction is exactly what scammers are counting on.

What is an account takeover scam?

In an account takeover, a criminal gains control of someone's social media, gaming or messaging account. They then use that account to message the owner's friends and followers. Because the message comes from a trusted name, people are far more likely to click, reply or hand over information.

The hacked person is often as much a victim as the people who receive the messages. Remember this when you see a strange message from a friend. It is usually not their fault, and they will probably need your help.

Common messages used in these scams

• "Is this you?" A shocking message with a link that leads to a fake login page designed to steal your password.
• "Can you send me a code?" The scammer is trying to break into one of your accounts and needs the verification code sent to your phone. Never share these codes with anyone.
• "Vote for me in a contest." The link asks you to log in with your account to vote, which is just another way to steal your login.
• "I'm in trouble, can you send money or a gift card?" Urgent requests for payment are a classic sign of a scam.
• "Check out this crypto or giveaway tip." Your friend suddenly promotes a get-rich-quick offer they have never mentioned before.

Warning signs that a message is off

• The writing style does not sound like your friend: odd spelling, unusual phrases, or no slang they normally use.
• The message arrives out of the blue and goes straight to a link or a request.
• It creates pressure with words like "quick," "urgent" or "right now."
• The link looks slightly strange, uses a shortened address, or asks you to log in again.
• The person avoids simple questions only the real friend would know how to answer.

How to check without starting a fight

You do not have to be rude or accuse anyone. Just verify.

1. Pause. Do not click or reply straight away.
2. Contact your friend another way. Call them, message them on a different app, or ask them in person.
3. Ask a personal question. Something only the real person would know works well, but do not rely on it alone, because a scammer may have read old chats.
4. Never share codes or passwords. A real friend will understand if you say no.
5. Report and block. Use the app's report tools on the suspicious message or account activity.

If you clicked or shared something

It happens to careful people too. Act quickly and calmly.

1. Change the password for the affected account, and for any other account that uses the same password.
2. Turn on two-factor authentication, preferably with an authenticator app rather than text messages.
3. Check your account's login history or connected devices and sign out of any you do not recognize.
4. Tell a parent, guardian or trusted adult, especially if money or personal details were involved.
5. Warn your friends that your account may have been used to send strange messages.

If your own account is hacked

Use the official recovery process in the app or game, never a third-party "recovery service" that contacts you first. Fake recovery helpers often try to scam people who have just lost an account. Once you are back in, update your password, review your recovery email and phone number, and remove apps or devices you do not recognize.

Build habits that make you a harder target

• Use a unique password for every account. A password manager makes this realistic.
• Switch on two-factor authentication wherever it is offered.
• Treat links in direct messages with caution, even from people you trust.
• Keep your recovery email and phone number up to date.
• Agree with close friends on a simple rule: if either of you ever asks for money or a code in a chat, you will check by voice first.

Where to keep learning

Many reputable organizations, including national cybersecurity agencies, consumer protection bodies and child safety charities, publish free guides and videos on account security and online scams. When you look for them, choose official websites and well-known organizations, and be wary of any "security tool" that asks for your password.

The bottom line

A familiar name on a screen is not proof of a familiar person. Slow down, verify through another channel, and never hand over codes or passwords. A ten-second check can protect your accounts, your friends and your money.