Loading...
Loading...
Phishing emails and messages impersonating social media platforms like X (Twitter), Instagram, and Facebook with fake 'Content Violation,' 'Account Verification,' or 'Copyright Strike' notices. These exploit periods of platform change (new features, policy updates) when users are more likely to click official-looking notices.
Annual Losses
$50M+ (est. from credential theft downstream)
Avg Loss / Victim
$100-$5,000+ (account takeover enables further fraud)
Primary Vector
Email, in-app DMs, fake notification pages
Peak Season
Spikes during platform changes, policy updates, and feature launches
You receive an email or message that looks like an official notification from X (Twitter), Instagram, Facebook, TikTok, or YouTube claiming your account has a 'content violation,' needs verification, or has a copyright strike. The message includes a link to a convincing replica of the platform's login page. When you enter your credentials, the attackers steal them and take over your account — often using it to scam your followers or access linked financial services.
Hover or tap the highlighted text to see why each element is a red flag.
X Community Guidelines Notice: Your account @username has been flagged for a content violationRed flag: Vague — doesn't specify what content or which guideline was violated. Real notices cite the specific post and rule.. Review the report and submit an appeal within 24 hoursRed flag: Artificial urgency. Real platform violations give you time to appeal and don't threaten permanent suspension in a single email. or your account will be permanently suspended. Review here: https://communitycase-x.comRed flag: Fake domain. Real X/Twitter notices come from x.com or twitter.com domains, and appeals are handled in-app through Settings > Account./appeal/review
Instagram Security Alert: Unusual login detected on your account. If this wasn't you, secure your account now: https://instagram-security-verify.comRed flag: Fake domain. Real Instagram security alerts come from mail.instagram.com and link to instagram.com only./protect. Failure to verify within 12 hoursRed flag: Real security alerts don't give deadlines — they let you secure your account at any time through the app's Settings > Security. will result in account restriction.
Email comes from a non-official domain
Real platform emails come from their verified domains (@x.com, @twitter.com, @facebookmail.com, @mail.instagram.com). Check the actual sender address, not just the display name.
Link goes to a domain that isn't the platform's official site
Always check the URL. If it's not x.com, instagram.com, facebook.com, etc., it's a phishing page.
Vague violation with no specific content referenced
Real content violation notices tell you exactly which post, tweet, or story violated which specific guideline.
Urgent deadline threatening account deletion
Platforms rarely delete accounts over a single violation. They give warnings, restrict features gradually, and provide clear appeal processes.
Arrives during a platform change or feature rollout
Scammers time these campaigns to coincide with real platform news (new features, policy changes) so users are primed to expect official communications.
Asks you to log in through the email link instead of the app
Real platforms handle account security through their apps. If you're concerned, open the app directly — never click the email link.
Real platform notifications appear in-app (in your notifications or inbox), come from verified email domains, reference specific content, and never threaten instant deletion. X/Twitter handles appeals through Settings > Account. Instagram and Facebook use their Help Center and in-app Security Checkup. None of them ask you to log in via an email link to avoid suspension.
Virtually never. Platforms use graduated enforcement: warnings, temporary restrictions, then suspension for repeated or severe violations. A single violation almost never results in immediate permanent deletion. If an email threatens instant deletion, it's almost certainly a scam.
Logos and formatting are trivially easy to copy. Scammers download the platform's official emails and replicate them exactly. The only reliable indicators are the sender's actual email address (not display name) and the URL the links point to.
2FA helps significantly, but advanced phishing kits (like the Starkiller kit identified in March 2026) can intercept 2FA tokens in real-time using reverse proxy techniques. The best defense is never clicking login links from emails — always go directly to the app or type the URL manually.
Paste it in and get an instant analysis — free, private, no account needed.
Analyze a Message