Instagram bans hundreds of accounts with stolen usernames

On Feb. 21, 2019, Pondicherry found himself locked out of his email accounts. Then, his phone stopped working. When he checked his AT&T account the next day, his number was associated with a new phone.

What Pondicherry experienced was a SIM swap, whereby a cybercriminal exploits someone’s personal information to obtain control of their phone number from a wireless provider, then uses two-factor authentication to gain access to their personal accounts. After Pondicherry regained control of his AT&T account and tried to log into Instagram, he discovered that his handle, @Ajay, had been stolen by the hacker.

SIM swapping has been many cybercriminals’ favored method of obtaining valuable Instagram accounts and social media handles. (It was also the method used by hackers to take over the Twitter account of Twitter’s chief executive, Jack Dorsey, in 2019.)

But recently, cybercriminals in pursuit of OG usernames have resorted to harassment and threats. According to Instagram, the people behind the accounts banned Thursday — some of which had millions of followers — had subjected the owners of desirable Instagram handles to threats of swatting, revenge porn and violence.

Jackson Weimer, 22, the administrator of a meme account called @hugeplateofketchup8, said he has encountered hundreds of people who engage in this type of behavior online.

“Their main objective is to grow their pages, and selling these OG usernames is a game for a lot of them,” he said. “Their objective is to do this to as many people as possible. Every meme page has encountered one of these people.”

After Weimer called attention to these practices on his own Instagram, he was met with a barrage of harassment. “They sent me pictures of my house on Google Maps,” he said of his harassers. “They told me they wanted to rape and kill my parents. They said that I’ll regret doing this. They sent me my address a lot and created an account ‘exposing’ me on Instagram, where they’d just post and make up lies about me.”

Instagram said that nine cybercriminals were behind the unauthorized seizure of hundreds of Instagram accounts, but the platform’s ban includes not just these nine users but middlemen who helped orchestrate the buying and selling of accounts on ogusers.com and Telegram, an encrypted messaging app. Many of the middlemen are young people, including teenagers, who view short handles as status symbols.

“It’s like driving a fast car when cars were important,” said Dr. Argelinda Baroni, a clinical assistant professor of child and adolescent psychiatry at NYU Langone Health. “Children in general want to be validated. Kids want to be cool. But kids do very dangerous things to obtain status.”

After noticing an alarming uptick in account theft and escalation in the methods used to acquire usernames, Instagram took action in 2020 and began working with TikTok and Twitter to identify accounts across platforms.

“As part of our ongoing work to find and stop inauthentic behavior, we recently reclaimed a number of TikTok usernames that were being used for inappropriate account squatting,” a TikTok representative said in a statement. “We will continue to focus on staying ahead of the ever-evolving tactics of bad actors, including cooperating with third parties and others in the industry.”

Twitter confirmed the company had also banned users for violating the platform’s policies on manipulation and spam. “This investigation was done in tandem with Facebook,” a Twitter representative said.

Rachel Tobac, a hacker and the chief executive of SocialProof Security, which hosts security training and workshops, said that the pandemic has pushed more young people into online communities where they can earn money and find camaraderie.

“It’s basically a lack of support and an increase in economic hardship, specifically under COVID-19,” she said. “I want to stress that this is a societal challenge that these minors are falling into cybercrime like this. We’ll always have criminals, but we’re going to see people, especially minors, turn to cybercrime when there is a lack of a support system or specific economic downturn affecting them.”

Instagram said it is sending cease-and-desist letters to individuals behind the theft of high-value handles and is collaborating with local law enforcement agencies to hold those involved in criminal activity accountable.

Although Instagram has previously banned meme accounts for violating terms of service, Thursday’s crackdown is the most public and decisive action Instagram has taken against people manipulating the platform for financial gain. But Will Dyess, vice president of Dank Memes, an e-commerce and media company that runs several pages with coveted usernames, said he was skeptical that the attempts at stealing the account would ever fully subside.

“Will @Stonks ever stop being a target? Probably not, especially not after last week,” he said, referring to the GameStop frenzy. “There will always be demand for certain usernames, URLs. The real estate of the internet is finite.”