A friend asks you to vote for them in a contest on Instagram, Facebook or X? Learn how the vote link steals logins and what to do if you clicked.
A vote for me message, even from a friend, should be treated as a possible phishing link. Do not log in through it. If you only opened the page, close it and check your account. If you entered a password or a code, reset your password from the app, log out unknown devices and follow the official hacked account steps.
SummaryA direct message arrives from someone you know. They are in a competition, a design contest or a talent search, and they need one more vote. The link opens a page that looks like a voting site and asks you to sign in with Instagram, Facebook or your email account to cast your vote. It feels like a small favour for a friend. This scam turns that favour into a stolen login. This guide covers the pattern on all three platforms, how to tell whether you are affected, and what to do depending on how far you went.
Last checked: 21 October 2026.
Treat it as one unless you can confirm with your friend through another channel, such as a phone call. Instagram's page on how to protect yourself from phishing describes phishing as someone trying to get access to your account by sending a suspicious message or link that asks for your personal information. It says that if they get into your account, they may use it to send spam. That is the loop behind this scam: a hijacked account messages its friends, and each new login handed over can feed the next round.
The wording and the contest change. Switzerland's National Cyber Security Centre has described this pattern, with a fake voting page that asks you to log in with Instagram, Facebook or an email account, and it names Facebook, Instagram, X and Snapchat among the networks targeted. The safe rule does not change: never log in to a social account through a link someone sent you.
This scam does not rely on a stranger. The message comes from a name and photo you trust, the request is small, and voting feels harmless. The login button on the fake page looks like the ones you see on real sites every day. None of that makes you careless. The useful habit is simple: a link that asks you to log in to a social account is a reason to stop, close it and open the app yourself instead. If your friend really is in a contest, they will understand a short delay while you check with them.
| What you did | Risk | What to do now |
|---|---|---|
| Read the message only | Lowest | Do not click. Report the message and warn your friend another way |
| Opened the link but typed nothing | Low | Close the page, do not log in, and check your login activity |
| Typed your password | High | Reset your password from the app and log out devices you do not own |
| Typed your password and a login code | Very high | Act now. Reset your password, check your email and phone details, follow the hacked account steps |
| Already locked out | Account taken | Use the platform's official hacked account route straight away |
Instagram's phishing page says that if you accidentally entered your username or password into a strange link, someone else might be able to log in. If you can still log in, it says to reset your password and log out of any devices you do not own. Instagram's page on securing your account adds two-factor authentication and checking that your email account is secure, since anyone who can read your email can probably also access your Instagram account.
If you are already locked out, Instagram's page if you think your profile has been hacked says to check for an email from security@mail.instagram.com about a changed email address, which may let you undo the change, and to request a login link from the login screen. If you can still log in, it says to change your password, turn on two-factor authentication, confirm your email and phone number are correct, check Accounts Centre, or Meta Account settings if that is what your app shows, and remove any linked accounts you do not recognise and revoke access for suspicious third-party apps. If the email and phone have already been changed, our guide on an Instagram hacked with the email and phone changed goes further.
Facebook's page on what to do if you've been phished says to first report your account as compromised, and that you can do this whether or not you can still log in. If you can still log in, it lists resetting your password, removing logins and devices you do not recognise, reviewing your activity log, checking recent emails from Facebook and deleting posts you did not make. If you think a financial account was accessed or payments were made, it says to contact your bank straight away.
X's page help with my compromised account lists signs such as unexpected posts, Direct Messages you did not send and a password that no longer works. Its steps are to change your password, make sure the email address on the account is secure, revoke connections to third-party applications you do not recognise and update your password in trusted apps. If you still cannot log in after a password reset, it says to submit a support request using the email address linked to the account and to include your username and the date you last had access.
Our guides to a hacked account messaging your friends and to friends scammed from your hacked account in Malaysia cover the follow up in more detail.
If you caught it early and reset your password, you may not need any help. A review can help when the scammer has changed your email and phone, when the account was used to ask friends for money, or when the platform's own routes have not worked. AwareXone works through the platforms' official recovery routes only and never asks for passwords, codes or browser data. See our Instagram account recovery page for how a review works and the Trust Center for what we never ask for.
More free guides on the same kind of problem.
