Scammers are abusing Instagram's protections against suicide, self-harm, and impersonation to purposefully target and ban Instagram accounts at will, with some people even advertising professionalized ban-as-a-service offerings so anyone can harass or censor others, according to screenshots, interviews, and other material reviewed by Motherboard.
It appears that in some cases, the same scammers who offer ban-as-a-service also offer or are at least connected to services to restore accounts for users who were unfairly banned from Instagram, sometimes for thousands of dollars.
"Me (and my friend's) currently have the best ban service on-site/in the world," one advertisement for a ban service on the underground forum OG Users reads. "We have been professionally banning since 2020 and have top-tier experience. We may not have the cheapest prices, but trust me you are getting what you are paying for."
War, the pseudonymous user offering the ban service, told Motherboard in a Telegram message that banning "is pretty much a full time job lol." They claimed to have made over five-figures from selling Instagram bans in under a month. War charges $60 per ban, according to their listing.
Do you know anything else about banning or restoring accounts? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, or email firstname.lastname@example.org.
Another banner on a different underground forum offers the service for between €5 and €30 per account, depending on the number of followers. That listing advertised bans for accounts up to 5,000 followers, but claimed that higher follower accounts are also possible to ban. The first listing said it can impact accounts with up to 99,000 followers.
War said they didn't know why particular customers may use their service, but added "obviously individuals who have money to throw around."
"Maybe it is their ex or they have/had a grudge with them. Maybe ruining their business, maybe getting paid even more from a third party," they added.
Both listings say that a target account must have a human in the profile photo. In War's case, they said they ban users by filing a fraudulent impersonation complaint to Instagram.
"I use an impersonation method where I get my verified IG accounts and change my profile to look exactly like the target's bio, name, profile photo etc. I report them for impersonation once and boom, they are gone," War told Motherboard.
A victim of ban attacks also showed Motherboard that their account had been banned after someone fraudulently reported it for violating Instagram's policy on suicide or self-injury.
"My page just got disabled again," the target of bans, who uses the handle flanvel on Instagram, told Motherboard after their account was briefly restored. "Was up for a few hours then take straight back down." Flanvel shared two screenshots both taken by attackers showing the flanvel account being reported for self-harm. Flanvel said one was taken by the attacker who later direct messaged it to Flanvel, and that the other was advertised on the attacker's own Instagram account. Flanvel said they became a target of banners after they helped legitimate cannabis companies recover their own banned accounts.
These bans let attackers "censor at will," flanvel told Motherboard in a phone call. Flanvel said they made their own script to demonstrate how easy it was to mass report a particular Instagram account.
Others have had similar ideas. Beyond the paid ban-as-a-service listings, multiple scripts are freely available online that can let someone report a particular Instagram account over and over in an automated fashion. One script Motherboard found which was created around 10 months ago says it will stop auto reporting after around 40 reports so as to not hit Instagram's limit. Motherboard also saw a job advert on a freelancing site seeking someone to develop a bot to mass report an Instagram account.
After being the target of a ban attack, a victim may be contacted by someone offering to restore their account, according to multiple screenshots provided by flanvel.
"Basically it's 3500-4k to restore. 1500 refundable deposit to start," one person allegedly offering restore services wrote in a message to a victim, according to one of the screenshots.
Motherboard has previously reported how Instagram's account recovery process for hacked accounts has been so dire that influencer victims have resorted to paying experts to navigate the process for them (after that and other coverage, Instagram made changes to its recovery process).
For banned accounts, victims generally have to provide Instagram with several pieces of information such as their name, phone number, and linked email address, flanvel explained. Flanvel said that previously, once an account was banned, the owner could try to restore it themselves straight away. Recently, Instagram introduced a 24 hour buffer window where a user has to wait before trying to restore the account, they said.
But it appears that in other cases some of the people offering restore services are connected to those banning the accounts in the first place. Flanvel says some victims receive a message offering account restoration immediately after being banned, and that in their own case, the two accounts that launched the ban attack and the one offering the restore service follow each other on Instagram.
Instagram told Motherboard it was investigating the sites offering ban services, and that it will itself ban people from Instagram who repeatedly break the site's guidelines. Instagram also encouraged users to report people if they suspect this type of activity, and pointed to its own support page that users can follow to restore their own disabled account.
Subscribe to our cybersecurity podcast, CYBER.