New Instagram scam alert: now bank accounts are being emptied with fake ads

Internet banking scams are multiplying and anyone can fall into the trap. When everyone was already attentive to the frauds that arrive by mail or WhatsApp, now a new channel that spreads scams has been added.

Instagram began to fill up with fraudulent stories that pretend to be produced by a bank. They promise very aggressive discounts on gasoline, flights, unique opportunities for retirees, low rate loans and much more. All of them are made with the bank's logo and a careful design, something that today can be achieved with any Artificial Intelligence program in seconds.

At the bottom of the fake flyer that can reach anyone who has an Instagram profile is the caption "More information". If clicked, the cell phone is directed to a page that pretends to be the home banking page. The victim will understand that he/she must enter the bank to get more information about that promotion. In all cases, the design of this page is the same as that of the bank.

There they ask for a document number, user and password. If personal data and passwords are entered, bye-bye account. The cybercriminals will be able to empty it.

On the left, an Instagram Story with a fake promotion promising discounts on gas. If clicked below, the system sends to a fake page (right) where they ask for banking passwords.

Other links lead to a phone call. It happened a few weeks ago to sports journalist Guillermo Salatino. He thought he was getting a discount from YPF and 1.8 million pesos were stolen from his account. The communicator fell into the trap through Instagram. "I was looking at reels and saw one of a 30% discount offer at YPF. I called the number on the reel and they answered," he said. There they asked him for some information.

In the end, they transferred his money to an ICBC account that he could not trace. "I couldn't be such a jerk," the journalist lamented.

What is known in the jargon as "social engineering", is the tool cybercriminals are using again. This is nothing more than detecting the needs of a large part of the population and exploiting their weak side to steal. If in the pandemic they sent false possibilities of getting vaccinated against Covid, now, because of the unchecked economic crisis, they offer promotions devised for Argentines hunting middle-class discounts.

"These hoaxes are usually very short-lived. Because someone reports them and Instagram unsubscribes them. It is estimated that they last between 8 and 10 hours and are powered by the same algorithms of the networks. For example, if someone is looking for airline tickets, they will probably get a fake flight promo. Or if they are looking for a discount on fuel, they may receive a flyer with a fake promotion", explains Camilo Gutiérrez Amaya, Head of ESET Latin America's Research Lab, to Clarín.

What are fake ads like?

A fake ad that seeks to deceive retirees with a non-existent Netflix promotion.

The seriousness of the matter is that these cheat ads arrive like any other Instagram advertisement. It is as if an advertising sign on the street gave us the address of a place where we are going to be robbed.

Meta, owner of Instagram, preferred not to answer Clarín's questions. But company sources sent a statement on the subject to the editorial office.

"Our Advertising Standards explicitly prohibit ads that promote products, services, schemes or offers using deceptive or fraudulent practices, including ads intended to defraud people or steal personal information. All content, including ads, is reportable and we take action whenever we identify content that violates our policies," the notice said.

"What happens is that Meta disassociates itself from the responsibilities that may apply to it when the user signs the terms of use of the platform. And it has a reactive ad control policy. That is to say that it acts when there are already faits accomplis with complaints from users, and then they do remove the advertisement. It happens that anyone can upload an advertisement to Instagram and, when paying, it will already be online. Perhaps they should optimize the algorithm so that it detects this type of deception before it is published," adds Gutiérrez Amaya.

"Meta has automated and manual reviews, which are activated by user reports, which is why it is important to report scams," adds Leandro Cuozzo, Security Analyst in the Global Research and Analysis Team for Latin America at Kaspersky.

Faced with the growing number of fraudulent advertisements that arrive in the name of all banks, these entities seek to raise awareness among their customers.

"In 2024 we carried out strategic communications in collaboration with different areas of the bank to raise awareness of fraud risks among our customers. These initiatives included sending educational mailings on the most common frauds, creating a featured story on Instagram with recommendations on cybersecurity, publications on social networks, complemented with guideline to expand reach, activation of interactive trivia on cybersecurity, communications in our branches and communications to employees," Juan Uranga, CMO and Head of Digital Sales and Design/UX at BBVA in Argentina, told Clarín .

What to do if you fall into the trap?

It is always a good idea to report it (Photo: AFP).

"First you should try to minimize the damage. If the scam involved sharing personal data such as credentials, passwords should be changed immediately and, if possible, a second authentication factor should be activated. If a transfer or payment has been made, contact the bank or financial institution to cancel the transaction, block the account in the case of virtual wallets or disown the purchase in the case of credit cards," explains Cuozzo.

Once everything is put in order, it is advisable to file a complaint.

"This can be on Instagram, in the option "report" both the account, the publication or the fraudulent advertisement; at the Police or prosecutor's office closest to the domicile and before the specialized cybersecurity entity (all over the country: Specialized Cybercrime Prosecution Unit of the Public Prosecutor's Office, [email protected]; City of Buenos Aires: Specialized Prosecution Unit on Computer Crimes and Contraventions of the Public Prosecutor's Office of CABA, [email protected]).

The business for criminals seems to be very profitable and not very risky. Already "farms" with global reach have been detected with operators who use AI tools to make these warnings.

There are no proactive controls by Instagram and if there are any, they are very weak and as these campaigns can come from other countries, it is very difficult for Justice to act. It seems that the only thing left to do is not to be unprepared and to be suspicious. "You have to doubt any promotion that can be categorized as too good to be true," warns Cuozzo.

SL