Watch Out for the Identity-Stealing Spambots of Instagram

The latest crop of spambots on Instagram are employing a trick even slimier than just buying fake followers: They're stealing profiles. As The Verge reported today, some Instagram users are getting followed by their bot doppelgängers, profiles made up entirely from their ripped-off images.

This goes down because Instagram bot makers are lazy (not to mention bad at making life choices). They don't want to come up with thousands of fake-yet-realistic digital personas, especially since the more active accounts they have control over, the more money they can make selling follows and likes from these accounts on the underground market for Instagram follows and likes.

Identity-stealing bots aren't new on social media. Facebook and Twitter have had them for years. They're not even new on Instagram. Instagram users have been complaining about them since at least 2012, which is when user shayjdgaf first noticed someone ripping off her account:

Yet despite the resurgence, Instagram isn't taking care of the problem like it should be. Here's how Instagram says it manages impersonator incidents:

Instagram takes safety seriously. If someone created an Instagram account pretending to be you, please report it to us and make sure to provide all of the requested info, including a photo of your government-issued ID.

Jamie Young, the editor in chief at App Advice, was recently impersonated by a bot and informed Instagram. She took the proper steps, and sent in a government ID.

I asked Instagram if they were doing anything to fix the issue at large, like creating an algorithm that pulls up duplicate profiles. I haven't heard back, but that kind of measure almost certainly doesn't exist, since Instagram doesn't take any proactive steps to fight the problem... and even when users like Young alert them to impersonations, they won't find them mischievous enough to take down.

Here's how Instagram responded to Young's complaint:

Thank you for your email. Unfortunately, we won't be able to remove the account you reported. We only remove accounts that impersonate you in a way that is intended to mislead, confuse, or deceive others.

Uh, it seems like all impersonations (besides maybe inside jokey friend situations, which is obviously not the case here) are intended to mislead, confuse, and deceive others, by definition.

Instagram is a very popular app. It can't employ infinite safety officers making sure its users aren't getting impersonated. But putting forth absolutely zero effort on its end until someone complains and submits a government ID is a bad policy, and one that belies the insistence that Instagram takes safety seriously. So is rejecting valid impersonation complaints.

Here's what an Instagram spokesperson told us about their policy:

"To limit the spam you see on our service, we prohibit the creation of fraudulent accounts and use a set of systems that work to flag and block suspicious accounts used for spam. You can also report these accounts using the report links we provide in our apps and on our site."

But as Young's recent issue with an imitator shows, Instagram's reporting system doesn't exactly yield results for everyone.

Parent company Facebook has extremely sophisticated facial recognition software; I seriously doubt creating a program to trawl profiles and point out duplicates is beyond its technological capability. This is a problem that persists because Instagram doesn't prioritize it. [Verge]