Goodbye to username scammers

I’ve just read that Instagram are in the process of rolling out a new feature that locks a username for 14 days after a user decided to change it. So if the original user changes their mind they can get it back. This could be the end of username grabber bots and also make it harder for scammers to steal prized usernames!

They have also flagged that you are still likely to lose your verification if you change your name. Even if you decide to revert back it’s likely you will have to reapply.

4 Likes

■■■■ off are you kidding me? so I can’t steal IG handles anymore? how will I feed my family?

2 Likes

I wonder how they determine whether the user who wants to switch back is the previous owner. The account must stay on the device somehow, unless they will track it by IP/email. Do you have a direct link to the press release? This sounds like the end of claimers and people who con others via “move the account out while I send you the payment”.

I also wonder if this somehow will also affect us as far as transfers go, we need to find out how the reclaiming process works.

2 Likes

I’m just out at the mo but will send through when I get back. It does make any transactions without the OG/most current email as part of the sale very very sketchy.

here you go https://wersm.com/instagram-will-start-locking-old-usernames-for-14-days/

the lady who discovered it has been getting death threats etc for exposing it

https://twitter.com/wongmjane/status/1108189146344882176

“We’re always analyzing trends so that we can build features that keep our community safe. We observed that if someone changes or loses their username—for example, if they want to switch usernames, or if they lose access to their account—it can sometimes be claimed quickly by another person. With this feature, we give the account holder the security of knowing their username is safe for a period of time following any changes.”

Seems like they’ve confirmed it. Wonder when it’s rolling out. As far as the OG email, ever since we’ve started pushing sellers to provide OG emails, we hardly get any tickets without them. People just aren’t willing to risk it, especially on more expensive properties.

So, it seems like the end of claimers. But I have a question we can debate on, is claiming really scamming? Obviously, if the account holder was manipulated to temporarily lose control of his account so a claimer can pick it up, then yes. But there are people out there who simply run claimers 24/7 on popular names. I mean, if someone releases an account it’s fair game, no? How is it different than domainers who track what is about to expire and what’s worthy, only to pick it up ASAP. Or bidding snipers who always snag items at the last second? Unfair advantage, sure. But is it scamming? That’s debatable, in my opinion.

1 Like

i agree i dont see it as scamming if it is done without duping the owner to change their username.

1 Like

I honestly felt tempted to run a claimer myself, just to see if it can pick up anything, seeing how expensive some of our OG handles tickets are. It’s just crazy how a good handle can be worth as much as a mid-size luxury sedan.

Most of the claims are from when the scammer messages a page and tells him he’s going to buy his handle in a ridiculous amount, but he needs to transfer the handle to a different account first, then the scammer takes his name. I’ve gotten a lot of those messages

If what Chris posted is real, it’s amazing and will stop people from getting scammed.

Honestly, this whole thing could have been stopped with throttles on IG’s part. If a username tries to get registered from THIS IP an X amount of time, deny every time. The amount of proxies needed would raise the costs by a lot, thus making claiming unprofitable. But, the 14 day rule works too. However, I won’t celebrate until I see the system in place. I mean, scammers always find a way, don’t they? It’s a constant cat and mouse game.

I recently bought a 2 letter username. In under 24 hours, I was hacked (no email notifications from IG btw) - bypassing 2FA, they changed the email/password/phone number. Then they switched out the username to another account.

It’s been disabled since. Can’t find a way to get it back.

Lol this won’t stop anything, if only it’ll just make turboing more known to others cause if they see someone change their username and it’s “locked” they’ll just have theirs running until it’s open.

If they actually want to put an end to all of this then they’d remove the username change feature completely… which they won’t.

Exactly what RyRy said. Claimers won’t disappear, they’ll just have a delayed feature like backordering a domain name when it becomes available. This is not going to stop people from snatching up handles at all.

1 Like

You right in that sense however 2 weeks makes it hard for the scammers to scam someone out of their handle. In the scenario that Swapd mentioned

Yeah, I don’t know what @Ryan and @jon1 are smoking (no offense), but it will absolutely make it super difficult for claimers to user their traditional ways.

It’ll just make turboing more known to others cause if they see someone change their username and it’s “locked” they’ll just have theirs running until it’s open.

That statement doesn’t even make sense. Sure, they can leave it on, but the point of the lockout is that the owner can just say “wait a second, something is wrong, I am taking my old account back.”

Or am I smoking too much and don’t understand that @Ryan’s train of thought?
Just to make sure, let’s run this down again.

  1. An attacker is trying to claim XACCOUNT
  2. The owner of XACCOUNT gets duped, tries to “move out the account” and unregisters it.
  3. The attacker sees that XACCOUNT is unregistered (but locked for 14 days) so the attacker “turbos” it even more?

Where is the point of that? The owner of XACCOUNT notices something is up. I mean, he has 14 days to recover the account, so whether he is waiting for a payment that will never come, or waiting on whatever other lies he was told, he will eventually grow tired of it and revert back. Another thing, we don’t know whether a locked account (14-day lock) will be distinguishable (from an attackers perspective) from a regular, registered account. I seriously doubt Instagram would give notices such as (for example): “Sorry! This account was unregistered and will be available in 11 days”.

Now, I don’t doubt workarounds are possible. This is Instagram/Facebook we’re talking about. They are notorious for bugs/workarounds/etc. Thieving won’t go away, but will it be more difficult? If they pull this off correctly, then I believe so.

2 Likes

This “turboing” works at the moment because it uses an element of surprise. An average Joe doesn’t have a clue that there is a robot trying to register his name 100 times per second, so he doesn’t see a problem with moving an account. A 14-day grace period will give everyone plenty of time to think twice, and scammers will have a REALLY tough time convincing someone to leave their handle unregistered for two weeks.

5 Likes

Good news, I receive about 1 scam attempt per day on a really premium 3 characters username. It’s very time consuming to vet the good leads from the scam attempts.

1 Like

I don’t smoke, so there’s your answer! You’re talking about completely different scenarios.
Being hacked/duped and having a bot monitor availability are two different things.
Sure, if someone realizes they’ve made a mistake the 14 days is a great solution to not lose a name.
That will help, but it will still not stop people from capturing available names instantly.

You’re also assuming everyone will somehow take advantage of the 14 days. That’s like with domain names and people who get a grace period to renew. But guess what? Great domains are still lost every day. There are bots monitoring availability waiting to instantly register these.

1 Like

rip turbos

1 Like

Yes, you’re right jon1. But we were talking about pure scammers in this topic, hence the title “goodbye scammers”. It’s natural that names will still drop for other reasons, but in my opinion this will be severely limited now. Usernames don’t expire like domains, so unless someone is tricked to release it, it’s unlikely the person would drop it, especially if it’s a rare name. In conclusion, this Instagram change (if executed correctly) will be devastating to these turbo-yielding people.