Social Media Account Hijacking

Account takeover has existed since the 2000s; the landmark case is the July 2020 Twitter hack from Tampa, Florida, when 17-year-old Graham Ivan Clark took over 130 high-profile accounts.

Taking over social accounts began with password reuse and phishing in the 2000s, but became a business in the 2010s: SIM-swapping and social engineering of platform staff let the 'OGUsers' community steal short 'handle' usernames for resale, and the July 2020 Twitter hack, in which teenagers used the company's internal tools to post a bitcoin scam from Barack Obama's and Elon Musk's accounts, showed the reach. Since 2022 hijacked Instagram and Facebook accounts are used to push crypto scams to the victim's own friends, and offenders steal recovery codes by impersonating friends.

The attacker gets in by phishing a login page, reusing a leaked password, tricking the victim or a friend into forwarding a recovery code, swapping the victim's SIM to receive SMS codes, or bribing or socially engineering platform staff. Once inside they change the email and phone, lock the owner out and either sell the handle, post crypto 'giveaways' to followers, message friends with investment pitches, or extort the owner for its return. Accounts of minors are also used to obtain intimate images.

Needs no code - Mosley and Svara took over nearly 900 accounts by impersonating friends and asking for recovery codes - and a hijacked account brings the victim's entire trust network. The FTC traced $1.9 billion of 2024 scam losses to social media, while platforms rarely restore accounts and police rarely act unless extortion or minors are involved.

No body publishes a hijacking-only total; the FTC counts $1.9 billion in US losses from scams that began on social media in 2024. The most famous case, the 2020 Twitter hack, netted only about $117,000 but reached 130 of the world's most-followed accounts. Victims lose businesses run through their accounts and, in the Mosley and Svara cases, were extorted for intimate images.