Hundreds of 'creepy' Instagram accounts target youth to grow online audience
Anonymous accounts build up followers and then are sold off to spammers and marketers
Maggie Coffin Prowse was cooking dinner inside her New Brunswick home, when her 11-year-old son said something frightening.
"My eldest son was playing on his phone and he said 'Hey, this guy guessed who I am!' I said, 'What do you mean, they guessed who you are?'"
The mother of two, who lives in Grand Bay-Westfield, northwest of Saint John, went over and saw her son scrolling through Instagram.
The "guy" was actually an anonymous profile with the username i_know_who_you_are_679.
The profile picture was a figure in a red hoodie with a creepy black shadow where a face should have been.
The description of the account was equally unnerving.
"I know who you are … dm my account and I'll guess who you are. RVMS [River Valley Middle School] kids and I can guess some Beaconsfield kids."
'All about trust and manipulation'
There are hundreds, if not thousands of Instagram accounts akin to i_know_who_you_are_679 that claim they'll perform the same trick: in exchange for a follow or a shout-out on your profile, they'll DM you back with personal details ranging from where you live and go to school, to who has a crush on you, and details about your future.
Many of the accounts use a Guy Fawkes mask — widely associated with the hacktivist group Anonymous — as a profile picture.
It's a creepy ploy — but one that appeals to the curiosity and vanity of young users. One of the most popular such accounts, with the username i.know.exactly.who.you.are.dms, has more than 80,400 followers.
Coffin Prowse said her son had been intrigued by the account. He sent a DM, or direct message, asking the person behind it to guess who he was.
The account responded with correct information: his grade and the school he attends. But when her son asked them to reveal their name, the message he got back was: "I can't tell you that.'
"Red flags were going up all over the place," said Coffin Prowse. "It made me feel like I watched way too many episodes of The Following."
Why is this such a huge thing?
According to David Shipley, the CEO of cybersecurity firm Beauceron Security, "tapping into people's curiosity is a great way to build up an online audience."
The modus operandi of these accounts, he said, is to build up followers, then sell the account off to spammers and marketers. Accounts with a huge following are a valuable commodity that can be sold in the shadowy world of the so-called dark web.
"It's a classic example of bait-and-switch," Shipley said.
A sophisticated example is the interference of Russian hackers in the 2016 U.S. presidential election.
"Russians hackers created Facebook groups for conservative causes or Christian movements, posting innocuous content relevant to a conservative audience," Shipley said "Then as the election ramped up, they started spewing out fake news about the Hillary Clinton campaign because they had a large audience that trusted them.
In addition to participating in a potential scam, Shipley said, interacting with anonymous accounts also opens users up to doxxing — where scammers scrape the web for personal information, then publish it online — as well as cyberstalking, blackmail and other intrusions.
"It's all about trust and manipulation," he said.
Copycat account
The Instagram profile targeting kids at RVMS and Beaconsfield has since been deleted.
And it likely wasn't the work of sophisticated hackers in the first place.
The references to specific Saint John-area schools, and the fact that users didn't have to follow the account to get a response, suggest a student may have created a copycat account inspired by the popularity of the I-know-who-you-are genre on Instagram.
In an email to Coffin Prowse, River Valley Middle School principal Trudy M.G. McGrath said the school was aware of the account, and administrators were "certain" it must be a student (or group of students), since the information shared would only be known to students at the school.
"I would simply encourage students to not interact with anyone online unless you know who they are," McGrath said in the email.
School administrators could not be immediately reached by CBC News for comment.
Kids 'desensitized to it'
After talking with several police officers she knows, Coffin Prowse said, she chose not to file a police report.
"Because the kids are reaching out to the person as part of this game, there's very little that the authorities can do," Coffin Prowse said.
The most surprising thing to Coffin Prowse was that her son "wasn't fazed by it," she said. "The kids are desensitized to it. Everyone under the age of 22 is completely blasé about the whole thing."
Shipley recommends that parents report any creepy anonymous Instagram accounts interacting with their kids, but — an important step, he said — to "get informed as a parent."
Parents of younger children, in particular, need to have basics about how apps work and which ones their kids are using. Kids also need to be taught not to message anonymous accounts, no matter what intriguing information they promise to deliver.
"The internet is not a one-way consumption method, like television," Shipley said. "This is a two-way relationship with information exchanged. That's where the risk comes in.
"Folks who aren't street-wise to the digital world are really easy marks."
ABOUT THE AUTHOR
