I recently discovered a business logic flaw in Instagram that turns a paid security feature into a tool for impersonation. Meta Verified Support—a feature meant to provide priority assistance—can be exploited to pull any user into an official support thread, making third-party messages appear as if they originated from Meta’s official staff.
When I reported this, Meta’s engineering team immediately recognized the severity. This wasn’t just a UI bug; it was a “Perfect Phishing” vector that leverages the highest level of trust on the platform.
The Mechanism: Bypassing the “System-Only” Gate
Official Meta Support chats are designed to be restricted, system-to-user channels. Under normal conditions, the “Add People” feature is strictly disabled because these are private, authenticated conversations between a user and a verified representative.
However, I found a logic bypass that unlocks this entire authorization layer. By utilizing the “Move to Primary” function within the chat controls, the application fails to enforce the restriction on adding third-party users to an official support case.
Real-World Impact: High-Trust Impersonation
This vulnerability poses a massive risk because it targets the one thing users trust most—official communication from the platform itself.
- Official Identity Mimicry: The victim receives the message under the official “Instagram Support” DM tab, inheriting all the visual trust markers of the system.
- Zero Warning Signs: Unlike standard group chats, there are no visual indicators or system banners indicating that a third-party user has been added to or is controlling the conversation.
- High-Success Phishing: Attackers can request sensitive documents, 2FA codes, or password resets while appearing as a legitimate Instagram employee within an official interface.
How I Verified It
- The Setup: Using my Meta Verified account, I initiated an official support chat via the settings menu.
- The Bypass: Inside the active support chat, I opened the Chat Controls and clicked “Move to Primary”.
- The Action: I navigated back to the “People” settings. The “Add People” button was now functional, allowing me to search for and invite a victim’s username.
- The Result: The victim received a notification and opened the message to find themselves inside the official Instagram Support interface, seeing my messages as if they were official system communications.
Resolution and Timeline
I reported this vulnerability to Meta’s Bug Bounty Program with a full proof-of-concept video demonstrating the bypass. Meta acknowledged the report, triaged it as a high-severity logic flaw, and issued a fix to ensure system-level chats remain restricted.
