Instagram Monday said it would again crack down on users who pursue “inauthentic activity” to boost an account’s popularity. Within hours, BlackHatWorld, a forum popular with self-proclaimed “black hat” social media marketers, was in crisis.
In a section of the forum usually reserved for sharing the best deals on obtaining fake Instagram followers, concerned users started at least 13 threads to discuss the policy change. “The beginning of the end?” asked one user. “It’s happening,” wrote another, posting a link to Instagram’s press release, which promised to “begin removing inauthentic likes, follows and comments from accounts that use third-party apps to boost their popularity.” BlackHatWorld users squabbled long into the night over the extent of Instagram’s purge. By Tuesday afternoon, several threads had descended into chaos. Applications had already started to go offline. It was an illicit growth hacker’s worst nightmare—suggesting that this time, perhaps, Instagram might actually be on to something.
Likes, comments, and followers are the currency of Instagram. They are the metrics by which we determine a profile’s worth, or an idea’s popularity, but they can be difficult to amass. From this stems their power. An account with tens of thousands of followers inherently seems more legitimate, and trustworthy, than one with three. When an account reaches 10,000 followers, it’s granted access to one of Instagram’s most coveted features: the ability to embed links in Instagram Stories. For a relatively link-adverse platform like Instagram, the feature is a big deal and could be used to drive traffic to a particular site or brand. For influencers, who make all or part of their living promoting products through Instagram, the stakes are even higher. Payments for these deals are determined based on perceived reach, so a higher follower count often directly translates into a significantly higher paycheck.
Unlike its real-life counterpart, however, digital popularity can be bought in minutes. Engagement manipulation has long plagued platforms like YouTube and Twitter, and Instagram is no different. Wannabe influencers, new companies, and scammers alike often turn to these services to get their profiles off the ground; when done right, fake engagement begets real engagement.
Instagram’s new policy is aimed most squarely at so-called automated amplification services. Almost all of these apps require a user to pay a subscription fee and turn over their Instagram login credentials, a direct violation of the platform’s terms of service and a clear security risk. The applications use the credentials to send the user’s profile into an automated frenzy of likes, comments, and follows, in an attempt to get real users to follow the client’s profile.
In its announcement, Instagram said that with the help of machine learning, it had identified users who had shared their login credentials with such services, and would offer those users an ultimatum: change your password immediately to revoke the service’s access to your account, or see your Instagram experience “impacted.” Instagram did not respond to multiple requests for additional comment.
“Many influencers and regular users use these tools to create perceived growth in their audience and to appear more successful than they are,” Gil Eyal, CEO of HYPR Brands, an influencer marketing company that specializes in rooting out fake followers from real ones, told WIRED over email.
As of Tuesday afternoon, a number of BlackHatters reported experiencing issues with Jarvee, one of the most recommended Instagram automation apps on the forum. In exchange for a subscription fee ranging from about $20 to $70 a month, Jarvee allows users to automate multiple in-app actions, from follows, to DMs, to reposts, and beyond, on up to 150 accounts across 8 social media platforms. Some users who tried to use the service Tuesday to automate follows, likes, and other actions, said they were greeted with a strange error message. “I was thinking it's because instagram issues ppl had today [sic],” wrote one user, who noted that Jarvee pushed out an update that morning. “I have the same issue on another bot,” wrote another, “it's because of a [sic] instagram update I'd say.”
In a message to WIRED, Jarvee said there was “nothing to worry about” and dismissed claims that Instagram’s crackdown had any effect on its services. A representative from Jarvee said that the service simulates traffic from the Instagram’s iPhone app in order to fool the company into believing it’s a legitimate user. “Just make sure you don't do too many actions and make sure you make your account look as natural as possible,” wrote the Jarvee representative.
Instagram fakery used to be much simpler. If you wanted more followers, you could visit one of the countless slightly sketchy sites offering them by the thousand, enter in your credit card details, and watch your follower count skyrocket. However, over the last few years, pulling off the sort of fraud capable of catapulting a user to genuine popularity has become much more difficult. Instagram’s decision to eschew the beloved chronological feed in favor of a more mysterious algorithmically ranked system left fraudsters scrambling for a workaround. Instagram hasn’t shared the specifics of how it ranks posts, but it’s clear that its new system prioritizes overall engagement—meaning likes, comments, story views, saves, mentions, and DMs.
That’s forced aspiring influencers and Insta-stars to take a multi-pronged approach to faking their followings. The most common methods over the last year or so fall into two main camps: automated engagement amplification services and pure paid fakery.
As of Tuesday afternoon, followers, likes, comments, story views apparently could still be bought from Social Media Marketing (SMM) panels, online vendors that use an automated fleet of accounts—or in some cases, real people controlling dozens of sockpuppet accounts—to provide clients with fake engagement.
“There is a huge market around this and a huge percentage of ‘influencers’ who use these services because they’re so cheap,” says Eyal. As of Monday evening, the going rate on one popular panel, SM Garden, was $3 to acquire 1,000 followers, $1.80 for 1,000 likes, $1.20 per 1,000 video views, $1.20 per 1,000 random comments in English, or $3 per 1,000 comments with emoji.
These services may be popular, but they are rarely very sophisticated, says Eyal, and pretty easy to spot. They follow and unfollow random accounts en masse, post stock photos and images scraped from real users, and are often associated with unusual IP addresses, he said. And these are just the signs visible to outsiders. Instagram itself has access to a wealth of data far beyond what is publicly available, like the specific software or application used to make the posts, the timing of behavior, and similarities in captions, bios, comments, or posted photos.
Despite this wealth of identifying information, SMM panels continue to be popular among users. Instagram’s crackdown on inauthenticity doesn’t appear to have affected these accounts yet, and panel companies seem relatively well prepared for the challenge. In a message to WIRED, one of the administrators behind SM Garden said that the company was aware of Instagram’s policy update. The admin said that though SM Garden couldn’t predict the future, it always “make [sic] sure that our services are closely look real as possible.” SM Garden did not respond to questions about the status of its Instagram services currently, but the site’s “news feed,” which provides minute to minute updates on the availability of its offerings, did not indicate any issues.