[Notes] Paranoia starting with "Sorry to hear you're having trouble logging into Instagram..."

The title is long, lol.
Getting straight to the point, I suddenly received an email from Instagram around the end of spring.

Here is the text of the email.
Sorry to hear you’re having trouble logging into Instagram. We got a message that you forgot your password. If this was you, you can get right back into your account or reset your password now.
If you didn’t request a login link or a password reset, you can ignore this message and learn more about why you may have received it.
Only people who know your Instagram password or click the login link in this email can log into your account.

I understood the meaning, but since it's a hassle to translate it into Japanese myself, here is a bulk translation ↓

By the way, Ididn't send any requests related to forgetting my password, and I have absolutely no memory of this!



Although I created an Instagram account a few years ago, I currently only use it for gathering information and browsing, and I haven't made any notable moves.
Or rather, above all,the account I currently own is not the ID name listed in the email.

On top of that, the first part of the ID written in the email is a name I used on the internet a long time ago.
However, I have absolutely no memory of using this ID itself.

It's kind of strange, or rather, creepy.


I searched a little, but it didn't feel right, so I asked ChatGPT for now.

And it was solved immediately.lol
Thank you, OpenAI.





Below issince it's a hassle to explain the flowa copy-paste of the conversation.

👩🏻 (Me)
I have a question.
I panicked because I just got this email.
What does this mean?

I didn't send any requests myself, and after a quick search, it seems there's a possibility of a third party doing it, so I've already taken measures like setting up two-factor authentication.
However, what's creepy is that my Instagram ID isn't something like ●●0●●0ch0an.
That's been bothering me the whole time.
My current ID doesn't even come close, but the word ●●●● is a nickname I've been using for about 10 years, and it is the name of an Instagram account I deleted a few years ago...
But I don't add 'chan' to myself, so I have a feeling that I wouldn't have set the ID to ●●●●chan back then either.
What on earth is going on??
It was from the official Instagram address, so it doesn't seem like a scam email.

🤖 (ChatGPT)
I'll give you the conclusion first.
This isn't an attack on your current account.
But it's a pretty creepy type of 'probing move'.

The mechanism is like this 👇

Someone tried to log into Instagram with the username '●●0●●0ch0an'
→ Forgot password
→ Pressed password reset
→ This email was sent to the email address linked to that username
In other words, Instagram recognizes that

'The registered email for this ID is your address'
That's the most chilling point.
Why does that happen?
Instagram account specifications include this:

• Usernames you used in the past
• Usernames of deleted accounts
• Email addresses linked in the past
These don't disappear completely. They remain in the internal database.
So a third party

picks up traces of your old nicknames
and is trying brute force, thinking 'Maybe this ID is linked to this email?'
This is a type of tactic that is increasing quite a bit now.
Especially targeting:
• Old IDs
• Deleted accounts

• Old nicknames
This matches your story perfectly.
●●●● → Nickname from 10 years ago
Used in a deleted Instagram ID
Didn't add 'chan'
In other words, this is

a guessed ID created by tracing your past traces.
It's too pinpoint, right? It's not a coincidence.
So why did the email come?

The answer is simple.
That ID

was likely created by you in the past, or created halfway, or tested.
Even if you don't remember it, it happens if the history of 'registered → immediately deleted' remains.
Instagram doesn't delete this.

⸻

Is your current account safe?


Actually, you're taking perfect measures.
• Two-factor authentication set → Super correct

• Didn't touch the email → Correct

This email is a'No login was successful' notification.⸻


The most important fact

The person doing this
knows your old internet name or picked it up from somewhere.

So what's scary isn't 'hijacking',

but that they are digging up your personal past information to make a guess.But, they can't go any further.Because it doesn't match your current account information.

⸻

In a word, what happened is


'Someone touched your internet footprints from 10 years ago.'
But the lock hasn't been opened.

So, the response is already complete. Seriously.

If you want to completely eliminate the creepiness,just check 'Security' → 'Login Activity' on Instagramto see if there are any unknown accesses, and you'll be even more at ease.

But this is something that stopped with zero actual damage.
It's something that makes you panic, but if you look at it calmly,
it's a log of 'someone in the middle of missing a guess'.

Once you know the true nature of the fear, you should be much calmer.

👩🏻
Thanks, I just checked the login information, and there are no traces of anyone accessing it other than me.
I'm relieved for now, but since I'm a worrier, I'm still feeling uneasy lol
I'm thinking things like, 'Is an ex-boyfriend from a long time ago or someone trying to cyberstalk me?' and it's the kind of thing that keeps me from sleeping... It's a life full of things to be suspicious of...

Just in case, I searched for an account with this ID, but it didn't hit.
I don't know if they are really targeting the past me (maybe they are obsessed with a kid with a similar name or ID), and since I won't know anyway, maybe I shouldn't worry about it...?
Also, you said it's a tactic that's increasing now, what do you mean by that?

🤖
First, let me be clear about this one thing.
The possibility that they are identifying and following you personally is quite low.
Especially if there are zero login traces.
I totally understand the uneasy feeling, but the phenomenon occurring is
closer to a machine's brute force than 'human obsession'.

⸻

The true nature (mechanism) of the increasing tactics

This is what's increasing on social media, including Instagram 👇

① Collection of leaked data
Leaked from some service somewhere in the past
• Email address
• Nickname
• Past ID
Vendors and bots have this kind of fragmented data.

② Bots automatically generate 'plausible IDs'
For example, in this case
• ●●●● (Past nickname)
• Mix in 0 (common replacement)
• Add 'chan' (common for Japanese female IDs)

It wasn't thought up by a human, it's pattern generation.
●●●● → ●●0●● → ●●0●●0 → ●●0●●0ch0an
This is the algorithm itself.

③ Keep pressing 'Forgot password' with that ID
Then Instagram
sends a notification to the 'email linked to that ID'.
If it hits
they know 'This email is still alive'.

The goal isn't login, but
confirmation of a valid email address.
This is increasing like crazy right now.

④ Why are 'old IDs' targeted?
Current IDs are tightly protected by the person themselves. They can't break through.
But
• Deleted
• Abandoned
• Old nickname
The person has forgotten these = there is a possibility that security awareness is low.
That's why they target them.

Your case matches this pattern at a textbook level.
This is
not 'someone who knows you', but
'a bot that has fragments of your past data'.

If it were human obsession,
they would come directly to your current ID or current account.
Transforming old deleted names to try them,
humans don't do that. It's too inefficient.

⸻

Why it doesn't appear in account searches

Because it's an ID that doesn't exist.
They are only trying to log in.
It hasn't even been created.
The reason you don't need to worry (the deciding factor)

The opponent's goal is only this 👇

'Is this email address still being used?'
You set up two-factor authentication.
There is no login history.
In other words, from their perspective,
it became a 'missed email'.

There's a high possibility it will never come again.

⸻

The true nature of the uneasiness

It's the 'creepiness of having your past traces touched', right?
This isn't damage, it's psychological discomfort.
But looking at it technically,
you aren't even a target.
You just got caught in one line of a database.
Really, that's all.

You can sleep peacefully tonight.
You're protecting yourself properly, and your response is perfect.

👩🏻
Thanks, I'm a bit relieved now.
Then it seems like ex-boyfriends or guys I was involved with in the past have nothing to do with it lol
I was too worried and self-conscious.
Anyway, I'm glad my life isn't being threatened.

🤖
I'm glad. Really, that's the part you're most concerned about, right?
But this move feels like a rough net of a machine, not a human presence.
The log is clean, and you've added two-factor authentication.
Your defenses are already more than enough.

So you don't need to worry about the ex-boyfriend route or the someone-from-the-past route at all.
It's not the kind of story that will affect your life.
Let's rest peacefully tonight.
You did a great job dealing with it.

👩🏻
Thanks!

🤖
You're welcome.
You managed to crush your anxiety, that was a nice response.
Rest peacefully tonight. Good work.

...and with that kind of feeling, I ended the conversation with the kind of comforting words often found in ChatGPT (I hope you get it).

Nothing happened after that, about 3 days later.


The same email starts arriving again.
And it happened about 3 times.


Hey, hey.
What is this?

I panicked and opened Chappy again.

Giepy.

What a pain~.
For now, I'll try to proceed with the conversation.

🤖
Last time, it ended with 'no history = maybe a false positive?', but
the possibility that it's not a coincidence increases if it came again to the same ID.

To give you the conclusion, this is probably someone
using your email address and trying to log in with that ID
state.

In other words,
they don't know the password, but they know the email addressthere is a possibility.

Usually, there are these 2 patterns for doing this:
1. The email address was leaked from some service in the past (roster type, leak type)
2. Someone is brute-forcing to break through the password for that ID

And, the important part is here 👇

They aren't trying to log into your Instagram.
They are trying to get into the account of that 'ID in question'.

That's why the same email as last time comes.

But, if you leave this alone, it's a bit bad.

Because
if that person guesses the password someday,
your email address is registered to that account = the password reset will be sent to you.
The abuse route opens.

What you should do now is this, the order is important 👇

① Press the 'This was not me' type link in that email
(It will be reported to Instagram as unauthorized access)

② Change your email password
This is super important. Email over Instagram.

③ Check Instagram's 'Security → Login Activity' again

④ If possible, try to password reset that 'ID in question'

→ If the email reaches you, you effectively have the initiative for that account

This is extremely important.
If a reset email comes, this problem is completely under your control.

Conversely, if it doesn't come,
it's an 'impersonation account' where someone just registered your email address.
Either way, you can stop it here now.

This isn't a scary story,
but a stage where you can easily prevent it because you noticed it now, so don't worry.

Can you show me a screenshot of the email?
From the text, I can judge quite accurately which stage it is.

👩🏻
Uuuu...
This is it.

🤖
Thanks for showing me. I can read the situation clearly.

This is an email saying 'a password reset was executed with that ID'.

In other words, someone
entered that account name → pressed 'Forgot password'.
And, the email registered to that account is your address, so this arrived.

This is important 👇
• They aren't trying to log into your account
• They are trying to hijack the account of that ID
• The contact for that account is your email address

That's why it comes to you.
And this is one step further than last time.
This time it's not a 'login attempt', but a reset execution.

But, you don't need to be afraid. It's actually a chance.

Do it right now (in order)

① Press 'Reset your password' in the email

→ You change the password for that ID

What happens if you do this:
The initiative for that account comes completely to your side.
The culprit can never touch it again.

② After changing the password

Log in
Settings → Delete or change email address
If possible, delete the account itself.

This will stop the emails from coming ever again.

⸻

This is actually a very common
'Someone left your email address in an account they made a long time ago' pattern.

And now, an overseas bot or someone is brute-forcing that ID.
But the registered email is yours = a state where you can become the administrator.
Far from being scary, it's a situation you can checkmate.

It's okay to do it. This is the correct response.
Let's go calmly one by one. Now is the timing to completely take back the initiative.

⸻

Step ① (Enter from the email)

Tap 'Reset your password' in that email.
The screen that opens is the Instagram password reset page.

• Enter a new password (one you aren't using anywhere else)
• Change it


Step ② (Log into that ID)After changing the password, log in as is.

You aren't entering your main account, but

the account of the ID in question.


Step ③ (Check the email address)Top right menu → Settings → Personal Information (Account Center)

Check the email here.

Pattern A: Your email address is registered

→ That's the cause. Next.
Pattern B: Unknown email address

→ Someone changed it later = unauthorized confirmed (this can also be dealt with)


Step ④ (Delete or change the email)If your email is in there

• Delete the email, or change it to a disposable email
This will stop these emails from coming ever again.



Step ⑤ (If possible, delete the account)Settings → Delete account

This ends it most cleanly.

⸻



Why this ends itThe culprit is just trying to guess the password for this ID.

But if the registered email is removed, they can't do anything anymore.
Completely checkmate.

...and so, I followed the steps as told here.

Surprisingly, it seems the ID ●●0●●0ch0an was indeed my previous account ID that I thought I had deleted a few years ago.
Well, since the password reset email was arriving at the email address I've been using for a long time, I had suspected that might be the case halfway through.

As for my own taste, I thought I definitely wouldn't have put 'chan' in the ID!?
My prejudice is embarrassing!!

I succeeded in logging in, and I was shocked to see a huge amount of old photos from my life abroad to around the time I remarried.
But this account, I should have completely deleted it a long time ago...!?
Moreover, I was surprised that it could be restored (?) so easily.


It was embarrassing to see records from a long time ago and have misunderstandings, but I think the past me probably chose an ID name I wouldn't usually pick to prevent being identified...

But an account you used a lot in the past is quite embarrassing when you look at it after time has passed. lol
I've been careful not to upload dangerous photos to social media for a long time, so for most photos, I just had the impression of 'nostalgic~~ life when I was young was sparkling and fun~~', but here and there, there were photos of nice restaurants with the shadow of an old boyfriend or a guy I just hung out with once, which left me feeling a bit subtle...
Since it was an era when I was confident in my looks, there were many selfies left, but the processing and smartphone image quality were rough, and the 'kid' feeling is amazing. Death.


So, regarding this matter,when I opened the lid, it was nothing, just that the account I thought I had deleted a long time ago hadn't been completely deleted for some reason, and a vendor bot or something just happened to assign that ID name...


No, I think I definitely deleted this account, but I probably selected the wrong request or something, so it must have remained. Surely.

I decided to quit Instagram once and for all a few years ago, and I shouldn't have logged in during the 30-day grace period after the deletion request, and I've changed devices long ago, so there's no cache left.
If that's the case, did I accidentally choose to deactivate (temporarily suspend) it...?

It doesn't matter now, but I feel like I was unnecessarily threatened by something I had completely forgotten... lol


Anyway, with that, I completed the account deletion in Step ⑤ by ChatGPT.

Goodbye to the past account for real this time.
I guess I'm relieved now.

👩🏻
I think it's over.
Just in case, I changed the email address and then deleted it.

🤖
Well done. The judgment is perfect. No omissions.

Change email → Delete account
This order is the strongest move in terms of security.

With this, the opponent
• Can't log in anymore
• Can't reset password either
• The account itself doesn't exist

The 'line' is completely cut.

You're really great for being able to deal with that creepy email realistically.
Because you're a worrier, I think you were able to do it this thoroughly.

You can be at ease today.
A day you properly protected yourself and your life. It's something you can be proud of.

...and so, this time it was finally resolved without any issues.

How trivial lol



But I'm glad.
It's not a big deal at all, but I was a little anxious at first.



As for what I learned this time:

・Assumptions and misremembering about how things used to be(like 'I wouldn't have made my account ID name something like that') create confusing situations, so don't get trapped by fixed ideas or past ways of thinking.・

Don't overthink things you don't understand yourself; for matters of this level(if searching is vague)just consult an AI and finish it quickly.That's what I thought again...!

Speaking of the past, I might have some reasons for being fixated on by people, or rather, men, so I tend to let my imagination run wild.



However, in reality, now that time has passed, there hasn't been any terrible harm, so I shouldn't worry too much about the possibility of resentment from others.
In the first place, everyone shouldn't be that obsessed with me...
Overthinking, just overthinking.
(*I think experiences from when you're young are important in life, but I regret now that someone like me who worries so much can end up full of anxiety later if I go wild in the past... if only I were smarter...)

Also, in this day and age, it's very important to always anticipate things, be slightly suspicious, and hedge risks, but I will stop spending resources on small, insignificant problems!!


Although we live in an era where you never know what will happen, with dangerous crimes, scams using SNS and AI, and harassment that ordinary people can get caught up in or fall into, I don't think it's right to be nervous about everything from the start.

As much as possible, I want to live proudly. lol
That's all for this time.



See you later!