Link in bio scams: Why you should think before you click

“Link in bio.”

You've probably seen or heard these three words thousands of times on Instagram, TikTok and other social platforms. Maybe you've even clicked without thinking about it.

There's nothing unusual about it—most of the time. Influencers use bio links to share products, websites, discount codes and other content with their followers. Businesses use them to send customers to stores, promotions or other official pages.

But that also creates an opportunity for scammers.

Key takeaways

A link in bio isn't automatically dangerous. It's a normal feature used by millions of creators and businesses, but scammers can use it to hide or promote malicious destinations.
Don't trust a link simply because you trust the account sharing it. Scammers can impersonate creators, and legitimate social media accounts can also be compromised.
Giveaways, crypto opportunities and unexpected login requests deserve extra scrutiny. Scammers often use excitement, a sense of urgency and promises of easy money to get people to click.
Never provide passwords or authentication codes after following an unexpected link. If you're asked to log in, open the official app or website yourself instead.
Check before you click. Free tools such as Bitdefender Scamio and Bitdefender Link Checker can help you investigate suspicious messages and URLs.
Creators have another risk to consider. If criminals compromise their social accounts, the trust they've built with followers can be used to spread phishing, fraudulent giveaways and other scams.

What is a link-in-bio scam?

A link-in-bio scam occurs when fraudsters use links promoted on social media profiles to direct people to fraudulent or malicious websites.

Scammers can either create entirely fake accounts impersonating influencers, celebrities, doctors, businesses, or other recognizable people and organizations, or simply

compromise or hijack a legitimate account.

Here are some of the stories these scammers use:

“You've won our giveaway! Claim your prize through the link in bio.”

“I turned $500 into $10,000. Course in bio.”

No matter what they say, their goal is to get the user off the social media platform and onto a website or another communication channel.

Most importantly, a bio link can lead almost anywhere

The destination could be a fake cryptocurrency course, fraudulent investment platform, bogus medical or wellness service, counterfeit online shop, phishing page or malware download.

Scammers may also hide the real destination behind URL shorteners; others use domains deliberately designed to resemble legitimate websites.

The scam doesn't always stay on Instagram or TikTok

Another warning sign is an attempt to move the conversation elsewhere.

A fake influencer, investment adviser or business representative might contact you through social media and encourage you to continue the conversation on WhatsApp, Telegram or another messaging service.

Once the conversation continues privately, the scammer may start asking for increasingly sensitive information. That could include your date of birth, email address, phone number, passwords, payment information or authentication codes.

They may claim you need to pay a fee to receive a prize, purchase access to an exclusive investment opportunity or even pay for a meet-and-greet with a celebrity or influencer.

Be particularly suspicious when someone promising huge or guaranteed investment returns wants to move the conversation away from the original platform.

“But the profile looks real”

That's exactly what scammers count on.

Cloned social media accounts can copy a real person's profile photo, biography, posts and other publicly available information. Usernames can also look deceptively similar to those of legitimate accounts.

There's an even more convincing scenario: the account really does belong to the influencer or content creator you know. In this case, criminals have everything they need to make the scam a success.

Imagine following someone for five years and suddenly seeing:

“I'm giving away 20 iPhones. Link in bio!”

Would you inspect the link as carefully as you would if the same offer came from an account created yesterday? That's why the identity of the person sharing a link should never be your only reason for trusting it.

What are the warning signs of a link-in-bio scam?

Pay attention to both the message encouraging you to click and what happens after you reach the destination.

Be cautious if someone:

Says you've unexpectedly won a giveaway or expensive prize.
Promises huge or guaranteed cryptocurrency or investment returns.
Immediately pushes you to continue the conversation on another messaging platform.
Requests your password, authentication code, date of birth or payment information.
Says you must pay a fee before receiving a prize.
Asks for money to meet a celebrity or influencer.
Sends you to a login page after you follow an unexpected link.
Promotes “see who viewed your profile” tools or other features that aren't officially offered by the platform.
Creates urgency and pressures you to act before you've had time to verify the offer.
Uses a domain that looks similar, but isn't quite the same as, the official website.

How can you check a bio link before trusting it?

Before clicking a link in someone's bio, take a few seconds to check where it leads and why you're being asked to visit it.

Inspect the actual domain. A scammer can create a website that looks almost identical to Instagram, a popular online store or a cryptocurrency platform. The URL is harder to fake. Look for misspellings, extra words, unusual domains or subtle substitutions designed to resemble the real address.

Be cautious with shortened URLs. Services that shorten URLs are legitimate, but they can also hide the final destination. If you can't tell where a shortened link will take you, check it before opening it.

Use Bitdefender Link Checker. Copy and paste a suspicious URL into the free tool to check it for potential phishing, fraud and malware before visiting the page.

Think about why you're being asked to click. Context can reveal as much as the URL itself. Did you even enter the giveaway you're supposedly winning? Does this creator normally promote cryptocurrency? Is an account you've never interacted with suddenly offering you an investment opportunity?

Verify the offer somewhere else. If an influencer announces a giveaway, promotion or new product, check their official website or other established social media channels. Don't use the suspicious link itself to verify whether the offer is legitimate.

Don't trust an unexpected login page. If following a bio link suddenly asks you to sign in to Instagram, Facebook, TikTok, Google, your bank or another important account, don't enter your credentials. Close the page, then open the official app or type the service's known address into your browser.

Ask Bitdefender Scamio when the whole situation seems suspicious. Sometimes the URL is only one part of the scam. You can share a suspicious link, message, screenshot or QR code with Scamio to help determine whether the interaction shows signs of fraud.

What if you already clicked a suspicious link?

Don't panic. Clicking a suspicious link doesn't automatically mean your account or phone has been hacked.

What you should do next depends on what happened after you clicked:

If you simply opened the page and didn't download anything or enter information, close it and avoid interacting with it further.
If you entered a password, change it immediately through the legitimate website or app. If you reused that password elsewhere, change it on those accounts too.
If you provided payment information, contact your bank or card provider and monitor your accounts for unauthorized transactions.
If you downloaded a file or application, scan your device with reputable security software and remove anything suspicious.
If you entered an authentication code or believe someone has accessed your social account, review active sessions, sign out unfamiliar devices, change your password and check whether your recovery email, phone number or other security settings have been altered.

For influencers, your followers' trust can become a weapon

There's another side to link-in-bio scams that deserves attention: the creator whose identity or account is being used to make the scam believable. If an attacker compromises your Instagram, Facebook or YouTube account, that trust you spent years building with your followers can suddenly be turned against thousands or even millions of followers.

The attacker could replace a legitimate bio link with a phishing page, announce a fake giveaway, promote a fraudulent cryptocurrency investment or message followers directly while pretending to be you.

How can creators stay safe?

As a content creator or influencer, you should treat your social media accounts as business assets. Use unique passwords, enable strong authentication, verify partnership requests independently, and be cautious with unexpected files and login pages. Regularly review account sessions, connected apps, and the links displayed across your social profiles.

You should also keep an eye out for changes you didn't make. An unfamiliar upload, changed bio, new link or unexpected message sent from the account could indicate that someone else has access.

Bitdefender Security for Creators is designed specifically for content creators. It includes protection for YouTube, Instagram and Facebook accounts, monitoring them for account takeover attempts, alongside device protection intended to help defend creators against threats such as fake sponsor emails and other attacks targeting their work.

FAQs

Is using a link in bio safe?

If you're a creator, business or active social media user who wants to add a legitimate link to your profile, yes, using a link in bio is safe.

If you're asking whether it's safe to click links in other people's bios, the answer is: it depends on the link. Bio links can lead to legitimate websites, but scammers can also use them for phishing, fake giveaways, fraudulent shops or other scams. Treat an unfamiliar bio link like any other URL and check where it leads before clicking.

How do I know if a link is a scam?

Check the actual domain for misspellings, strange characters or an address that doesn't match the organization it claims to represent. Be especially cautious if the link is connected to an unexpected prize, crypto opportunity, urgent warning or login request. You can check suspicious URLs with Bitdefender Link Checker or ask Bitdefender Scamio to analyze a suspicious link or message.

Can someone hack your phone if you click a link?

Simply clicking a link doesn't automatically mean your phone has been hacked. However, malicious links can lead to phishing websites, malware downloads or other threats. If you entered credentials or payment information, downloaded something, or granted permissions after clicking, take action immediately.

What should I do when it says “link in bio”?

Go to the person's profile and you'll usually find the link in their bio or profile information. Before clicking, consider why you're being sent there and whether you trust the account and destination. Be particularly careful with links promising prizes, investments, giveaways or account verification.