Privacy · Community report
Verify a suspicious DM is a scam
Verify a suspicious DM is a scam. Check a suspicious DM's identity signals before trusting it.
What you can get
Reaches your accounts Creates or changes things in accounts you connect, with your approval.
-
It does
- Looks up and reports on identity signals
- Does not contact, block, or report the sender unless asked
-
It stops and asks
- Before trusting the result: confirm which signals were actually checked (identity, badge age, login location, tracked link).
- Before replying to the sender: don't tip them off that you're investigating.
- Before deleting the message: keep a copy in case you need to report it.
-
You approve
- No authorization implied to respond to or block the sender
Derived from this task's own brief and steps, not from the source.
- Capture the DMStops for your approval
Sender profile, message text, and any link, exactly as received.
- Check the identity
Does the claimed name/outlet actually exist and match?
- Check the account
Badge purchase date and login location versus claimed location.
- Check the linkStops for your approval
Look for tracking or identifying parameters before clicking.
Editorial, not from the source
Works when
- You received an unsolicited DM claiming to be a journalist, company, or official contact.
- The message includes a link, a meeting request, or a request for information.
- You want identity signals checked before you reply or click anything.
Does not work when
- You already know the sender personally and the message isn't suspicious.
- The DM has already caused harm (money sent, credentials given) — that needs a faster, different response than a pre-click check.
- The sender's identity is impossible to check against any public record.
Verify a suspicious DM is a scam: review template
| Signal | What was checked | Result |
|---|---|---|
| [Claimed identity] | [Name/outlet/company] | [Found / not found] |
| [Account signals] | [Badge age, login location] | [Match / mismatch] |
| [Link] | [Tracking parameters] | [Clean / tracks you] |
The source case
On X, @IguanaXYZ relays an account (via @jbahrdestefano, about someone referred to as 'JC') of a DM from a supposed TechCrunch reporter that included a Calendly link. Instinct is credited with finding that no such reporter exists, that the account's verification badge was purchased that same month, that an account claiming to be US-based was logging in from France, and that JC's email address was embedded in the link as a tracker. This is a relayed, third-hand report rather than a first-hand account of running the check, and nothing here has been run by this directory.
A public report by someone outside this library. Not independently reproduced here.
From the source
Source excerpt
A fake TechCrunch reporter DMed JC, then sent a Calendly link. ... Instinct found no such reporter, a blue check bought this month, a "US-based" account logging in from France, and JC's email baked into the link as a tracker.
Quoted from the original posts. Not written by this guide, and not a result produced here.
Suggested prompt
Bring The DM content, The sender's profile/handle, Any included link. Acts Looks up and reports on identity signals. Does not contact, block, or report the sender unless asked. Source community report, checked 2026-10-09.
Written by this guide as a starting point, not quoted from the source. Your edits stay in this browser.
Other ways to ask
Editorial rewrites of the brief above, for a different emphasis. Copy them separately.
What you need
Editorial, not from the source
You supply
- The DM content
- The sender's profile/handle
- Any included link
Connected
- Whatever lets it inspect the sender's profile and the link; no account login is needed for this check itself
How to try it
Editorial, not from the source
- Share the DM, the sender's profile, and any link exactly as received.
- Ask it to check whether the claimed identity (reporter, company, person) actually exists and matches.
- Ask it to check account signals: how recently any paid verification badge was purchased, and whether the account's stated location matches where it's logging in from.
- Have it check whether a link carries identifying information back to you before you click it.
Separate the claim from the account
A DM that claims to be from a named outlet or company is a claim about identity, and it can be checked separately from the message itself. The report behind this page describes Instinct checking whether a supposed TechCrunch reporter actually exists under that name — and finding no such person. That's the first and most direct check: does the claimed identity show up anywhere independent of the message that's asking you to trust it? A scammer invents a title and an outlet precisely because most recipients won't take the time to check, so the value here is doing a check that's simple in principle but easy to skip when a message feels urgent or flattering.
Read what the account itself gives away
Beyond the claimed identity, an account carries signals about itself: when any paid verification badge was purchased, and where it's actually logging in from versus where it claims to be based. The source describes a badge bought that same month and a supposedly US-based account logging in from France — neither proves fraud by itself, but together with a nonexistent reporter they build a pattern. These signals aren't always available, and a patient scammer can age an account or route around location checks over time, so treat them as supporting evidence rather than a final verdict. The more signals point the same direction, the more confidently you can act on the result.
Treat a link as evidence, not just a next step
A link inside a DM can be checked before it's clicked, not just after something goes wrong. The report describes finding that the recipient's own email address had been baked into the Calendly link as a tracker — a way to identify the specific person who clicks, independent of anything they type in. That's a concrete, checkable fact about the link itself, distinct from guessing whether the destination 'looks legit.' Ask for the link to be inspected for tracking or identifying parameters before deciding it's safe, and treat a link that carries your own information back to the sender as a red flag on its own, regardless of what the rest of the message claims.
Open Instinct to try it. That is the product's own site; this guide is not part of it.
Limits and confirmation points
- This is one relayed report (via @jbahrdestefano, about 'JC'); it isn't a first-hand account of running the check.
- Account-location and badge-purchase-date signals aren't always available or reliable, and some can be altered by a determined scammer over time.
- Checking identity signals reduces risk; it doesn't prove a DM is safe, and no outcome (was the sender reported, blocked) is given here.
Editorial, not from the source
- Before trusting the result: confirm which signals were actually checked (identity, badge age, login location, tracked link).
- Before replying to the sender: don't tip them off that you're investigating.
- Before deleting the message: keep a copy in case you need to report it.
Editorial, not from the source
- The identity can't be confirmed either way
- Treat it as unverified, not cleared; don't click links or share information until you can confirm through a separate channel.
- Account-location data isn't available
- Fall back to other signals — badge age, writing style, requests for payment or information — rather than treating the check as complete.
- The link has already been clicked
- Stop entering information, and check what the tracker could have revealed; that's a more urgent problem than a pre-click check.
Common questions
How do I know if a DM sender's claimed identity is real?
Ask for the claimed name, title, and outlet or company to be checked against an independent, findable source — not just whether the message sounds plausible.
What does a recently purchased verification badge tell me?
On its own, not much — but combined with other mismatches, like a nonexistent claimed identity, it adds to a pattern worth treating with suspicion.
Why does the account's login location matter?
A claimed location that doesn't match where the account is actually logging in from is a specific, checkable mismatch, as in the case where a 'US-based' account was logging in from France.
How can a link track me without me clicking anything inside it?
A link can have your email or another identifier baked into its parameters, so simply opening it can confirm to the sender which specific person received the message.
What if the check comes back inconclusive?
Treat an inconclusive result as unverified, not cleared. Don't click links or share information until you can confirm the sender through a separate channel.
Next in Privacy
Get recurring task recommendations — ask your own agent to check for relevant updates.