FBI Issues Warning to All Social Media Users About Their Most Private Photos

As technology grows, the unfortunate truth is that criminals simply become more sophisticated in the ways that they are able to target innocent individuals, which means it's more important than ever to make sure that you keep yourself safe while online.

This week, the FBI issued a significant warning regarding a popular scam in which criminals are using multiple different methods to obtain people's personal non-consensual intimate images and videos and then selling the content online.

"The Federal Bureau of Investigation (FBI) warns the public about sexual exploitation (SE) actors targeting adult and underage victims by illegally accessing their social media and personal accounts to steal and post their explicit content (also known as non-consensual intimate images, or NCII) for sale on criminal marketplaces," the FBI warns . "SE actors are using a variety of social engineering and cyber intrusion tactics to target specific individuals of interest — who may or may not be known to the actor — or general targets of opportunity."

To make matters worse, these images are usually sold alongside identifiable information about the victim so that the images and videos can be tied to a real person.

"Once the sexually explicit images or videos are accessed and stolen, typically unbeknownst to the victim, SE actors are sharing or posting the content within community forums or selling them to illicit marketplaces," the FBI warns. "Personally identifiable information — such as name, date of birth, email, phone number, and social media username — is often posted along with the victim's explicit content, exposing them to continued re-victimization."

How Content is Exposed

The FBI shared three primary methods by which this content is typically accessed and exposed: password and PIN targeting, social media customer service impersonations, and phishing.

In a password and PIN targeting scam, criminals use high volume password and PIN attempts on social media and personal accounts based to try to access those accounts. These crimals often use curated lists of passwords obtained from a variety of sources, such as data leak sites, social media, and open source. The lists include personal information, such as date of birth or name variations, when the victims are known to them.

Impersonation scams, meanwhile, involve criminals sending text messages claiming that a victim's social media account is being disabled or locked unless they respond with a verification code. The scammer then uses this verification code to reset a victim's login information and access their personal account.

A phishing scam involves scammers creating look-alike websites, apps, and email accounts emulating customer support to notify victims of issues with their account or "new logins." The emails then include malicious embedded links to "change [their] password," and once clicked, the criminal is able to gain access to their account.

These are all popular scams that users should be aware of.

Tips from the FBI

The FBI shared a few tips that you can use to keep yourself safe from these sorts of scams while online.

• Avoid storing sensitive images or videos on social media platforms or Internet-accessible sites.

• Use unique, complex passphrases and PINs and use multi-factor authentication methods. Avoid using information that is directly associated with your identity, such as your or a loved one's name, birthday, or other personally related information.

• Be cautious about clicking on embedded links in emails and text messages.

  • Go directly to the website to address account concerns; or

  • Consider viewing emails from a computer to hover over embedded links, verify URLs, and inspect for potential formatting inconsistencies in the email address or URL. Viewing from a mobile device could cause emails to appear legitimate at first glance.

• Use caution if you receive a temporary password, PIN reset, or access code you did not request. Do not share login information with anyone, even if the requestor claims to be associated with a platform or service with which you have an account. Go directly to the service's website or official app to change your password or PIN, if necessary.

It's important to stay vigilant when you or your family are online.

This story was originally published by Men's Journal on Aug 13, 2026, where it first appeared in the News section. Add Men's Journal as a Preferred Source by clicking here.