Instagram and its top executive, Adam Mosseri, were probably both relieved to learn recently that Mosseri is still alive—both in the real world and the digital one.
As reported by Motherboard, the platform accidentally locked Mosseri’s account in September and reported him as dead, after an online troll managed to trick it into doing so.
Mosseri, who previously worked directly for Facebook overseeing the social media giant’s Newsfeed feature, went to work for Instagram (also owned by Facebook) in 2018 and has served as the head of the company ever since. As such, you would think that Instagram would know whether the Israeli businessman is alive or not but, apparently, it doesn’t have the best track record with that.
An anonymous trickster going by the name “Syenrai” recently managed to get Mosseri’s profile flagged as belonging to someone who had “passed away.” They did this by juking Instagram’s “Memorialization” process—a newish feature used to distinguish the accounts of former users who are no longer living.
Somewhat morbidly, Instagram rushed the feature into production last year amidst a rising Covid-19 death toll. “We’ve been working on these updates for some time, though this is one — among others — that we’ve accelerated in light of COVID-19 to help support our community during a difficult time,” a company spokesperson told Buzzfeed News, last April.
The loved ones of a deceased user can submit an application to memorialize their account. Once an account is memorialized, it becomes locked—meaning nobody can log in to make additional changes to its appearance or settings. Instagram then adds “Remembering” to the front of the deceased user’s name, and will also issue the following notice on the profile: “This account has been memorialized. Memorialized accounts are a place to remember and celebrate someone’s life after they’ve passed away.”
If the friends or family of a user wants to initiate this process, they can fill out a form on Instagram’s website with the deceased’s personal details. For proof of death, the company asks for an uploaded death certificate but will also apparently accept a screenshot or a URL link to an obituary or news article that references the person’s death.
However, Syenrai found a pretty basic hack for this whole process: Engineering a fake online obituary that it could feed into Instagram’s authentication system. Instagram confirmed to Motherboard that the whole incident had occurred but noted that it had “quickly resolved the issue.”
However, the fraudster, speaking with the outlet, claims that the whole process would not have been resolved so quickly had the person in question not been the company’s top executive. “I find it ridiculous how Instagram lets such things even happen on their platform in the first place,” they told Motherboard.
It’s unclear if Instagram has since changed its authentication process to make it more rigorous. We reached out to the company for comment and will update this story when more information becomes available.