Bluesky Scams: Fake Support DMs, Phishing and Impersonation
Most Bluesky scams fall into two groups. The first is DMs from fake "Bluesky Support" or "Safety" accounts about your account, your verification or a moderation problem. The second is links that take you to a fake login page. The rule that stops both: Bluesky never DMs you about your account, and you should only type your Bluesky password into the Bluesky app, bsky.app or bsky.social. Don't wait for a warning from the app: in 30 days, Bluesky's moderation applied its "scam" label zero times.
This isn't an old problem. On October 17, 2026, Bluesky's Safety team said a phishing attack had "compromised more than 4,500 accounts", spread through "posts promoting a fake offer of a government payment." To see what that looks like from the outside, I replayed 30 days of Bluesky's public moderation labels and searched for accounts posing as Bluesky staff. In those 30 days Bluesky's moderation took down 76,772 accounts, used the "scam" label zero times, and restored 3,896 accounts in the three days after the October attack. Those restored accounts were real people's established accounts, not new fakes.
(Disclosure: I make Agent Sky, a Bluesky growth tool. More on it at the end.)
What Are the Most Common Scams on Bluesky?
Six kinds of Bluesky scam messages and posts are worth knowing. Bluesky's Safety team has warned about the first three by name, in threads from March 2025 and November 2025:
| Scam | What it looks like | How to tell |
|---|---|---|
| Fake moderation notice | A DM saying your account broke the rules and will be suspended unless you appeal through a link, an app or a payment | Bluesky "only communicate[s] moderation decisions via email, not via DMs" and "never charge[s] money for moderation decisions" |
| Verification offer | A DM from "Bluesky staff" or a service offering to get you the blue check | Bluesky "will NEVER DM you about account verification". Applying is free, through one official form |
| "Let's talk on Discord" | A stranger says someone is impersonating you, or that there's a problem, and wants to show you on Discord or another app | Bluesky says these scammers are "trying to take you off-app" and that it never discusses moderation "in a separate Discord channel or other apps" |
| Phishing post | A post offering money (a government payment, a giveaway, free crypto) with a link that asks you to log in | A real offer never needs your Bluesky password |
| Impersonator | An account with a famous person's name and photo | The handle is slightly off, the account is new, or the details don't match |
| Hacked friend | A post or DM from someone you know, sharing a link that isn't like them | The October 2026 attack took over real accounts, so it can come from someone you trust |
Some third-party services also ask for your main Bluesky password. A safe one uses Bluesky's own login screen (OAuth) or an app password instead.
Does Bluesky Ever DM You?
No, not about your account. Bluesky's November 2025 security thread is blunt: "We will NEVER DM you about account verification." "DMs about account violations or moderation issues are scams." It also says Bluesky would "NEVER ask for your password, payment, or credit card details regarding moderation decisions." Moderation decisions come by email.
So any DM that claims to be from Bluesky about your account is a scam, whatever the sender's name says.
How Do You Spot a Fake Bluesky Support or Impersonation Account?
Check the checkmark and the end of the handle. Bluesky's own advice: "Our accounts have blue verification checkmarks—if an account looks like Bluesky but lacks the checkmark, it's not official." Every Bluesky staff or company account I found also has a handle ending in bsky.app, bsky.team or bsky.network, for example @support.bsky.team and @safety.bsky.app. A handle on a domain proves the owner controls that domain, so nobody outside Bluesky can get one. You need both checks, because other organizations can verify accounts too. (One small exception: Bluesky's regional moderation accounts, such as moderation-de.bsky.app, have the right domain but no checkmark. They never post, so you won't hear from them.)
To see what the fakes look like, on October 21, 2026 I ran 24 searches such as "bluesky support", "bluesky safety" and "bluesky verification" through Bluesky's public search. That gave 2,561 different accounts. I kept those whose handle or name presents as Bluesky staff, with no "unofficial" note:
| What I found | Count |
|---|---|
| Accounts with staff-style names (blueskysupport, blueskyadmin, blueskystaff, blueskysecurity, blueskyverification.com, or the display name "Bluesky Moderation Service") | 33 |
| With a verification checkmark | 0 |
| Labelled "impersonation" by Bluesky | 1 |
| With no posts at all | 27 |
| Most followers on any of them | 9 |
Most have no posts and no profile, so they don't look like much from the outside. But a DM doesn't need posts behind it. Nine of them, all named "blueskysupport" plus four digits, were created on November 9 and 10, 2025, four days before Bluesky warned about "an increased number of phishing and social engineering attempts targeting Bluesky users." The timing fits, but I can't see what they sent, because DMs aren't public.
Search only shows accounts that still exist, so this is what's left after Bluesky's removals, not everything that was ever made.
Will Bluesky Warn You About a Scam Account?
Usually not. Bluesky's moderation removes scam accounts much more often than it labels them. Bluesky's moderation service publishes every label it applies as a public stream, which anyone can replay. I replayed 30 days of it, September 21 to October 20, 2026:
| Label from Bluesky's moderation | Applied to accounts |
|---|---|
| Takedown (account removed) | 76,772 |
| Spam | 1,511 |
| Impersonation | 9 |
| Scam | 0 |
| Unsafe link | 0 |
The "scam" label exists in Bluesky's list of labels, but it wasn't used once in those 30 days. Impersonation was used nine times. The labels you see on profiles are mostly about adult content and spam. For scams, Bluesky's tool is the takedown: an account it catches disappears without a warning label first. So you can't rely on the app to warn you. If a scam account reaches you before it's removed, it will look normal.
What Was the October 2026 Bluesky Phishing Attack?
Around October 17, 2026, posts offering a fake government payment led people to a phishing page, and more than 4,500 Bluesky accounts were compromised. Bluesky's public moderation stream shows 3,896 accounts restored from October 17 to 19.
A reversed takedown means an account was removed and then restored. In the 26 days up to October 16 there were about 116 a day. Then:
| Day (UTC) | Account takedowns reversed |
|---|---|
| Average, Sep 21 – Oct 16 | 116 |
| October 17 | 591 |
| October 18 | 2,380 |
| October 19 | 925 |
| October 20 | 319 |
That's 3,896 from October 17 to 19, against about 350 in a normal three days. Bluesky said it had "temporarily suspended the compromised accounts", and these numbers fit that. In a random sample of 100 of them, 85 of the 99 I could look up were created in 2023 or 2024. The median account had 2,973 followers and 2,765 posts. For comparison, a sample of 100 accounts restored in the weeks before had a median of 16 followers and 2 posts. One owner in the sample later said Bluesky had locked the account after spotting third-party use.
The point: the accounts in this attack were long-standing accounts with thousands of followers. A link from someone you've followed for two years is a reason to check the link, not to trust it.
What Should You Do If You Clicked a Scam Link?
If you only opened the page, just close it. If you typed your password into it, do these in order. Steps 1 to 4 are from Bluesky's October 2026 notice and its November 2025 security thread:
- Change your password to one you don't use anywhere else.
- Turn on two-factor authentication. Settings > Privacy and Security. Bluesky's 2FA sends a code to your email when you sign in, so turn on 2FA for your email account too.
- Delete app passwords you don't recognize. Settings > Privacy and Security > App passwords.
- Remove connected apps and devices you don't use at bsky.social/account.
- Check your email address in Settings > Account. Bluesky warns that if a scammer changes it, "someone can then request a password reset to that email and take over your account."
- If your account was suspended, email moderation@blueskyweb.xyz. Bluesky says it emailed the owners of the accounts compromised in October.
- Tell your followers if anything was posted or sent from your account.
How Do You Report and Stop Scam DMs on Bluesky?
Report the message, block the sender, and limit who can message you. On mobile, press and hold the message and choose Report. On desktop, hover over it, click the ··· button and choose Report. You can also report the whole chat with Report conversation in the chat menu, or the account with Report account in its profile's ··· menu. Bluesky's Safety team asks people to report scam DMs as spam. Its 2025 transparency report says nearly half (48%) of the DM reports it received were in the "misleading" category, which covers spam and scams.
To stop them reaching you, open Chats, tap the gear icon and choose Chat settings, then set Allow direct messages from to People I follow or No one. People I follow is the default. When I sampled 200 active posters, 18.5% had set it to Everyone, and those are the accounts a stranger can message directly. People I follow only protects you if you're careful about who you follow: if you follow a fake account, it can DM you.
How I measured it, and the limits. The label numbers come from replaying Bluesky's public label stream from its own moderation service (mod.bsky.app), from about September 20 to October 21, 2026. I counted labels whose timestamp fell between September 21 and October 20 (UTC). Only labels on whole accounts are in the tables, and a takedown can also happen without a public label, so these are minimums. "Restored" means a takedown label was removed. In my October sample, 99 of the 100 accounts could be looked up again. I can't tell from the stream why. The October numbers fit Bluesky's notice, but the stream doesn't name the attack. The search numbers come from Bluesky's public search while logged out, which can't return removed accounts. I chose which names "present as Bluesky staff" by hand, and I left out fan accounts and accounts that say they're unofficial. Everything here is public data, and I haven't named any of the people whose accounts were taken over.
Scammers want your password. A growth tool shouldn't need it. I built Agent Sky to grow your audience: it finds active accounts in your niche, follows them at a human pace, well inside Bluesky's limits, and checks for a live follow-back before it unfollows anyone. You sign in with Bluesky's login screen or an app password, never your main password, and by default it skips accounts Bluesky has labelled spam, scam or impersonation. $9 a month, free to start. For more on who can reach your inbox, see are Bluesky DMs private.
Quick FAQ
Does Bluesky ever DM you? Not about your account. Bluesky's Safety team says it will "NEVER DM you about account verification", that "DMs about account violations or moderation issues are scams", and that it only tells you about moderation decisions by email. Bluesky's own accounts have a blue checkmark and a handle ending in bsky.app, bsky.team or bsky.network. Any DM from another "Bluesky Support" or "Bluesky Safety" account is a scam.
Is a Bluesky verification DM a scam? Yes. Bluesky says it will "NEVER DM you about account verification." Verification is free and you apply through Bluesky's official form. Anyone who offers you a blue check by DM, for a fee or in exchange for your login, is a scammer.
What should I do if I clicked a scam link on Bluesky? If you typed your password into the page, change it right away to one you don't use anywhere else, and turn on two-factor authentication in Settings > Privacy and Security. In the same place, delete any app passwords you don't recognize, then remove connected apps you don't use at bsky.social/account. Check that the email on your account is still yours. If Bluesky has already suspended the account, email moderation@blueskyweb.xyz.
How do I report a scam on Bluesky? For a DM on mobile, press and hold the message and choose Report. On desktop, hover over the message, click the ··· button and choose Report. You can also report the whole chat with Report conversation in the chat menu. For an account, open its profile, tap the ··· menu and choose Report account. Then block it.