We hacked an Instagram

The 5,000-peso SIM they bought for Tencargo carries a ghost: registering Instagram, the number reports “esta cuenta ya está registrada” ▸ 0:54, a password-reset code arrives at the very number now in his hand, and he’s inside a stranger’s account, a 60-year-old man posting motivational quotes ▸ 3:00. No hack, “así de fácil” ▸ 1:53, and the same number lets WhatsApp populate with the man’s contacts too.

The teardown is the mechanism: phone numbers get recycled when abandoned ▸ 4:30, so a number tied to an account survives its owner’s departure, and “la seguridad de Instagram es cero” ▸ 5:01. His diagnosis is a design tradeoff, not a bug: Meta offers simplicity, anyone registers in seconds with a number, “a cambio de seguridad” ▸ 6:00. And it reframes a familiar message, the “me hackearon, no soy yo, no manden plata” chain letters, as usually not a hack at all ▸ 5:54, just this same recycled-number takeover.

un número reciclado es una llave que sobrevive a su dueño →

What makes it an ethics beat as well as a security one: he could have changed the password and “despojado al hombre de su cuenta” ▸ 9:08, could have jumped to the linked Facebook ▸ 3:45, and instead tried to unlink the number to lock himself out, only to be stopped by a password prompt he refused to bypass out of decency ▸ 8:42. The golden rule the diary extracts is procedural and urgent: whenever you change or abandon a number, especially leaving the country, unlink it from every account first ▸ 12:35, a note that matters doubly for a couple planning a move to Asia…