 They capture your password when you log in, and then they log in on your behalf somewhere else. Now, Instagram does have some built-in safeguards. They will say, are you sure you're logging in from some foreign country somewhere halfway across the world? And you say, what? No.