Short answer
Fifteen minutes now saves weeks later. 1. Secure the email account behind your profiles. 2. Turn on two-factor authentication with an authenticator app — Meta recommends it over SMS — and store the backup codes offline. 3. Set WhatsApp and Telegram two-step verification. 4. Log out of unknown sessions and remove old connected apps. 5. Learn to check which emails are real. 6. Keep recovery phone numbers and emails up to date.
1. The email account first
- A unique, long password you use nowhere else.
- Two-factor authentication on the email itself.
- Check its recovery phone and backup email — attackers change those first.
2. Two-factor authentication, done properly
- Use an authenticator app (such as Google Authenticator or Duo); Meta recommends it, and you can connect up to five devices to one Meta account.
- Download your backup codes and keep them offline; generating new codes cancels the old ones.
- Mark only your own devices as trusted — never a shared or public one.
- On X and Google, prefer an app or security key over SMS alone.
3. Messaging apps
- WhatsApp: turn on two-step verification with a PIN and recovery email; never share the six-digit registration code.
- Telegram: set a two-step password with a recovery email, and check Devices for unknown sessions.
- Ask your mobile operator about SIM-swap protection and set a voicemail PIN.
4. Sessions and connected apps
- Instagram and Facebook: review where you’re logged in in Accounts Center and log out of unknown devices.
- TikTok: Settings and privacy → Security → Manage devices.
- X: apps and sessions — revoke apps you don’t recognise.
- Remove third-party “follower”, “analytics” or automation apps you no longer use.
5. Know what real messages look like
Instagram lists the emails it really sent you under Accounts Center → Password and security → Recent emails, and it never contacts you about account security by DM. No platform asks for your password or codes in a chat. More in fake Meta emails and account recovery scams.
6. Keep recovery details current
An old phone number or a work email you’ll lose is a recovery route someone else may control one day. Update them now. For business accounts, keep two admins with 2FA; if something does go wrong, our hacked account recovery service works the official routes with you.
Frequently asked questions
Is SMS two-factor authentication good enough?
It is much better than nothing, but an authenticator app or security key also protects you against SIM-swap attacks. Meta recommends the app.
Where are my Instagram backup codes?
In Accounts Center → Password and security → Two-factor authentication → your account → Additional methods → Backup codes.
How often should I check my sessions?
Whenever you get a login alert you don’t recognise, and every few months as a habit.
Does a strong password alone protect me?
Not from phishing. A strong password plus app-based 2FA, and never logging in through links in messages, covers most attacks.
Sources: Instagram Help — securing your account with two-factor authentication, Instagram Help — use an authentication app, Instagram Help — backup codes, Instagram Help — recent emails from Instagram, WhatsApp Help Center — compromised account, Telegram — active sessions and two-step verification