Instagram and Facebook privacy and security settings

Most hacked social accounts had no second lock and a password used elsewhere. Both are fixed in one screen: Accounts Centre.

Instagram and Facebook share one security hub called Accounts Centre. Menu names change from time to time; use the search box at the top of Settings if a name here has moved.

Open Accounts Centre

• Instagram: your profile › menu (three lines, top right) › Accounts Centre.
• Facebook: menu › Settings & privacy › Settings › Accounts Centre.

1. Two-factor authentication

Accounts Centre › Password and security › Two-factor authentication. Choose the account, then a method: an authentication app (recommended), WhatsApp or SMS. Save the backup codes shown under "Additional methods". Without this, anyone who learns your password owns the account.

2. Password, logins and alerts

Still under Password and security:

• Change password: make it one you use nowhere else. See strong passwords.
• Where you're logged in: review the devices and log out any you do not recognise.
• Login alerts: turn on in-app and email alerts for new logins.
• Recent emails: shows the security emails the company really sent you in the last days. An "Instagram security" email that is not listed here is fake.

3. Check your contact details

Accounts Centre › Personal details › Contact info. The email and phone number here receive password resets. Remove any you do not own, and keep your email account itself well protected.

Instagram

• Private account: Settings › Account privacy › Private account. Only followers you approve see your posts and stories.
• Messages and story replies: limit message requests from people you do not follow, and who can add you to groups.
• Tags and mentions: allow only people you follow, or turn on manual approval of tags.
• Hidden words: hides abusive comments and message requests.
• Activity status: off, if you do not want people to see when you are online.
• Blocked, Restricted, Close friends: use Restrict for someone you cannot block outright.

Facebook

• Privacy Checkup: Settings & privacy › Privacy Checkup walks through who sees your posts, profile details and how people find you.
• Lock profile (available in India): on your profile, tap the three dots and choose Lock profile. People who are not friends see only a small part of the profile and cannot open your full-size photo.
• Friends list: set "Who can see your friends list" to Only me. Blackmailers and impersonators use the list to reach your relatives. See sextortion.
• How people find and contact you: limit friend requests to friends of friends, and look-up by phone number and email to friends or only you.
• Profile and tagging: turn on review of tags before they appear on your profile.
• Off-Facebook activity (Accounts Centre › Your information and permissions): see and disconnect the data other websites and apps share about you.

Scams that arrive through these apps

• "Is this you in the video?" or "vote for my niece" with a link: a fake login page that steals your password. Do not log in through links in messages.
• Copyright or "account will be deleted" notices in direct messages. The companies do not warn by DM.
• A friend asking for money or a code. The friend's account is hacked. Phone them.
• Verified badge or follower offers.
• Fake giveaways and investment success stories, sometimes from a hacked friend's account. See investment scams.

If your account is hacked

1. Look for an email from the company saying your email or password was changed. It contains a link to secure your account or reverse the change; use it if the email is listed under "Recent emails" or comes from the company's real domain.
2. On the login screen choose Forgot password and follow the recovery steps. Instagram's "Get help logging in" and facebook.com/hacked are the official routes; both may ask for a selfie video or identity proof.
3. Once back in: change the password, turn on two-factor authentication, log out other devices, and check the email and phone number on the account.
4. Tell your followers that messages sent from your account in that period were not from you.
5. Do not pay anyone who offers to "recover" the account. That is a second scam.