How to secure your Instagram account

Two-factor authentication: Settings and privacy, Accounts Centre, Password and security, Two-factor authentication. Choose the authentication app option rather than SMS, and save the backup codes it offers you.

Login activity: in the same Password and security screen, open Where you're logged in. Anything you do not recognise — an unfamiliar city, a device you have never owned — should be logged out immediately, and that is also your cue to change the password.

Login alerts: turn on alerts about unrecognised logins, so an attempt reaches you while you can still act on it.

Connected apps: Settings, Website permissions, Apps and websites. Remove anything you no longer use. A dormant third-party app with posting access is a way into the account that does not need your password at all.

An attacker who controls your email does not need your Instagram password — they will simply reset it. Whatever address is on the account needs its own strong password and its own 2FA, and it should be an address you can still access. An old college or work email you have lost is a permanent hole in the account, so change it to a current one now.

The most effective attack on creators is a message claiming a copyright violation, an account review, or an offer of verification, with a link to "appeal". The link leads to a convincing login page, and entering your details hands over the account.

Instagram does not contact you about violations by DM. Real notices appear inside the app, and you can confirm any message that claims to be from Instagram in Settings, Security, Emails from Instagram, which lists every genuine security email they have sent you. If it is not in that list, it was not them.

Keep your phone number linked so an extra recovery route exists. Turn off the option to let others share your story or reels if you post anything sensitive. If the account matters commercially, avoid sharing the password with staff — use Instagram's own access tools instead, so removing a person does not mean changing a credential everyone knows.

Go to instagram.com/hacked and follow the official flow, which is built for exactly this. Our guide on a hacked social media account covers the order to work through and how to fill in the identity form so it stands the best chance. Do not use a paid "recovery service" — only Instagram can restore the account.