How to Secure Instagram and Facebook Accounts in India

Instagram and Facebook accounts in India are lost to three things: a phishing message about a "copyright strike" or "verification badge", a password reused from a leaked site, and a SIM swap that captures an SMS code. To secure Instagram account access and Facebook at the same time, you work in one place, Accounts Center, and the whole job takes about fifteen minutes.

The paths below are for the current apps. Instagram → Settings is reached from your profile, through the three-line menu at the top right. Facebook → Settings & privacy → Settings. Both lead to Accounts Center at the top of the settings screen.

Secure Instagram account access from Accounts Center

Instagram → Settings → Accounts Center → Password and security. Four items here do most of the work.

Two-factor authentication

Choose Two-factor authentication, pick the account, and select Authentication app. Scan the QR code with Google Authenticator, Microsoft Authenticator or another app, enter the code, and then save the backup codes somewhere that is not your phone's notes. SMS is offered and is better than nothing, but SIM swap defeats it; the authenticator app does not depend on your number. Repeat for Facebook if it is a separate login.

Where you're logged in

This lists every device and location with an active session. Log out anything you do not recognise, and anything you do recognise but no longer use, such as the old phone or the laptop at your previous job. Check it monthly. A session left open on a shared computer is the most common "hack" that was never a hack.

Login alerts and the security checkup

Turn on login alerts so an unrecognised login triggers an email and an in-app notice. Then run the Security checkup from the same section; it walks through password strength, recovery contacts and the devices list in a few taps. Make sure the email and phone number on the account are current and that the email itself is protected, since password resets go there; the Gmail guide covers that.

Privacy settings that stop photo harvesting

A fake account needs your photos. A morphed image needs your face. The settings below decide how easy both are to obtain.

Instagram. Settings → Who can see your content → Account privacy → Private account. Then Settings → How others can interact with you → Messages and story replies, and set message requests from people you do not follow to not receive, or at least to the requests folder. Under the same section, Hidden Words filters offensive comments and DM requests using Instagram's list plus your own words. Restrict, from any profile's three-dot menu, quietly limits someone without blocking them; useful for a colleague or relative. Tags and mentions can be limited to people you follow.

Facebook. Open your profile, tap the three dots, and choose Lock profile. In India this hides your photos, posts and full-size profile picture from non-friends in one step. Then Settings → Privacy Checkup, and set "Who can see your friends list", "Who can look you up using your phone number" and "Who can look you up using your email" to Friends or Only me. The phone-number lookup is how someone with your number from a leaked database finds your face and your friends.

If someone is already harassing you on either platform, our women's online safety guide covers Hidden Words, Restrict and the legal routes in more depth, and applies to anyone.

The messages that steal accounts

Almost every Instagram takeover in India starts with one of these: a DM or email saying your account violates copyright and will be deleted unless you "appeal" through a link; an offer of a blue verification badge for a fee or a form; a "brand collaboration" that requires logging in to a portal; or a friend's hacked account asking you to vote for them in a contest by entering your login. Each link leads to a page that looks like Instagram and collects your password and two-factor code in real time.

These messages are phishing, which the phishing page covers in general. Report them inside the app as scam or phishing; the report helps the next person.

If the account is already gone

Move quickly, because a hijacker's first act is to change the email and phone number, and the second is to message your followers for money or run a fake trading promotion in your name.

1. Try the reset. On the login screen, tap "Forgot password" and send the link to your email or phone. If it arrives, reset, then go straight to Accounts Center, log out all other sessions and turn on two-factor.
2. Use the hacked-account flow. instagram.com/hacked and facebook.com/hacked walk you through identity confirmation, which may include a video selfie for accounts with your face in photos. If Meta emailed you that your email address was changed, that email contains a "revert this change" link that works for a limited time.
3. Warn followers from another account or by WhatsApp. Tell people the account is compromised and to ignore any requests for money or investment.
4. Report the fraud. If the hijacker took money from your followers, they are victims of cheating by personation; they should call 1930 and file on cybercrime.gov.in. You should file too, as a victim of unauthorised access, so there is a record if the account is used for a larger scam.
5. Report impersonation separately. If the hijacker created a second account copying yours, report it as impersonation from its profile. Impersonation reports are handled differently from spam reports and usually require ID.

Meta's recovery flows are automated and sometimes fail, especially for accounts with changed emails and no two-factor. Our hacked account recovery service handles the escalation, the identity submissions and the police complaint for accounts that the self-service route does not return.

Do the fifteen minutes today

Open Accounts Center, turn on two-factor with an app, log out old sessions, and set the account to private. Then forward this to the friend whose account posted a crypto scheme last month; they are the person most likely to need it. The remaining phone settings are in our personal cyber safety checklist.