Set aside fifteen minutes. Switch on two-factor authentication, ideally with an authenticator app, and store the backup codes somewhere you can reach without your phone. Review active sessions, leave login requests on, and learn where to verify Instagram's real emails. Finish by updating contact details for the long haul and locking down your inbox. Each item shuts a door attackers commonly use.
The eight settings at a glance
Instagram is gradually renaming "Accounts Center" to "Meta Account", so menu labels on your phone may differ slightly. The settings are the same.
| # | Setting | Closes this door |
|---|---|---|
| 1 | Two-factor authentication | A stolen password on its own |
| 2 | Authenticator app as the method | SIM swaps and lost signal |
| 3 | Backup codes stored offline | Being locked out by your own security |
| 4 | Active sessions reviewed | Someone already logged in |
| 5 | Login requests on | Silent sign-ins from new devices |
| 6 | Knowing Instagram's real emails | Phishing |
| 7 | Current email and phone | Losing the means to prove ownership |
| 8 | A secured email account | Password resets by an attacker |
1. Two-factor authentication
Two-factor adds a code to every sign-in from unfamiliar hardware, which makes a leaked password useless on its own. You'll find Two-factor authentication among the password and security settings; pick the account and follow the prompts.
2. The right method
| Method | Notes |
|---|---|
| Authenticator app (Duo Mobile, Google Authenticator and similar) | Instagram's recommendation; works on several devices; can only be set up from the Android or iPhone app |
| Text message | Tied to your phone number |
| Requires SMS codes to be set up first |
An authenticator app keeps working without signal and survives a SIM change, which is why it suits most people best.
3. Backup codes, stored offline
When no code can reach you, a backup code finishes the login. You can only view them while signed in, so get them today from the additional methods inside the two-factor settings (Backup codes). Copy them, screenshot them or write them down, but keep them reachable if your phone is gone, and never share them. Think someone saw them? Get new codes voids the old set.
4. Active sessions
The Where you're logged in screen shows every recent session; end any you can't account for. Older layouts call it Login Activity, where a stranger's login gets This Wasn't Me and a password reset. More: signing out everywhere.
5. Login requests
Once two-factor is on, Instagram can alert you to every sign-in attempt from an unfamiliar device or browser, naming the device and its location so you can let it in or not. Rejecting one triggers a password reset, which locks the other person out. Enable Login requests in the two-factor settings and allow Instagram's push notifications. What to do when one arrives: login alerts.
6. Real Instagram emails
The Recent emails screen keeps two weeks of real Instagram mail, security messages listed apart; anything missing there didn't come from Instagram. Security mail only ever arrives by email, from @mail.instagram.com, @support.instagram.com, @facebookmail.com, @support.facebook.com or @global.metamail.com, and never through Direct. More: fake emails and DMs.
7. Contact details with a future
Your registered email and number are how Instagram recognises you as the owner. Employer addresses and numbers you may drop one day are where people usually come unstuck, so swap them now, while you still have access, for details you'll keep for years. Already lost them? No access to email or phone.
8. The inbox behind it all
An attacker in your inbox can typically reset Instagram at will. Give that inbox a long password of its own and turn on two-factor there too.
Common questions
What's the safest two-factor method for Instagram?
An authenticator app; Instagram recommends that option itself. SMS and WhatsApp are fine as backups but hinge on your number.
Where are my Instagram backup codes?
In the two-factor settings under additional methods, visible only while signed in. A new set generated there cancels the previous one.
How can I verify that an email is from Instagram?
Two checks: it appears in Recent emails (14 days of genuine mail), and its sender domain is on Instagram's official list.
Will Instagram contact me about security by DM?
No. It says it never does, so any such DM is phishing and its links shouldn't be opened.
Already locked out?
Too late for prevention? List what the intruder altered and you'll get a free pointer to the matching official route. Passwords and codes stay with you.
Sources
- Securing your Meta Account with two-factor authentication (Instagram Help Center) help.instagram.com
- How you can use a backup code on Instagram (Instagram Help Center) help.instagram.com
- View your recent Instagram login activity (Instagram Help Center) help.instagram.com
- Turn login requests on or off on Instagram (Instagram Help Center) help.instagram.com
- Review recent emails sent from Instagram (Instagram Help Center) help.instagram.com