Social media privacy and account security
Lock down Instagram, Facebook, TikTok, X and others in 15 minutes: privacy settings, login alerts, what not to post, and how to recover a hijacked account.
Two separate goals
Social media safety is really two jobs:
- Account security: stopping someone from taking over your account and using it to scam your friends.
- Privacy: controlling who sees what you share, so it cannot be used against you.
Account security in five steps
- Unique password from your password manager.
- Two-factor authentication with an authenticator app or passkey, not just SMS. See 2FA and passkeys.
- Login alerts turned on, so you are notified of new sign-ins.
- Review active sessions and remove devices you do not recognize.
- Check connected third-party apps ("Apps and websites" settings) and remove quizzes, games and tools you no longer use.
Hijacked accounts are valuable to criminals: they message your followers with fake investment offers, "help me, I'm stuck abroad" requests or fake giveaways, and your friends trust them because they come from you.
Privacy settings to review
| Setting | Why |
|---|---|
| Private account / friends-only posts | Strangers cannot browse your history |
| Who can find you by phone number or email | Stops scammers matching leaked numbers to your profile |
| Location sharing and photo location tags | Stops people learning where you live or when you are away |
| Who can message you | Reduces scam and harassment messages |
| Tagging approval | You decide what appears on your profile |
| Off-platform activity and ad settings | Limits how much data is collected about you |
| Profile details (birthday, hometown, school, employer) | These answer security questions and help impersonators |
Each platform has a privacy checkup tool: Facebook's Privacy Checkup, Instagram's Accounts Center, TikTok's Privacy settings and X's Privacy and safety. Spend five minutes in each.
What not to post
- Holiday photos while you are away. Post them after you return.
- Boarding passes and tickets. Barcodes can contain your booking reference and personal details.
- Your full birthday, address or phone number.
- Photos of keys, ID cards, credit cards or badges. Even partial details help fraudsters.
- Answers to "fun" quiz posts like "your first car + your street name = your band name". These match common security questions.
- Your child's school, uniform or daily routine.
Recognizing scams on social media
- Friends suddenly selling crypto or asking for money: call them to check.
- "Your account will be deleted for copyright violation, appeal here." Platforms do not contact you this way.
- Celebrity giveaways and investment endorsements, increasingly with deepfake videos.
- Marketplace buyers who want to pay outside the platform.
If your account is hacked
- Use the platform's official recovery page (search "hacked account" on the platform's help center, reached by typing the address yourself).
- Once back in, change the password, turn on 2FA, sign out all sessions and remove unknown connected apps, emails and phone numbers.
- Post or message friends that you were hacked so they ignore requests.
- If you used the same password elsewhere, change it there too.
Tip
Save your social media 2FA backup codes in your password manager now. Recovering a hacked account is far easier with them.