Here is how to protect your Instagram account from hackers: turn on two-factor authentication with an authenticator app or a passkey, secure the email address and phone number linked to the account, give your team their own access instead of your password, and treat every urgent “copyright” or “verification” message as suspect.
This guide is for public figures, creators and the people who run their pages, with Nigeria’s SMS-code and SIM-swap realities in mind.
How to protect your Instagram account from hackers: the 10-minute lockdown
Do these in order. Most live in Accounts Center (which Meta is gradually turning into Meta Account), under Password and security.
- Run Security Checkup. It walks you through a strong password, two-factor authentication and your recovery email and phone number.
- Change your password to a long, unique one and keep it in a password manager, not in a WhatsApp chat.
- Turn on two-factor authentication with an authentication app.
- Check where you are logged in and log out any device you do not recognise.
- Remove linked accounts and third-party apps you no longer use.
- Confirm the email and phone number on the account are ones you control today, not an old assistant’s.
Why public figures are targeted and how takeovers usually happen
A large, trusting following is valuable to a criminal. A hijacked account can post fake investment or giveaway offers, message your contacts for money, or be held for ransom. Takeovers rarely involve clever code. They usually come through one of these doors:
- Phishing: a message that leads to a fake login page.
- Code theft: someone tricks you or a team member into reading out a login or WhatsApp code.
- A reused password leaked from another website.
- A compromised email account used to reset your Instagram password.
- A hijacked phone number that now receives your SMS codes.
- Too many people with the password, including former staff.
Use an authenticator app or passkey instead of SMS codes
Instagram two-factor authentication asks for a second proof when someone logs in from a device it does not recognise. Turn it on in Accounts Center under Password and security, then Two-factor authentication. Instagram lists the authentication app as its recommended method.
Choose an app such as Google Authenticator, Microsoft Authenticator or Duo Mobile over text messages. An SMS code goes to whoever controls your phone number, and numbers can be stolen. An app code is generated on the phone in your hand.
Passkeys go further. A passkey lets you sign in with your phone’s fingerprint, face or screen lock, so there is no password or code for a fake page to capture. In April 2026 Meta announced that passkeys now work on Instagram as well as Facebook and Messenger, as part of a gradual move to Meta Account. If you see the option, set it up.
Save Instagram’s backup codes somewhere offline, and keep the authenticator on a phone the account owner controls, not on a staff member’s personal phone.
Secure the email and phone number behind your account
Your email account is the master key
Whoever controls the email on your Instagram account can usually reset the password. Give that email a unique password, two-step verification with an app or passkey, and a recovery number that is yours. Keep it out of your bio; give the public a separate address for enquiries.
SIM swap risk in Nigeria
A SIM swap happens when a criminal gets your number moved onto a SIM card they hold, by posing as you or with help from someone inside a network. From then on, your SMS codes go to them. Nigeria’s telecom regulator, the NCC, has named illegal SIM swaps among the most serious cyber threats in the telecom sector, largely because of the bank fraud that follows. To reduce the risk:
- Move Instagram, email and banking logins off SMS codes wherever an app or passkey is offered.
- Keep the number on your accounts private and separate from the number your team shares publicly.
- Treat a sudden loss of service on a working line as an emergency: call your network from another phone, then your bank.
- Never read out a code to a caller, even one claiming to be from your network, your bank or Meta.
Give your team access without sharing passwords
When a manager, a content creator and an agency share one password, you cannot tell who logged in, and when someone leaves, the password leaves with them. Meta offers better options.
| Option | Best for | How it works |
|---|---|---|
| Shared access in the Instagram app | A small team | Invite people from your profile menu to post, comment and, on professional accounts, view insights and run ads, without your password. Available to eligible accounts, including through Meta One plans. |
| Meta Business Suite business portfolio | Public figures with staff | Add each person to your portfolio and assign the Instagram account with only the permissions they need. |
| Partner access | Agencies and PR firms | Give the agency’s own portfolio access to your assets, so you can remove the whole agency in one step. |
The account owner stays the admin, every person has their own login with two-factor authentication, and access is reviewed every quarter and on the day someone leaves. Setting this up is part of the digital operations support I offer public figures.
Spot phishing: fake copyright, verification and brand-deal messages
Phishing messages copy Meta’s look and always push you to act fast. Three disguises are common around creators:
- Fake copyright notices: “Your account will be deleted in 24 hours. Appeal here.”
- Fake verification offers: “You qualify for the blue badge. Confirm your details.” Genuine verification is handled inside Instagram or Accounts Center, not through a stranger’s link.
- Fake brand deals: a “brand manager” sends a brief that asks you to log in to view it, or a file to open.
The rule for the whole team: never log in through a link in a DM, email or WhatsApp message. Open the Instagram app yourself and check Account Status there. Never share a login code.
Lock down WhatsApp, Facebook, X and TikTok too
Attackers move from one account to the next, so the way to protect social media accounts for public figures is to secure all of them together.
- WhatsApp two-step verification: go to Settings, Account, Two-step verification and turn it on. You create a six-digit PIN that is asked for when your number is registered on a new phone. Add an email too: WhatsApp’s help centre explains that without one, a forgotten PIN means waiting seven days to reset it.
- Facebook: if it sits in the same Accounts Center, manage its password and two-factor authentication there.
- X and TikTok: both offer two-factor authentication in their security settings. Use an authenticator app where offered and a different password for each.
Instagram hacked? What to do in the first hour
Split the work: one person on recovery, one on communication.
- Check your email for a message from Instagram about a changed email address or password. It may let you reverse the change.
- If you can still log in, change the password; Instagram says this logs out every device signed in. Remove apps and linked accounts you do not recognise and turn on two-factor authentication.
- If you are locked out, go to instagram.com/hacked. You can request a login link or submit a support request, and Instagram may ask you to confirm your identity, for example with a photo of yourself or the email or phone number you signed up with.
- Secure the email account behind Instagram: new password, and check its recovery details and forwarding rules.
- Call your network if your line has lost service.
- Warn your audience from another channel, such as your WhatsApp Status or your other social accounts. Ask people not to send money or click links from your account until you confirm it is back.
- Write down what happened: times, messages and changes. It helps with recovery and any report to your bank or the police.
A clear graphic from the free Announcement Post maker is easy for fans to share. For media enquiries, a short statement drafted with the Press Release tool keeps everyone on the same message.
Impersonation accounts and warning your followers
Fake profiles copy your photo and bio, then message your followers with fake offers or pose as your “manager” asking for booking fees.
Report them from the app: open the fake profile, tap the three dots, choose Report, then Report Account, then “It’s pretending to be someone else”. Instagram’s help centre says it only acts on impersonation reports from the person being impersonated or their representative, so ask fans to send you the fakes and report them yourself.
Then make the real account easy to recognise:
- State your official handle and booking contact in your bio. The free Social Bio Writer helps you fit that into a short, clear bio.
- Pin a post saying you will never ask followers for money.
- Use the same handle across platforms so fakes stand out.
Monthly security checklist for your team
- Run Security Checkup and check where the account is logged in.
- Review who has access in Business Suite and Shared access.
- Confirm the recovery email and phone number still work.
- Search for fake accounts using your name and report them.
- Remind everyone: no shared passwords, no codes read out, no logging in from links.
Creators face the same risks; see how I help personal brands build a safe online presence.
Frequently asked questions
Is SMS two-factor authentication good enough for Instagram?
It is much better than nothing, but an SMS code goes to whoever controls your phone number, so a SIM swap can defeat it. An authentication app or a passkey is stronger because the code or key stays on your own device.
What should I do first if my Instagram account is hacked?
Check your email for a message from Instagram about a changed email address or password and use it to reverse the change. If you are locked out, go to instagram.com/hacked and follow the steps, then secure your email account and warn followers elsewhere.
Why should I add an email address to WhatsApp two-step verification?
The email lets you reset your PIN quickly if you forget it. Without one, WhatsApp says you must wait seven days from your last connection before you can reset it, and it cannot speed that up.
How can my social media manager post without my Instagram password?
Use Shared access in the Instagram app if your account is eligible, or add the manager to your Meta Business Suite business portfolio with only the permissions they need. Each person keeps their own login, and you can remove them at any time.
