Turn on two-factor authentication, preferably with an authentication app, and save your backup codes where you can reach them without your phone. Check where you're logged in, keep login requests switched on, and learn how to check which emails really came from Instagram. Finally, make sure the email address and phone number on the account are ones you'll still have in a few years, and protect that email account as well. Each step closes a common way into an account.
Instagram is moving people from "Accounts Center" to "Meta Account" settings, so the exact menu names below may differ slightly on your phone. The settings themselves are the same.
1. Turn on two-factor authentication
Two-factor authentication asks for a code whenever someone tries to log in to your account from a device Instagram doesn't recognise. A stolen password alone is then no longer enough.
To switch it on, open Settings, go to Accounts Center (or Meta Account), then Password and security and Two-factor authentication. Pick the account and follow the on-screen steps.
2. Choose the strongest method
Instagram offers three ways to receive login codes:
- Authentication app, such as Duo Mobile or Google Authenticator. This is the method Instagram recommends, and it can be added on more than one device. Instagram notes that app-based codes can only be switched on from the Instagram app for Android or iPhone.
- Text message to your mobile number.
- WhatsApp, available once text messages are switched on.
An authentication app keeps working if you lose phone signal or change SIM cards, which is why it is the better choice for most people.
3. Save your backup codes
If a code can't reach you, backup codes let you finish logging in. You can only see them while you are logged in, so get them now: Password and security › Two-factor authentication › your account › Additional methods › Backup codes.
Instagram suggests copying them, taking a screenshot or saving them some other way. Whatever you choose, keep them somewhere you can reach if your phone is lost, and never share them with anyone. If you think someone has seen them, choose Get new codes to cancel the old set.
4. Check where you're logged in
Under Password and security, open Where you're logged in to see the devices that recently logged into your account. Log out of anything you don't recognise.
Some accounts still have the older Login Activity screen. There, if a login wasn't you, choose This Wasn't Me and follow the steps to reset your password.
5. Keep login requests on
With two-factor authentication on, Instagram can alert you whenever someone tries to log in from a device or browser it doesn't recognise. The alert shows the device and its location, and you can approve or deny it straight away. If you deny a request, Instagram asks you to reset your password so the person trying to get in can no longer use it.
You'll find the switch under Two-factor authentication › Additional methods › Login requests. Push notifications from Instagram need to be allowed on your phone.
6. Know what real Instagram emails look like
Instagram lists every email it sent you in the last 14 days under Recent emails in your security settings, split into security emails and other emails. If an email isn't on that list, it didn't come from Instagram.
According to Instagram, security messages are only sent to your email address, from addresses ending in:
- @support.facebook.com
- @support.instagram.com
- @facebookmail.com
- @mail.instagram.com
- @global.metamail.com
Instagram also says it never contacts you about your profile's security through Direct Messages. More on spotting fakes: fake Instagram emails and DMs.
7. Keep your email and phone up to date
Instagram uses the email address and phone number on your account to confirm the account is yours. Old work addresses and numbers you might give up are the most common gaps. Replace them now, while you can still log in, with contact details you expect to keep for years. If you've already lost them, see what to do without access to your email or phone.
8. Secure the email account too
Whoever controls your email can usually reset your Instagram password. Give the email account its own long, unique password and turn on two-factor authentication there as well.
Frequently asked questions
Which two-factor method is safest on Instagram?
Instagram recommends an authentication app, such as Duo Mobile or Google Authenticator. Text-message and WhatsApp codes also work, but they depend on your phone number.
Where do I find my Instagram backup codes?
While logged in, go to Settings, Accounts Center (or Meta Account), Password and security, Two-factor authentication, choose your account, then Additional methods and Backup codes. You can also get a new set there, which cancels the old codes.
How can I tell if an email really came from Instagram?
Check the Recent emails list in your security settings, which shows everything Instagram sent you in the last 14 days. Instagram's security emails come from addresses ending in @support.facebook.com, @support.instagram.com, @facebookmail.com, @mail.instagram.com or @global.metamail.com.
Will Instagram message me about my account in DMs?
No. Instagram says it never contacts you about your profile's security through Direct Messages. Treat any such DM as a phishing attempt and don't click its links.
Already locked out?
If someone got in before you could lock the account down, tell us what changed. We'll tell you for free which official route fits your case. We never ask for your password or codes.
Sources
- Securing your Meta Account with two-factor authentication (Instagram Help Center) help.instagram.com
- How you can use a backup code on Instagram (Instagram Help Center) help.instagram.com
- View your recent Instagram login activity (Instagram Help Center) help.instagram.com
- Turn login requests on or off on Instagram (Instagram Help Center) help.instagram.com
- Review recent emails sent from Instagram (Instagram Help Center) help.instagram.com