Five practical checks for Instagram sign-ins, recovery details, phishing messages, connected apps and account alerts.
This second guide in our five-step account security series focuses on Instagram. No single setting can prevent every account takeover, so check how you sign in, recover access, recognize suspicious messages and manage connected services.
1. Strengthen sign-in
Turn on two-factor authentication (2FA). In Instagram, look for Password and security in Accounts Center, then choose two-factor authentication for the account you want to protect. An authenticator app is a useful option because it does not depend on receiving a text message. Two-factor authentication adds a barrier to new sign-ins, although it cannot undo a session that has already been stolen.
Use a long, unique password. A password manager can create and store one that you do not reuse for email, banking or other social accounts. Keep the recovery codes offered during 2FA setup somewhere secure and separate from the phone you normally use. They are one recovery option if you lose access to your usual method, not a reason to share them with anyone.
2. Protect recovery details and review sign-ins
Secure the email account linked to Instagram with its own unique password and 2FA. Check that the email address and phone number in your account settings still belong to you. If you see a sign-in or device you do not recognize, sign out that session and change your password from a device you trust. Instagram's account recovery guidance also recommends checking connected accounts and access when you suspect a compromise.
3. Check messages before acting
A message about a copyright complaint, verification, account closure or a prize may try to rush you into opening a fake sign-in page. Do not enter your password or a 2FA code through a link in a message, even if it appears to come from a friend. Open Instagram directly and check the notice there.
Instagram says it does not send account warnings through in-app direct messages. Its settings include a record of official emails sent recently; use that record to check a suspicious email instead of trusting the sender name or a link in the message. See Instagram's scam prevention guidance for examples.
4. Remove access you no longer trust
Review the apps and websites connected to your Instagram account. Remove access for services you no longer use or do not recognize, especially services promising to reveal profile visitors or manipulate follower counts. Be careful with any service that asks you to type your Instagram password outside Instagram's own sign-in flow.
5. Turn on alerts and keep a copy of your data
Check the account's security notification settings so that you can notice unfamiliar sign-ins promptly. Periodically download a copy of photos and other account information you would not want to lose. A backup helps preserve your data, but it does not replace sign-in and recovery controls.
If you suspect someone has accessed the account, start from Instagram's official recovery flow, secure the linked email account, review recent sessions and connected apps, and replace credentials from a trusted device. A LeakData match can be one signal to investigate, but it does not by itself establish that your Instagram account was taken over.
