How to secure your Instagram account in 15 minutes: a checklist for creators

Why does account security matter so much for creators?

Because a hacked account can quickly become a suspended account. A New York Times investigation from July 2026 looked into five reported "wrongful bans". According to Meta, two of them were hacked accounts through which attackers had posted prohibited content. In the end, it was the owners who got banned 1.

On top of that, your Instagram is a work tool. Fans, collaborations and often the route to your other platforms depend on it. An attacker can use your account to send scam messages to your followers, delete content or blackmail you with the login.

The good news: most takeovers happen in a few well-known ways. These include phishing, reused passwords, intercepted SMS codes and apps you gave your password to. This checklist helps against all four. How to recognize fake emails in Meta's name is covered in How to spot phishing from "Meta".

Why do you start with your email inbox?

Because your email address is the master key to your account. Every reset link from "Forgot password" lands there. Germany's consumer advice centers (Verbraucherzentrale) explicitly advise that after a hack you first recover and secure your email account, before you deal with other accounts 2.

How to go about it:

• A separate inbox for your creator business. An address you only use for Instagram, OnlyFans and business. It never appears in giveaways or newsletters, so it is harder to guess. That helps your privacy too (more in Can you be anonymous on OnlyFans?).
• A strong, unique password from a password manager.
• Turn on 2FA for your inbox too, ideally with an app or a passkey.
• Check forwarding and filter rules. Attackers like to set up a silent forward so they can read reset emails. The Verbraucherzentrale names this as a typical point to check after a hack 2.

What kind of password do you need?

A long, random password you do not use anywhere else. In early 2026, a large dataset of Instagram profile data surfaced on hacker forums. Estimates of its size range from 6 to 17 million records. Meta said its own systems had not been breached. The Verbraucherzentrale still recommended using a unique password 3.

The reason: reused passwords from other companies' data leaks are one of the easiest ways into an account. A password manager generates and stores a separate password for every service. You then only need to remember one.

Which Instagram two-factor authentication method is the safest?

A passkey or an authenticator app, with SMS only as a fallback. With two-factor authentication (2FA), you need a second proof besides your password when you log in, for example a code that is regenerated every 30 seconds.

Why SMS is weaker: in so-called SIM swapping, criminals get your mobile provider to issue a replacement SIM for your number and then receive your SMS codes. Security vendors therefore recommend app-based methods that are not tied to your phone number 4. Germany's Federal Office for Information Security (BSI) recommends 2FA wherever it is offered. It also advises registering more than one second factor so you are not locked out if you lose a device 5.

A case from this year shows that 2FA works. At the end of May 2026, attackers got Meta's AI support chatbot to add other people's email addresses to Instagram accounts and reset passwords. Meta says it has closed the gap. Several reports found that accounts with 2FA turned on were not taken over 6.

How to set it up: in Instagram, go to Accounts Center, then Password and security, then Two-factor authentication 11. The labels may differ slightly depending on your app version. Choose the authentication app there and scan the code shown with an app of your choice.

What do the Instagram passkey and the new Meta account change?

A passkey replaces your password with an approval on your device, which makes it especially robust against phishing. On 23 April 2026, Meta announced that passkeys now work for Instagram too, not only for Facebook and Messenger 7.

At the same time, the old Accounts Center is becoming the Meta account. There you manage your password, email address and 2FA in one place. The Security Checkup gives you personal recommendations, for example on 2FA and login alerts. Meta is rolling this out gradually, and the switch is expected to take about a year 7. So you may not see the new menus yet.

• Set up a passkey as soon as the app offers it to you.
• Decide deliberately which accounts sit in your Meta account. Do you really want to link your private Facebook account and your creator Instagram? For your privacy, keeping them apart can make sense. Whether linking them raises the risk of being suspended along with another account is not proven.

How should you store your Instagram backup codes?

Offline or encrypted, but not as a photo on your phone. Backup codes are one-time codes that let you log in when your second factor is missing, for example because your phone broke.

• Good: as a note in your password manager, or printed out and kept somewhere safe at home.
• Bad: as a screenshot in your camera roll. It often syncs to the cloud automatically, and anyone who gets into your phone or your cloud account then has the codes too.
• Never share them. No real support agent asks you for a backup code. Anyone who does wants your account (see How to spot phishing from "Meta").

What do you check in your Instagram login activity?

Whether it only lists devices and places you recognize. Instagram shows you where your account is currently logged in.

• Log out unknown devices, then change your password right away.
• Remove old phones and tablets you no longer use.
• Put locations in context: they are often inaccurate, and a neighboring town is usually no cause for alarm. A login from another country you have not been to is.
• Turn on login alerts so you get a notification for every new login.

Which third-party apps should you remove?

Every one you are not actively using, and every one you ever gave your password to. Especially risky are apps that promise to show "who unfollowed you", follower analytics, auto-likers and so-called shadowban checkers. They have no access to Instagram's internal assessment (see Instagram shadowban), but they often ask for your login.

• Check connected apps and websites and remove anything you don't recognize.
• Use official logins only. A reputable tool redirects you to a Meta page to log in and never sees your password.
• Change your password after removing an app if it knew the password.

Meta's rules on account integrity list sharing login credentials as a topic of its own 8.

How does your agency get access without your password?

Through roles and permissions that you grant yourself and can take back at any time. For professional accounts, Meta offers Meta Business Suite for this, where you can give people or a business access with defined permissions.

Why this matters: whoever has your password can lock you out. A BBC investigation into so-called OFM managers describes how creators had handed over control of logins and payouts and were put under pressure with exactly that 9.

• No password for your agency, chatter, photographer or assistant. Not even "just for a moment".
• Roles instead of logins, with as few permissions as necessary.
• Review access regularly and remove former team members right away.
• If you part ways, revoke all roles and change your password to be safe.

How else to recognize a legit agency is covered in How to spot a legit OnlyFans agency.

What else belongs on the list?

Two points many people overlook: your phone number and your photos.

• Protect your phone number: ask your mobile provider whether you can set a customer PIN or password that is checked before any SIM change.
• Your own recognizable photos on your profile: to recover hacked accounts in the EU, Meta uses a video selfie that is matched against the photos on your profile 10. If you never show your face, this route may not be available. It is not an obligation; you should just know about it.
• Set up a data export: download your information regularly, meaning posts, followers and messages.

Checklist: set up once (about 15 minutes)

• [ ] Email inbox secured with its own password and 2FA, forwarding rules checked
• [ ] Instagram password unique and from your password manager
• [ ] 2FA turned on with an authenticator app, SMS only as a backup
• [ ] Passkey set up, if offered
• [ ] Backup codes in your password manager or printed out
• [ ] Login alerts turned on
• [ ] Unknown devices logged out, old devices removed
• [ ] Connected apps cleaned up
• [ ] Agency and team connected through roles instead of your password
• [ ] Asked your mobile provider about protection against SIM swapping

Checklist: every month (5 minutes)

• [ ] Check login activity and devices
• [ ] Check connected apps
• [ ] Check Account Status (warnings, recommendation eligibility)
• [ ] Check roles and access, remove former team members
• [ ] Run the Security Checkup in your Meta account
• [ ] Renew your data export

Frequently asked questions

Our take

Fifteen minutes today can save you weeks if something goes wrong. The most effective steps are unspectacular: a secure inbox, a unique password, 2FA with an app or passkey, well-kept backup codes and no password in someone else's hands.

If you want to build your channels with a team that works without your passwords, our intro call is no-obligation, and afterwards you decide in your own time. maevia works with English-speaking creators who live in Germany, Austria or Switzerland and write native-level English. Apply now.