How to protect your Instagram account from phishing and scams

Account safety and helping the community keep their accounts secure is important to the team at Instagram. There are a number of tools in place to help people keep their Instagram accounts safe against phishing attacks and suspicious activity – and Instagram is always working to improve and update these security features to ensure a safe and welcoming community.

From Security Checkup to reporting tools, Instagram has rounded up five key steps for everyone to help keep their account secure:

• Security Checkup: a new feature to help people keep their Instagram accounts secure. Security Checkup will guide people, whose accounts may have been hacked, through the steps needed to secure them. This includes checking login activity, reviewing profile information, confirming the accounts that share login information and updating account recovery contact information such as phone number or email.

• Enable two-factor authentication: Instagram recommends setting up two-factor authentication, which is a security feature that helps protect your Instagram account and your password. Having two-factor authentication means you’ll receive a notification or be asked to enter a special login code when someone tries logging into your account from a device we don’t recognize. Head to Security in your Settings and set this up in just a few taps, either using your phone number, or an authenticator app like Duo Mobile or Google Authentication. 

• Enable Login Request: When you set up two-factor authentication on Instagram, you’ll receive an alert whenever someone tries to log in to your account from a non-recognised device or web browser. These alerts will tell you which device tried logging in and where it’s located. You can approve or deny the request immediately from your already logged in devices. You can also view the list of devices that have recently logged into your Instagram account at any time under “Settings,” “Security,” “Login Activity.” If you don’t recognise a recent login, you can log out of that location or device and let Instagram know that the login wasn’t you.

• Update your phone number and email: Make sure that the email and phone numbers associated with your device are up to date. That way if something happens to your account, we can reach you. These steps let you recover your account even if your info has been changed by a hacker. 

• Instagram will never send you a DM: Over the past few months, there has been a rise in malicious accounts DMing people to try and access sensitive information like account passwords. They may tell you that your account is at risk of being banned, that you are violating our policies around intellectual property, or that your photos are being shared elsewhere. These messages are often scams and violate Instagram’s policies. When these kinds of scams are discovered, action is taken against them. Instagram encourages you to report the content and block the account. Remember: Instagram will never send you a DM. If Instagram ever wants to reach you about your account, they will do so via the ‘Emails from Instagram’ tab in your settings, which is the only place you will find direct and authentic communication from us on the app. 

• Report content and accounts you find questionable: While Instagram is always improving its technology to combat new trends and techniques that hackers and spammy accounts may use, you can also report individual pieces of content by tapping the three dots above a post, holding on a message, or by visiting an account and reporting directly from the profile. 

For more information about Instagram’s safety tools, visit the Help Center here.