ACCOUNT PROTECTION PLAYBOOK

Securing Social Media Accounts

Learn how to lock down your accounts using 2FA, Passkeys, active session checks, and privacy barriers across your phone, tablet, and computer.

The 4 Shields of Social Media Defence

Securing an account is like locking your front door. If you only have a password, you have left the spare key under the doormat. Here are the 4 tools you will turn on for every app below:

1. Two-Factor Authentication Requires a code from an Authenticator App (Google or Microsoft Authenticator) every time a new device attempts sign-in.
+
2. Passkeys Unlocks your account with your phone fingerprint, Face ID, or PIN. Impossible to steal via fake phishing links.
+
3. Active Sessions Check Shows every phone, tablet, and PC signed into your profile. Lets you tap "Log Out" on unknown intruders.
+
4. Privacy Barriers Hides your private photos, phone number, location, and friend list from strangers and automated web bots.

Choose an app to configure

1. Instagram 2. WhatsApp 3. Facebook 4. X (Twitter) 5. TikTok 6. LinkedIn 7. Snapchat 8. YouTube

1. Securing Instagram

Instagram is targeted via password resets and impersonation scams. Meta manages security through its combined Accounts Centre.

STEP-BY-STEP PLATFORM ACTIONS

Lock Down Two-Factor, Passkeys & Privacy

Profile → ☰ Menu → Accounts Centre → Password and security → Two-factor authentication & Passkeys

📱 On Android & Samsung

  1. Enable App 2FA: Open Instagram, tap your profile icon (bottom right), tap the ☰ Menu (top right), then tap Accounts Centre > Password and security > Two-factor authentication. Select your account and choose Authentication app (e.g. Google Authenticator). Follow the screen prompt to bind the key.
  2. Add a Passkey: In that exact same Password and security menu, tap Passkeys. Tap Create passkey and touch your phone's fingerprint sensor or enter your screen lock PIN.
  3. Review Where You're Logged In: Tap Where you're logged in. Review the list of active devices. If you see an unrecognised device, tap it and select Log Out immediately.
  4. Lock Down Privacy: Return to Settings and activity > Account privacy and switch Private Account to ON so unknown users cannot see your posts.

🍏 On Apple iPhone & iPad

  1. Turn on 2FA & Passkeys: Open Instagram > Profile icon > ☰ Menu > Accounts Centre > Password and security. Tap Two-factor authentication, select Authentication App, and verify. Next, tap Passkeys and approve using Face ID or Touch ID to save it to your iCloud Keychain.
  2. Check Connected Sessions: Under Password and security > Where you're logged in, tap your account to audit active iPhones, iPads, and PCs. Remove any session you do not recognise.
  3. Direct Message Controls: Go to Settings and activity > Messages and story replies > Message controls. Under "Others on Instagram", select Don't receive requests to stop strange message requests from reaching your inbox.

💻 On Windows PC & Mac (Web Browser)

  1. Open your web browser, go to instagram.com, and sign in.
  2. Click More (☰) at the bottom left, then click Settings > Accounts Centre > Password and security.
  3. Click Two-factor authentication to add an authenticator app code. You can also generate and copy a set of Backup Codes to save in a secure place.
  4. Review Where you're logged in to ensure no obsolete desktop browser cookies remain active.
✓ Verified: Your Instagram is shielded with non-SMS two-factor and biometric passkeys.

2. Securing WhatsApp

WhatsApp attaches to your phone number. Hijackers attempt to call you, steal your SMS registration code, and lock you out. Activating WhatsApp Passkeys and Two-Step Verification stops this cold.

STEP-BY-STEP PLATFORM ACTIONS

Activate Two-Step PIN, Passkeys & Chat Privacy

WhatsApp → Settings → Account → Two-step verification & Passkeys

📱 On Android & Samsung

  1. Set a Two-Step PIN: Open WhatsApp, tap the three vertical dots (⋮) at top right > Settings > Account > Two-step verification. Tap Turn on and create a memorable 6-digit PIN. Add your primary recovery email.
  2. Turn on Passkeys: Tap Settings > Account > Passkeys. Tap Create a passkey and approve with your fingerprint or device screen lock. This allows you to verify your identity if you reinstall without SMS.
  3. Audit Linked Devices: Tap ⋮ > Linked devices. Review all active web and computer sessions. If there is a device you do not recognise, tap it and select Log Out immediately.
  4. Enable App Lock: Go to Settings > Privacy > App lock (or Fingerprint lock) and toggle it ON so the app cannot be opened without your fingerprint if you lend your phone to someone.

🍏 On Apple iPhone & iPad

  1. Turn on Two-Step Verification: Open WhatsApp > tap the Settings gear (⚙) bottom right > Account > Two-Step Verification. Tap Turn On, enter your 6-digit security PIN, and set an email.
  2. Configure Passkey: Tap Account > Passkeys. Tap Create Passkey and save it using Face ID or Touch ID into your Apple iCloud Keychain.
  3. Audit Linked Devices: Tap Settings > Linked Devices. Review active sessions (such as Mac or PC browsers). Tap any old browser and hit Log Out.
  4. Turn on Screen Lock: In Settings > Privacy > Screen Lock, turn Require Face ID to Immediately.

💻 On Windows PC & Mac (Desktop App / WhatsApp Web)

  1. WhatsApp Desktop cannot be set up on its own: it requires pairing with your physical mobile phone via a camera scan.
  2. Lock the Desktop Screen: In the WhatsApp Windows/Mac app, open Settings > Privacy > App Lock. Set a desktop password so nobody walking past your computer can read your messages.
  3. Always log out of WhatsApp Web when using public, school, or shared work workstations.
✓ Verified: Your WhatsApp phone number cannot be hijacked via SMS swap or voicemail hacking.

3. Securing Facebook

Facebook profiles contain years of private photos, friends lists, and app connections. Here is how to configure Meta security controls properly.

STEP-BY-STEP PLATFORM ACTIONS

Turn on Security Keys, App 2FA & Session Cleanup

Menu → Settings & Privacy → Accounts Centre → Password and security

📱 On Android & Samsung

  1. Open the Facebook app, tap your Profile/Menu (☰), scroll down, and tap Settings & privacy > Settings.
  2. Tap Accounts Centre > Password and security > Two-factor authentication. Select your Facebook profile and choose Authentication app. Complete verification in your authenticator app.
  3. Under Password and security, tap Passkeys to add biometric sign-in to your device.
  4. Tap Where you're logged in, inspect the list of active sessions, and tap Select all > Log out if you see anything unexpected.
  5. Under Settings > Audience and visibility, check Profile and tagging and set "Review posts you're tagged in before the post appears on your profile" to ON.

🍏 On Apple iPhone & iPad

  1. Tap Menu (☰) > Settings & privacy > Settings > Accounts Centre > Password and security.
  2. Configure Two-factor authentication with an Authenticator app (avoid relying on SMS).
  3. Set up Passkeys using Face ID or Touch ID to prevent password-stealing malware from logging into your account.
  4. Check Where you're logged in to terminate old iPad or Safari sessions.
  5. Turn on Login alerts under Security checks so Facebook notifies you by email whenever an unfamiliar device logs in.

💻 On Windows PC & Mac (Web Browser)

  1. Open facebook.com and click your round profile picture in the top right corner.
  2. Click Settings & privacy > Settings > Accounts Centre > Password and security.
  3. Set up Two-factor authentication and generate Recovery codes. Save these recovery codes inside your password vault.
  4. Click Apps and websites in the main settings bar to audit third-party games and quizzes that have access to your Facebook profile. Click Remove on anything you no longer use.
✓ Verified: Your Facebook account is secured against credential stuffing and session theft.

4. Securing X (formerly Twitter)

X is widely targeted by automated botnets and phishing links. Free tier accounts must use an Authenticator App or Passkeys for Two-Factor Authentication, which is significantly more secure than SMS.

STEP-BY-STEP PLATFORM ACTIONS

Configure Authenticator 2FA, Passkeys & DM Safety

Profile → Settings and privacy → Security and account access → Security → Two-factor authentication

📱 On Android & Samsung

  1. Open X, tap your profile avatar (top left), scroll down to Settings and Support > Settings and privacy.
  2. Tap Security and account access > Security > Two-factor authentication.
  3. Turn ON Authentication app. Scan or copy the key into Google/Microsoft Authenticator, type the generated 6-digit token, and save your one-time Backup Code.
  4. Tap Passkey and follow the prompt to register your phone's biometric screen lock.
  5. Tap Security > Additional password protection and turn it ON to prevent unauthorized password resets.

🍏 On Apple iPhone & iPad

  1. Tap your profile avatar > Settings and privacy > Security and account access > Security.
  2. Tap Two-factor authentication and toggle Authentication app ON. Verify with your code generator.
  3. Toggle Passkey to ON and tap Add Passkey using Apple Face ID or Touch ID.
  4. Back out to Privacy and safety > Direct Messages. Switch "Allow message requests from everyone" OFF to prevent spam and phishing links from arriving in your DMs.

💻 On Windows PC & Mac (Web Browser)

  1. Sign in at x.com. On the left side navigation, click More > Settings and privacy.
  2. Navigate to Security and account access > Apps and sessions > Sessions. Click Log out of all other sessions to kick out old browser windows.
  3. Under Security and account access > Security, configure a physical FIDO2 Security Key (like a YubiKey) if you require high-assurance hardware protection.
✓ Verified: Your X profile is guarded by hardware-grade 2FA and passkey barriers.

5. Securing TikTok

TikTok accounts can be lost to credential takeovers. Setting up 2-Step Verification and biometric passkeys keeps your videos and profile safe.

STEP-BY-STEP PLATFORM ACTIONS

Turn on 2-Step Verification, Passkeys & Device Auditing

Profile → ☰ Menu → Settings and privacy → Security & permissions (or Account)

📱 On Android & Samsung

  1. Open TikTok, tap Profile (bottom right), tap the ☰ Menu (top right), and choose Settings and privacy.
  2. Tap Security & permissions > 2-step verification. Select at least two methods: choose Authenticator and Email (do not rely on SMS alone). Tap Turn on and confirm.
  3. Tap Account > Passkey. Tap Set up to link your phone's Google Password Manager. Now you can log in with a single touch of your fingerprint sensor.
  4. Under Security & permissions > Manage devices, inspect all phones and tablets. Tap the trash can icon on any device that is not yours.
  5. Under Privacy, toggle Private account ON if you only want approved friends to see your posts.

🍏 On Apple iPhone & iPad

  1. Open TikTok > Profile > ☰ Menu > Settings and privacy.
  2. Tap Security & permissions > 2-step verification. Enable Authenticator app and save your generated secret token.
  3. Tap Account > Passkey. Tap Set up and authorise with Apple Face ID or Touch ID. The passkey is saved safely to your iCloud Keychain.
  4. Under Security & permissions > Security alerts, verify that no unusual login alerts have been flagged.

💻 On Windows PC & Mac (Web Browser)

  1. Visit tiktok.com in your browser and sign in.
  2. Hover over your profile picture at the top right and click Settings.
  3. Under Account > Login & Security, check that your linked email address and mobile number are verified and current.
  4. Audit connected third-party apps under Manage app permissions and disconnect old video tools or web games.
✓ Verified: TikTok is protected against unapproved sign-ins and session cloning.

6. Securing LinkedIn

Criminals frequently target LinkedIn to commit business impersonation and employment scams. Protecting your profile with passkeys and app 2FA safeguards your professional identity.

STEP-BY-STEP PLATFORM ACTIONS

Configure Passkeys, Two-Step Verification & Session Management

Profile → Settings & Privacy → Sign in & security → Two-step verification & Passkeys

📱 On Android & Samsung

  1. Open the LinkedIn app, tap your profile picture (top left), and tap Settings > Sign in & security.
  2. Tap Two-step verification. Select Authenticator App (Recommended) and verify it with your authenticator token.
  3. Tap Passkeys. Tap Add a passkey and approve with your phone's biometric fingerprint or screen lock.
  4. Tap Where you're signed in. Tap End session on any older phone, tablet, or PC location.

🍏 On Apple iPhone & iPad

  1. Tap your profile avatar > Settings > Sign in & security.
  2. Tap Two-step verification, choose Authenticator App, and verify your 6-digit code.
  3. Tap Passkeys and register your iPhone using Face ID.
  4. Under Visibility > Profile discovery using email address, set it to Nobody or 1st-degree connections so scammers cannot scrape your email address.

💻 On Windows PC & Mac (Web Browser)

  1. Sign in at linkedin.com, click the Me icon at top right, and click Settings & Privacy.
  2. Click Sign in & security in the left column.
  3. Click Passkeys and click Create a passkey to bind your Windows Hello PIN/fingerprint or Mac Touch ID directly to LinkedIn.
  4. Click Where you're signed in and terminate any unrecognized desktop or mobile sessions.
✓ Verified: Your LinkedIn account and professional connections are secured.

7. Securing Snapchat

Snapchat is heavily used on mobile phones. Locking down Two-Factor Authentication, Passkeys, and Ghost Mode keeps your account and your real-time physical location private.

STEP-BY-STEP PLATFORM ACTIONS

Turn on 2FA, Passkeys & Ghost Mode

Profile → ⚙ Settings → Two-Factor Authentication & Passkeys

📱 On Android & Samsung

  1. Open Snapchat, tap your Bitmoji avatar (top left), and tap the Settings gear (⚙) at top right.
  2. Tap Two-Factor Authentication. Tap Continue and select Authentication App. Complete setup and save the generated Recovery Code.
  3. Scroll down in Settings and tap Passkeys. Tap Add Passkey and register your biometric fingerprint.
  4. Tap Saved Login Info. Tap on any old devices to remove them.
  5. Scroll down to Privacy Controls > See My Location and enable Ghost Mode so nobody can see your physical location on the Snap Map.

🍏 On Apple iPhone & iPad

  1. Tap your Bitmoji > Settings gear (⚙) > Two-Factor Authentication. Turn on Authenticator App verification.
  2. Tap Passkeys, select Add Passkey, and authenticate using Face ID or Touch ID.
  3. Under Privacy Controls, tap Contact Me and change it from "Everyone" to Friends.
  4. Tap See My Location and switch Ghost Mode to ON.

💻 On Windows PC & Mac (Snapchat for Web)

  1. Visit web.snapchat.com in your browser.
  2. Sign in using your password and Authenticator 2FA code (or confirm on your mobile app).
  3. Click your Bitmoji icon in the web panel > Account Settings.
  4. Always click Log Out when finished on a computer so your private snaps and web chat cannot be accessed by anyone else using that PC.
✓ Verified: Your Snapchat account and GPS location are protected.

8. Securing YouTube (Google Account)

YouTube is powered by your core Google Account. Protecting your YouTube channel requires locking down the master Google Security dashboard using synchronized Passkeys and 2-Step Verification.

STEP-BY-STEP PLATFORM ACTIONS

Configure Google 2-Step, Passkeys & Channel Permissions

myaccount.google.com → Security → 2-Step Verification → Passkeys

📱 On Android & Samsung

  1. Open phone Settings > Google > Manage your Google Account.
  2. Swipe across to the Security tab.
  3. Under How you sign in to Google, tap 2-Step Verification and verify that an Authenticator App or Google Prompt is active.
  4. Tap Passkeys and security keys. Tap Create a passkey and approve with your fingerprint.
  5. Under Your devices, tap Manage all devices. Review all TVs, computers, and phones signed into YouTube. Tap any unknown device and hit Sign out.

🍏 On Apple iPhone & iPad

  1. Open the YouTube app, tap your profile avatar (bottom right), and tap Manage your Google Account.
  2. Tap the Security tab at the top.
  3. Tap Passkeys and security keys > + Create a passkey. Tap Continue to save it to your Apple iCloud Keychain via Face ID or Touch ID.
  4. Tap 2-Step Verification and generate a fresh set of 10 Backup Codes. Print or safely write them down.

💻 On Windows PC & Mac (YouTube Studio & Web)

  1. Open myaccount.google.com/security in Chrome, Edge, or Safari.
  2. Click Passkeys and security keys > Create a passkey. Select Windows Hello or Touch ID to allow passwordless signing in on that computer.
  3. For YouTube Creators: Open studio.youtube.com > Settings > Permissions. Verify that only trusted email addresses hold Manager or Editor access to your YouTube channel.
  4. Click Third-party apps with account access and remove any video plugins or upload tools you no longer trust.
✓ Verified: Your YouTube channel and master Google Account are fully secured.
Crucial Social Media Rule: Social media support teams will NEVER send you a Direct Message (DM) asking for your password, a 6-digit SMS code, or claiming your account will be deleted in 24 hours. Any message like this is a phishing scam.

The Complete Social Media Safety Checklist

  • Turn on Two-Factor Authentication (2FA) using an authenticator app across all 8 platforms.
  • Enable Passkeys on your phone or laptop so you can log in with biometrics instead of passwords.
  • Save your One-Time Recovery Codes inside a secure vault like Bitwarden.
  • Audit Active Sessions monthly and log out of obsolete phones, tablets, or web browsers.
  • Set accounts to Private where appropriate, and keep location sharing (like Snap Map) disabled.
  • Ensure your recovery email and telephone number are always up to date.