At HelloTech, we’ve seen a rise in hacked Facebook and Instagram accounts. It’s a reminder to check your security while you still have access, rather than waiting until something goes wrong.
For many of us, these accounts hold years of family photos, conversations and connections. For a business, they can also be an important way for customers to get in touch. Losing access can be stressful, and getting an account back is not always straightforward.
A little preparation now can make a real difference. Start with two-factor authentication, current recovery details and a backup of the things you cannot replace. And if you’ve heard about facial verification, it helps to understand what it can actually do.
1. Turn on two-factor authentication
Two-factor authentication, often called 2FA, adds another check when you sign in. A stolen password alone is less useful to an attacker when a second check is required.
Open Facebook or Instagram yourself, go into settings and look for Accounts Centre or Meta Account, then the password and security options. Find Two-factor authentication and follow the prompts for the account you want to protect. Check that protection covers both Facebook and Instagram.
Menu names can vary. Meta is gradually replacing Accounts Centre with Meta Account, so your screens may look different from someone else’s. Meta’s account update explains this rollout.
Where supported, consider a security key or an authenticator app rather than relying on text messages. The Australian Cyber Security Centre recommends moving from less effective methods such as SMS to stronger options when available. SMS is still preferable to leaving 2FA off. ACSC’s advanced security guide
Microsoft Authenticator is one option for supported non-Microsoft accounts. Follow the setup instructions in the social account, add it to the authenticator and enter the generated code to finish. Simply installing the app does not turn on 2FA. Microsoft’s setup guide
Save any recovery codes securely, somewhere you can access if your phone is lost. Never share a login code, recovery code or authenticator setup QR code with someone claiming to be support.
2. Understand facial verification and passkeys
There are two different features people often confuse.
Video-selfie verification helps with account recovery. Meta may offer a video selfie during a recovery process to help confirm your identity. Its published description explains that facial recognition can compare the selfie with profile pictures on the account.
Do not rely on being able to enrol in this beforehand. Meta’s published guidance describes it as a recovery option, rather than a universal “turn on facial verification” setting. Availability depends on the recovery options offered to your account, and a selfie is not a guarantee that access will be restored.
For the process Meta describes, the uploaded video is encrypted and not shown publicly. Meta says the facial data generated for the comparison is deleted immediately afterwards. That statement concerns the generated facial data, not necessarily the uploaded video itself. Read the privacy information in the actual verification flow before proceeding. Meta’s explanation of video-selfie recovery
Passkeys are a proactive sign-in option. A passkey can let you sign in using your device’s face recognition, fingerprint or PIN. Meta says the biometric information used to unlock a Facebook passkey stays on your device and is not shared with Meta. This is different from uploading a recovery selfie. Meta’s passkey explanation
Meta announced that passkeys would extend to Instagram through its new Meta Account rollout, alongside Facebook and Messenger. If the option appears in your security settings on a supported device, follow the official setup prompts. Keep recovery options current as well. Meta Account security features
3. Check your email address and mobile number
Could you receive a recovery message today?
Check that your account’s contact details belong to you, are current and are accessible. An old work email address or a mobile number you no longer use can complicate recovery. Verify a replacement contact method before removing your old one.
Protect the linked email account with a strong, unique password and multi-factor authentication too. Someone who gains access to your email may be able to interfere with your social account recovery. ACSC’s social media security guide
4. Review logins, passwords and connected apps
Use Security Checkup and review the devices signed into your accounts. Investigate sessions you do not recognise and use the official security flow to secure the account if something looks wrong. Turn on login alerts where available. Meta’s account security guidance
Use unique passwords and a reputable password manager. Review apps and websites with access to your social accounts, and remove access you no longer need. Keep your phone, computer and apps updated. ACSC’s social media security tips
Be cautious with messages saying your Page will be deleted, your account has violated copyright, or you must urgently verify your details. Open the app directly to check, rather than signing in through an unexpected link. Even a message from a friend could come from a compromised account.
5. Back up the memories you want to keep
Social media should not be the only place your favourite photos and videos live.
Use Meta’s information download or export tools to request a copy of your account information. Review the categories and date range, then check that the downloaded files include what you wanted. Keep important originals in a separate backup too. Meta’s information-access tools
An export helps preserve available information. It does not prevent a hack or recreate your account, followers and conversations on demand.
What if your account has already been hacked?
Start with the official Facebook hacked-account page or Instagram hacked-account page. Secure your email account as well, and follow the recovery instructions shown to you.
Be wary of people offering guaranteed recovery for a fee or asking for your password or codes. Recovery decisions remain with the platform. Meta’s account recovery guidance
For wider device and email checks, see HelloTech’s hacked-account and scam response guide.
A quick security checklist
- Turn on 2FA and save recovery codes securely.
- Set up a passkey if your account and device support it.
- Confirm your email address and mobile number are current.
- Secure the email account connected to your social profiles.
- Review signed-in devices, login alerts and connected apps.
- Back up important photos, videos and account information.
It is much easier to make these changes while you can still log in. Don’t wait until years of memories or an important business account are at risk.
Need a hand checking your settings? Contact HelloTech to discuss your account security.
