WhatsApp and social media accounts are prime targets precisely because they're trusted. A hijacked account can be used to scam your friends and family, since messages appear to come from someone they already trust. Securing these accounts properly takes about fifteen minutes and dramatically lowers your risk.
Securing WhatsApp
Turn on two-step verification
This adds a PIN that's required if someone tries to register your phone number on a new device — the most common way WhatsApp accounts get hijacked. Go to Settings > Account > Two-step verification and set a PIN you don't use anywhere else.
Never share verification codes
A common scam involves someone — often posing as a friend in trouble — asking you to forward a six-digit code "by mistake." That code is actually what lets them take over your own account. WhatsApp will never ask you to share this code with another person.
Review linked devices regularly
Go to Settings > Linked Devices periodically and remove any device you don't recognize or no longer use. This shows every device currently able to read your messages.
Control who sees your profile photo and last seen status
Under Settings > Privacy, you can limit your profile photo, last seen, and status visibility to contacts only — reducing exposure to strangers who might use this information for scams or impersonation.
Securing Facebook, Instagram, and other social accounts
Enable two-factor authentication everywhere
Most platforms now support an authenticator app or SMS code as a second login step. This single setting blocks the vast majority of account takeover attempts, even if your password is ever leaked.
Use a unique password for each platform
Reusing passwords means a breach on one unrelated website can expose your social media account too. A password manager makes using unique passwords realistic without needing to memorize them all.
Review active sessions and connected apps
Most platforms let you see every device currently logged into your account, along with any third-party apps you've granted access to. Periodically log out of unfamiliar sessions and remove app connections you no longer recognize or use.
Be skeptical of urgent messages from "friends"
A hijacked account is often used to message the victim's contacts asking for money or claiming an emergency. If a message feels off — unusual wording, urgent tone, unexpected request — verify through a separate channel (a phone call, for example) before responding.
Lock down who can find and message you
Review your privacy settings for who can send friend requests, message you directly, or find your profile via phone number or email. Tightening these reduces unwanted contact from strangers and bots.
General habits that protect everything at once
- Keep your phone's lock screen secured — most accounts stay logged in on your phone, so a stolen unlocked phone exposes everything
- Log out of accounts on shared or public computers
- Update your recovery email and phone number so you can regain access if something goes wrong
- Be cautious of lookalike login pages reached through links in messages — type the platform's address directly instead
Quick recap
- Turn on WhatsApp two-step verification with a unique PIN
- Never forward a verification code to anyone, for any reason
- Review linked devices and active sessions regularly
- Enable two-factor authentication on every social account
- Use unique passwords, ideally through a password manager
- Remove old, forgotten third-party app connections
- Verify unusual requests from contacts through a separate channel
- Keep recovery email and phone numbers up to date