Most social account takeovers do not involve clever hacking. They come from reused passwords, weak second factors and phishing. A handful of settings prevent the large majority of them. Here is where to spend your five minutes.
Turn on strong two-factor authentication
Two-factor authentication (2FA) means a password alone is not enough to log in. Not all second factors are equal:
- Passkeys and security keys are the strongest widely available option. They are tied to your device and are resistant to phishing because there is no code to trick out of you.
- Authenticator apps (time-based codes) are a strong, free step up and work everywhere.
- SMS codes are better than nothing but the weakest choice, because numbers can be hijacked through SIM-swapping. Use them only where nothing better is offered.
Where a platform supports passkeys or an authenticator app, prefer those over text messages.
Use a password manager and unique passwords
Reuse is the single biggest risk: one leaked site exposes every account that shares the password. A password manager lets every account have a long, unique password you never have to remember. It also helps against phishing, because it will not autofill your credentials on a look-alike domain.
Review active sessions and connected apps
Every major platform has a security page listing the devices and locations currently logged in, plus the third-party apps you have authorized. Check it periodically: log out sessions you do not recognize, and revoke apps you no longer use. A forgotten third-party integration is a common and quiet way in.
Lock down recovery
Attackers often target the recovery path rather than the password. Keep a current recovery email and phone on file, secure the email account itself with its own strong 2FA, and save any backup or recovery codes somewhere safe and offline. If your email is compromised, most of your other accounts are too — protect it first.
Learn the phishing tells
No platform will ask for your password or a 2FA code by direct message or email. Be suspicious of urgent “your account will be deleted” messages, check the real domain before you type anything, and open the app directly rather than following a link. When in doubt, navigate to the site yourself instead of clicking.
The short version
- Strong 2FA — passkey or authenticator app over SMS.
- Unique passwords from a password manager.
- Review sessions and connected apps now and then.
- Keep recovery options current and protect your email first.
- Never hand over a password or code; verify the domain.