Tracer got distracted at FindASpy headquarters by two insects on the lobby windowsill, locked in a slow, stubborn wrestling match that neither one seemed capable of winning.
He set down his fresh pour-over coffee, watched them shove each other a few more determined inches, and finally welcomed a visitor into the lobby before the tiny standoff claimed the rest of his morning.
She had arrived after a friend’s Facebook account was taken over. The criminal used the account to message everyone in her contact list, pretending to need emergency money.
“I didn’t even know Facebook had security settings,” the client said.
Tracer opened his laptop. “It does. The important ones are just a few menus deeper than most people ever go.”
One of the insects was apparently still refusing to concede on the windowsill as he got started.
He then walked her through Facebook and Instagram, step by step. You can follow along with an old account or a brand-new one.
Facebook and Instagram are both owned by Meta. Between them, your accounts may contain family photos, private messages, your phone number, birthday, workplace, friend network, location details, and clues about your daily routine.
A criminal who takes over your account may:
This is why account security matters before convenience. The goal is not to disappear from social media. The goal is to control who can enter, what they can see, and which apps can use your information.
Scam warning: Never share a one-time login code with another person. A one-time code is a temporary number used to prove that you are signing in. A real company does not call or message you asking for that code. A message saying, “I accidentally reported your account: send me this code,” is a takeover trick.
Open Facebook and tap your profile picture. Choose Settings & privacy, then Settings.
On a computer, click your profile picture in the upper-right corner, then choose Settings & privacy and Settings.
Meta frequently moves controls into Accounts Center. Accounts Center is the shared control panel for connected Facebook and Instagram accounts. When you see an Accounts Center link, open it and continue there.
Look for Security and login. On newer versions, go to Accounts Center, then Password and security.
Start with Change password.
Create a long, unique password. “Unique” means you have never used it on another website. A good password is easier to manage when it is a short sentence with unexpected words, numbers, and punctuation. Do not use your name, birthday, pet, street, or the word “Facebook.”
A password manager can create and remember different passwords for every account. Never send your Facebook password to a friend or store it in a public note.
Next, open Two-factor authentication. Two-factor authentication, often called 2FA, adds a second proof of identity after your password. When available, choose an authentication app instead of text messages. An authentication app generates temporary login codes on your phone. Text messages are useful, but criminals sometimes steal control of a phone number through a SIM-swap attack, which moves a victim’s number to a criminal’s phone.
Now open Where you’re logged in. This list shows phones, tablets, computers, televisions, and other devices connected to the account. Review each entry. Tap the three dots beside any old, shared, lost, or unfamiliar device and choose Log out.
Turn on Alerts about unrecognized logins. These alerts notify you when Facebook sees a login from a device it does not recognize.
If you use Facebook on a shared computer, open Save your login info and turn it off. Otherwise, the next person using that computer may open your account without entering the password.
Return to Settings and look for Your Facebook Information, then Off-Facebook Activity.
Off-Facebook Activity is a record of websites and apps that send Facebook information about visits, clicks, or purchases. Meta uses this information for advertising and account activity.
Choose Clear History. Then select Disconnect Future Activity or turn off the option that allows future off-Facebook activity. The wording may differ slightly by device.
This does not erase every piece of information already posted to Facebook. It limits one important stream of activity data from outside websites and apps.
Open Privacy.
Set Who can see your future posts? to Friends. Then select Limit Past Posts. This changes older public posts to Friends-only.
Set Who can look you up using the email address you provided? and Who can look you up using the phone number you provided? to Only Me or Friends.
Open Profile and tagging. Turn on Review posts you’re tagged in before the post appears on your profile. A tag links your profile to another person’s post. Reviewing tags lets you approve that connection first.
On your profile, review these details:
In Settings, open Apps and websites.
Every quiz, game, contest, personality test, or “see who viewed your profile” tool you approved may have received account permissions. A permission is an authorization allowing an app to access certain information.
Open each app you no longer use and choose Remove. Pay special attention to apps you do not recognize. Turn off the option that allows future activity from connected apps when that control is available.
Open Ad preferences. Some accounts show this under Accounts Center, then Ad preferences or Ad settings.
Turn off options for ads based on data from partners and activity on other websites and apps. These changes reduce how much outside browsing activity is combined with your social profile.
Open Instagram and go to your profile. Tap the three-line menu in the upper-right corner, then choose Settings and privacy.
On a computer, choose More, then Settings.
Scroll to Accounts Center, then choose Password and security.
Change your Instagram password if it is reused anywhere else. Turn on Two-factor authentication. Select your Instagram account and choose an authentication app when that option is available.
Review Where you’re logged in and remove every device you do not recognize.
Turn on Login requests and alerts for unknown logins. A login request asks you to confirm that a new sign-in was yours. Never approve one you did not start.
Open Settings and privacy, then Privacy.
Turn on Private account if you want to approve followers individually. A private account means people must send a follow request before they can see your posts and stories.
Business owners, investigators, creators, and other public-facing users may need a public account. If you keep yours public, avoid publishing your home address, travel dates, children’s school names, or your exact location while you are still there. Consider adding location information after you leave.
Under Messages and story replies, turn off Activity status if you do not want others to see when you are online.
Under Tags and mentions, turn on Manually approve tags. This prevents tagged posts from appearing on your profile without your approval.
Open Comments and choose who may comment. You can filter offensive comments and limit comments to people such as followers you follow.
Open Messages and story replies. Restrict message requests from strangers if you do not need them. Turn off read receipts if you do not want senders to know when you opened a message.
Use Hidden Words to filter common offensive or scam phrases into a hidden folder. Check that folder occasionally because legitimate messages may be filtered there too.
In Accounts Center, review Connected experiences, Linked accounts, or similar options. Remove connections you no longer use.
Also review Apps and websites or Authorized apps and revoke access for old or unfamiliar services.
Instagram offers Advanced Protection for some journalists, public figures, politicians, and other high-risk accounts. It requires stronger login protections. Check Accounts Center, then Password and security, to see whether the option is available to you.
Never click a message claiming your account will be banned unless you independently open the official app and check your notifications there.
If Facebook is taken over, use Facebook’s official recovery page: facebook.com/login/identify.
If Instagram is taken over, use: instagram.com/hacked.
Tell close contacts immediately that the account is compromised. Change passwords anywhere you reused the old password. Review email security too, because access to your email can help a criminal reset other accounts.
Your public profile is only the surface. The real protection is behind Password and security, Where you’re logged in, Apps and websites, privacy controls, and connected-account settings.
Tracer’s rule is simple: if you did not start the login, do not approve it. If you do not recognize the app, remove it. If you would not give the information to a stranger at your front door, do not publish it publicly.
Before your next cup of coffee:
Save this article and walk through the list with a parent, spouse, or friend who may need help.
Which State are you reading from? Which buried Facebook or Instagram setting surprised you most: old logged-in devices, outside app permissions, search-engine access, activity status, or something else?
Have you ever received a message asking for a login code or claiming your account would be banned? Tracer reads all posts, so share what happened without posting private account details.
You can also upload your own hidden gadget or privacy discovery for the FindASpy community by clicking here.
Next time, Tracer examines the quiet information your phone shares in the background: and the simple settings that help reduce it.
These steps reduce account-takeover and privacy risks, but no setting guarantees absolute security. Meta frequently changes its menus, labels, and account features, so the names or locations may differ slightly by device, app version, account type, or region. This article is educational guidance only, not a guarantee or a substitute for individualized legal, technical, or safety advice. If you are in immediate danger, if a crime is in progress, or if your safety is at risk, stop reading and call 911.
If you are dealing with stalking, harassment, threats, impersonation, or an active account takeover, report the conduct through the platform’s official recovery and reporting tools. Contact a licensed professional or appropriate law-enforcement agency when necessary. FindASpy can help with a deeper review of a compromised device or account through its security services.
Sterling Reed, known as “Tracer,” helps individuals, families, and organizations understand practical privacy and security risks without unnecessary fear. His approach starts with awareness, continues with clear instructions, and ends with protection you can use.
Your vote helps determine FindASpy Insider’s Readers’ Top Picks. One rating is allowed per reader for each article.
Today’s Coffee Conversation
Tracer shares cybersecurity stories, scam alerts, privacy tips, and investigative insights. Pull up a chair, share your experience, and help shape tomorrow’s discussion.