Seven habits protect social media accounts and privacy: unique strong passwords, multi-factor authentication, privacy setting reviews, limited third-party app access, caution with links and messages, careful posting, and a separate approach for work accounts. They block most takeovers and reduce what a scammer can learn about you.
1. Use a unique, strong password for each account
CISA's Secure Our World guidance on strong passwords recommends long, random and unique passwords, with a password manager to keep track. A reused password lets one breach unlock your social accounts. If you cannot use a manager, a long passphrase of unrelated words is better than a short complex one.
2. Turn on multi-factor authentication
A second factor stops a stolen password from being enough. Prefer an authenticator app or a security key over text message codes where the platform offers them. Never read a code to anyone who contacts you, however official they sound.
3. Review privacy settings now and after updates
Platforms change defaults. Check who can see your posts, your friend list, your location and your profile details, and who can find you by phone number or email. Choose the narrowest option you are comfortable with.
4. Limit third-party app access
Quizzes, games and tools often request access to your account. Open the list of connected apps and remove those you do not use. Each is another party who can read your data or post on your behalf, and a compromised app is a way into your account.
5. Be skeptical of links and messages
Account takeovers often spread through direct messages from a friend's hijacked account: "is this you in this video?" CISA's guidance on phishing advises recognizing the signs, such as urgency and unexpected requests, and reporting them. Check with the friend through another channel before clicking.
6. Think before you post
Posts reveal more than intended: your employer, routine, travel dates, children's school, a photo of a badge or a boarding pass. Scammers use such details to make a pretext believable, and answers to common security questions are often public. Share travel after you return. Review photos for background details.
7. Treat work accounts as part of your security perimeter
A company page is a brand asset and a target. Use a shared password manager, individual named admins with multi-factor authentication, and a written process for removing access when someone leaves. Decide who may post and who approves. Keep personal and work content in separate accounts.
What does an attack look like?
A constructed example: a marketing coordinator gets a direct message from a colleague's account with a link to "vote for our team photo." The link opens a login page that looks like the platform. They enter their password, and their account then messages their own contacts. Multi-factor authentication would have blocked the attacker's login, and a quick text to the colleague would have exposed the lure.
What should you do if an account is taken over?
Use the platform's recovery process first. Change the password, sign out all sessions, check connected apps and forwarding or recovery settings, and warn your contacts through another channel. If it was a work account, tell your security contact and review posts made during the takeover.
How often should you review all this?
Twice a year is enough for most people, plus any time a platform announces a major change or you hear of a breach. Put a reminder in your calendar and run through the seven items in about twenty minutes.
How to check or apply this
- Put every social account into a password manager and replace reused passwords.
- Enable multi-factor authentication, preferring an app or key.
- Walk through privacy settings on each platform.
- Remove connected apps you do not recognize.
- Verify unexpected messages through a second channel.
- Audit your last twenty posts for details a scammer could use.
- Make a one-page admin plan for any organization account.
Quick check
Is a private account enough?
It helps, but followers can still screenshot posts, and a takeover exposes everything. Pair privacy settings with strong sign-in.
Sources
- CISA, Use Strong Passwords
- CISA, Recognize and Report Phishing
- CISA, Avoiding Social Engineering and Phishing Attacks
Last reviewed: 18 October 2026.
