My friend had her Instagram account hacked, and the hackers contacted all her followers asking for money. I want to figure out what precautions to take so it doesn't happen to me, especially since I use the same phone for work too.
I agree on two-factor authentication, but it's just the basics. What's missing is protecting the rest: use a strong password that's different from your other accounts (if Gmail has the same password as Instagram and someone cracks Gmail, you're done for), turn on login alerts in settings, and regularly check which apps have access to your account. Most importantly, if you use the same phone for work, install a decent password manager so you're not tempted to use the same combination everywhere for convenience - that's the fastest way to get everything hacked at once.
The first thing is to enable two-factor authentication directly in Instagram's security settings, so even if someone figures out your password they can't get in without the code you receive on your phone. Change your password regularly, use something complicated that you don't use anywhere else (especially for work) and avoid connecting to public wifi networks when you log into Instagram. Another important thing is to check your active sessions in the settings once in a while and remove any you don't recognize, like if you notice a login from a city you haven't been to. Since you use the same phone for work, keep your operating system updated and install decent antivirus software too.
If you use the same phone for work and Instagram, the risk goes up quite a bit because an attack on your phone could compromise both. Beyond two-factor authentication that everyone recommends, check which apps have access to your Instagram account in the settings and revoke the ones you're not using anymore - those are often where the holes are. Change your password from a computer, not your phone, because hackers might've installed something on it. And if you use Gmail for account recovery, make sure that's protected decently too, otherwise Instagram's security doesn't mean much.
One thing nobody's mentioned yet is account recovery: save your recovery email and the phone number linked to Instagram in a safe place like a password manager, because if you get hacked they could change those just to lock you out. Also, regularly check Settings > Login and Security to see which devices have access to your account and remove any you don't recognize; it's something people always forget to do but it's crucial, especially if your phone is also used for work and could be more exposed to risks.
When you use your phone for both work and social media, have you thought about how to separate your access? Because that's the critical point everyone overlooks.
What hasn't been stressed enough is that protecting Instagram when you're sharing the device with sensitive accounts (work, company email, etc.) also means doing regular cleanups. Check which apps and websites have access to your Instagram profile through the "Apps and websites" settings - if a third-party app gets hacked, they have a direct entry point. Delete everything you're no longer using. And if your phone is Android, run a malware scan once in a while - it's not paranoia considering what happened to your friends.
The other important thing is that your recovery account (usually Gmail or another email) needs to be well protected too, because if they hack that, Instagram becomes secondary. Use a recovery email different from the one you visibly link to your social media, and keep it with a complicated password in a password manager. When you log into Instagram from a new device, Instagram asks you to confirm - don't ignore those notifications, always check that it was actually you who logged in. I once knew someone who systematically ignored those alerts thinking they were spam, and sure enough, not long after that they lost access to her account.
What almost nobody mentions is the issue of connected devices and active sessions. On Instagram you can go into security settings and check where you're logged in - if you see weird sessions from cities or countries you don't know, you can disconnect them right away. Since you use the same phone for work, check in every so often to see if there's anything suspicious in there, because attacks often start from a session you never close.
Beyond what others have said about two-factor authentication (which is fundamental, there's no getting around it), the real practical help is limiting what a hacker can do even if they manage to get in. Disable the ability to change your email, phone number, and password without extra verification in the settings. Then - and this is the part people forget - go to Meta's site directly, not from the app, and link it to a secondary email as a recovery contact. Not just the one you normally use, because if they hack your main email you're screwed.
Since you use the same phone for work, also consider not staying logged in to Instagram all the time. Log in, do what you need to, log out. I know it's annoying, but it's extra protection if someone manages to compromise the device. And change your password every couple of months - not because it's magic (people do it for nothing), but because in your specific case where the phone is multi-use it makes sense.
What comes to mind is periodically checking which apps and devices have access to your Instagram account in the "Logins and Security" section - sometimes old phones or apps you're no longer using stay connected and create a security gap. If your work phone ever ends up in the wrong hands or gets infected with malware, at least you know exactly what to disconnect instead of finding out too late. It's worth taking a look there every so often, especially after logging in from a new device.
what nobody tells you is that two-factor authentication solves only half the problem. the other half is that your phone itself could be compromised, and if you use the same device for work, the damage can be much wider than a hacked Instagram account. i've seen it happen to someone i know: he'd downloaded an app from a sketchy source, the malware gave it access to everything, from email to banking. instagram was the minor part of the disaster.
what you really need is to separate security levels in your head. you start with two-factor authentication on instagram, yeah, but then link the account to an email you only use for this (not your work one). use a decent password manager (bitwarden, 1password, whatever you prefer) to generate a long random password you'll never have to remember. the password manager itself needs to be protected with a strong master password and also kept in a safe physical place.
the third level is your phone: don't download apps from random sources, turn on automatic updates, every now and then check the permissions you give to apps (instagram doesn't need access to your medical records, for example). if you really do use the same phone for important work, consider keeping work sensitive data separate, maybe with a second account on the device if your os allows it. finally, save somewhere (written on paper, in a vault) the email and recovery number linked to instagram, so if it gets hacked at least you can take it back without having to explain to meta that you're really you.
What would worry me most in your case is if someone gets access to your main email address, because from there they can reset your Instagram password without even needing your phone. Check if your email has two-factor authentication enabled, and if possible use an app like Google Authenticator or Authy rather than SMS codes (SMS is more vulnerable to attacks). It's a layer of protection that a lot of people skip but it really makes a difference.
I myself got scared of something similar and had to do a kind of security audit, since I use my phone for everything. The point I see least addressed is your Instagram password: it needs to be completely different from your Gmail one, your work email, and any other service. If someone manages to get into Gmail (maybe through your phone), they can control Instagram's password recovery from there and you're screwed. Use a password manager like Bitwarden or 1Password, seriously, because remembering 50 strong passwords just isn't doable.
Then there's the issue of a phone shared between work and personal stuff. The real risk isn't so much Instagram itself, but that malware or a malicious app could read your SMS messages for two-factor authentication codes. If possible, turn on app-based authentication (Google Authenticator or Authy) instead of SMS: the codes stay local in the app and don't go through messages. If you have to use SMS because it's the only option, at least be careful about which apps you give permissions to and only download from the official Play Store or App Store, never APK files from random sites.
One last thing: periodically check which devices have access to your Instagram account (settings > login and security > logins). If you see sessions from devices you don't recognize, log them out right away. And backup your recovery information - I've already seen that mentioned, but seriously save it offline or in a password manager, not as a random screenshot on your phone.
Have you ever checked which apps have access to your Instagram account? This is something nobody mentions but it's really important: go into Instagram settings, look for "Apps and websites" or "Connected applications", and disable access to any app you don't use anymore or don't trust. A malicious or compromised app can steal your credentials without you even noticing, especially if you share your phone with work stuff. Combine that with two-factor authentication and a unique password for Instagram (not the same as Gmail or your other accounts) and you'll significantly reduce the risk.
Log into answer.
