Don’t let your social media account be hijacked

Imagine logging into your social media account and discovering that someone else has taken control of it.

They could read your private messages, impersonate you, contact your friends and family, or even use your account to scam people you know.

And this type of crime is increasing rapidly.

Data from Report Fraud shows that the total amount reported stolen through email and social media account hacking reached £6.3m in 2025-26, up from £1.2m in 2024-25.

That’s an increase of more than 400% in just one year.

The true figure is likely to be even higher because not every victim reports what has happened.

Report Fraud is now urging people to take steps to protect their online accounts, including using passkeys wherever they’re available.

A passkey uses your device and, where supported, biometrics such as your fingerprint or face to verify that it’s really you. Unlike a traditional password, a passkey isn’t something that can simply be guessed or stolen.

How can you protect your social media accounts?

There are several simple things you can do to make it much harder for criminals to take over your accounts.

Use a strong, unique password

If you’re still using the same password for several accounts, it’s a good idea to change it.

Try using three random words to create a strong password that you can remember.

And don’t use the same password for every social media account.

If a criminal gets hold of one password, they may try it on your other accounts.

Turn on two-factor authentication

You should turn on two-factor authentication (2FA) or two-step verification wherever it’s available.

This gives you an extra layer of protection because you’ll need to provide another form of verification when someone tries to log in, for example, a code from an authenticator app or, in some cases, a text message.

An authenticator app is generally a better option than SMS where it’s available.

Use passkeys when you can

If the social media service you use offers passkeys, consider setting one up.

A passkey allows your device to authenticate you using things such as your fingerprint, face or device PIN.

It means you don’t have to rely on remembering another password, and passkeys are designed to protect against common forms of password theft and phishing.

Check which devices are logged into your account

You may be surprised by how many devices have access to your social media accounts.

Go into your account’s security settings and look at your active login sessions.

If you see a phone, computer or other device you don’t recognise, log it out immediately and change your password.

It’s also a good idea to regularly review these settings, particularly if you’ve lost a phone or used a public or shared computer.

Think carefully about what you share

The more personal information you put online, the more information a criminal has to work with.

Be careful about sharing details such as:

• your full date of birth
• your home address
• your phone number
• your workplace
• your children’s names or schools
• your holiday plans
• information about family members
• answers to common security questions

Criminals can use seemingly harmless information to make their scams more convincing or to try to impersonate you.

Review your privacy settings

Take a few minutes to check your social media privacy settings.

Where possible, set your accounts to private and decide who can see your posts, photos, personal information and contact details.

Don’t automatically accept friend or follower requests from people you don’t know.

Be very careful about what you download

Be cautious when downloading unauthorised software, game modifications, cracked programs or scripts from websites you don’t trust.

Malware hidden inside these downloads can steal information from your device, including active browser session cookies.

In some cases, this can allow criminals to get around protections such as passwords and two-factor authentication.

If you’re not sure what a download is or where it came from, don’t install it.

Watch out for phishing messages

You may receive an email, text or social media message claiming there’s a problem with your account.

It might tell you that your account will be closed, that you’ve violated the rules, or that you need to click a link to verify yourself.

Don’t panic and don’t click the link.

Instead, open the social media app or website yourself and check your account there.

Remember, a message can look completely genuine and still be a scam.

Be careful with your phone number

Criminals can sometimes use SIM-swap scams to persuade a mobile phone provider to transfer your number to a SIM card they control.

If they succeed, they may receive text messages intended for you, including SMS-based two-factor authentication codes.

If your phone suddenly loses mobile service for no obvious reason, contact your mobile provider immediately.

Where possible, consider using an authenticator app or passkey instead of relying solely on SMS for account security.

Block suspicious accounts

If someone is sending you unwanted messages, following you suspiciously or repeatedly trying to contact you, use the block function.

You don’t have to engage with suspicious accounts.

Blocking and reporting them can help protect you and may also prevent them from targeting other people.

Lock your phone and computer

It sounds simple, but don’t leave your devices unlocked and unattended.

Use a PIN, password, fingerprint or facial recognition to lock your phone and computer.

If you use a shared or public computer, make sure you log out of your accounts when you’ve finished.

Keep your devices and apps updated

Don’t ignore software updates.

Updates often include important security fixes that protect your device against newly discovered vulnerabilities.

Turn on automatic updates where possible so you don’t have to remember to do it yourself.

What should you do if your account has been hacked?

If you think someone has taken control of your account, act quickly.

• Change your password immediately if you can still access the account.
• Log out of unfamiliar devices and sessions.
• Turn on two-factor authentication or set up a passkey.
• Check your email address and phone number in the account settings to make sure they haven’t been changed.
• Check your messages and posts for anything the criminal may have sent or published.
• Warn your friends and family if they may have received messages from your compromised account.
• Report the account takeover to the social media platform.
• If you have lost money or believe you’ve been the victim of a crime, report it to Report Fraud.

Your social media accounts contain a lot of personal information. Take a few minutes to protect them before a criminal gets the chance to take them over.