How to Protect Your Digital Identity and Social Media Accounts

Start with the email account used to reset your other passwords. Give each important account a unique password or supported passkey, enable a strong additional sign-in method and check that its recovery details still belong to you. Then review connected apps, active sessions and what your social profiles reveal.

Correction, November 5, 2026: An earlier version presented unsupported global attack statistics, password-cracking times and recovery averages, along with an attribution that could not be substantiated. Those claims and an infographic repeating them have been withdrawn.

Secure passwords and recovery details

Use a different password for each account so that one stolen password cannot be reused across them. The FTC recommends long, hard-to-guess passwords and explains how a browser or password manager can generate and save them. A randomly generated password or random-word passphrase is more useful than a predictable phrase with a year added.

Protect the password manager and your primary email account carefully. Check the recovery phone number and alternate email, and store backup codes somewhere you can access if your usual device is unavailable. Avoid keeping your only recovery method inside the account it is meant to recover.

Choose an appropriate sign-in method

Multifactor authentication adds another requirement to a password-based login. It reduces particular risks, but it is not a guarantee against account takeover. NIST’s authentication guidelines distinguish phishing-resistant methods from manually entered one-time codes, which an attacker can relay through a fake login page.

Where the service supports it, consider a passkey or FIDO security-key sign-in. If an authenticator app or SMS is the available option, use it while understanding its limits. Never share a code with someone claiming to help you, and do not approve an unexpected sign-in prompt.

Review apps and sessions with access

Use each service’s own security settings to review devices, recent activity and connected apps. Google’s linked-apps documentation explains how to review the access an app has and remove it. Removing a link may stop a feature from working and does not necessarily delete data the other developer already holds.

Before removing a sign-in connection you still use, confirm that you have another way to enter that account. Review access after trying a new integration, replacing a device or receiving an unfamiliar security alert. A calendar reminder can help, but there is no universal fifteen-minute monthly audit that guarantees protection.

Check unexpected messages through a separate route

A familiar logo, urgent message or apparently correct sender name does not establish who sent a request. The FTC’s phishing guidance recommends checking a suspicious request through contact information you know is genuine. Open the service’s app or type its known address instead of following a login link from the message.

Pause when a message asks you to disclose a password or code, install software, approve a login you did not start or move a conversation to an unfamiliar account. If you already entered information on a suspicious page, use the real service’s security and recovery process promptly.

Limit exposure without assuming privacy settings secure an account

Review who can see your posts, contact details and location information. Use separate decisions for audience settings, account sign-in and third-party app permissions: hiding a post from the public does not make a weak password stronger. Avoid publishing identity documents or information you use for account recovery.

Keeping devices and browsers updated is also part of the routine. A VPN does not replace these controls. As the FTC explains, HTTPS protects website traffic in transit, including on public Wi-Fi, while an encrypted scam website can still steal information you submit to it.

If an account has been taken over

Use the provider’s official account-recovery page. If the device may be infected, address that before using it to secure accounts. After access is restored, the FTC’s recovery checklist calls for changing the password, signing out other sessions, enabling available two-factor authentication and checking recovery details.

• Review email forwarding rules and filters you did not create.
• Check sent messages, profile changes and unfamiliar connected apps.
• Warn contacts about messages or payment requests sent by the attacker.
• Change reused passwords on other accounts and keep a record of suspicious changes.

Do not depend on a fixed recovery time or a stranger promising paid recovery. The provider’s process and the details changed by the attacker affect what you can do. For the difference between an account login and a government credential, see how digital identity systems work.

Frequently asked questions