How to lock down your accounts: 2FA, passwords and who has access

Before you start

You'll need your phone, access to your email and about 30 minutes. An order that works: email first, then your paid platform (OnlyFans or Fansly), then social. Have a safe place ready for backup codes, like a password manager; never a loose note on your phone or a photo in your camera roll.

This guide is part of our safety section: why creator accounts get banned.

Turning on two-factor authentication on Instagram

According to Instagram's Help Center (checked November 9, 2026), you do it from Accounts Center:

1. Open Accounts Center from Instagram's settings and go to Password and security.
2. Choose "Two-factor authentication" and the account you want to protect.
3. Pick a method. Instagram offers text message, WhatsApp or an authentication app. Why the app: a text can be intercepted if someone manages to hijack your number; the app lives on your phone.
4. With the app, copy the key or scan the QR code and enter the code it gives you. According to the help page, this option is turned on from the Instagram app for Android or iPhone.
5. Save your backup codes in your password manager.
6. Make sure it works: log out on another device and log back in.

Account-by-account checklist

Passwords: one per account

If you reuse a password, one leak anywhere is all it takes for someone to try it on every account you have. The practical fix is a password manager: it generates long passwords, remembers them for you and warns you if one shows up in a breach. If you'd rather not use one, at least keep separate passwords for your email and your paid platform. Never send a password over chat, not even to someone you trust.

Who gets into your accounts: the monthly check

1. Look at active logins on each platform and log out any you don't recognize.
2. Review connected apps (schedulers, editors, "follower analyzers") and remove the ones you don't use.
3. Write down who has access and how: person, account, type of access and since when.
4. If you work with a team, have them use their own access when the platform allows it, and get who logs in, and why, in writing. Fansly has Management Sessions; how to set this up with an agency is in what access an agency should have.
5. Change the password as soon as someone stops working with you.

Access log · Account: ____ · Who: ____ · Type of access (management session / role / app): ____ · Since: ____ · Last reviewed: ____ · Still needed?: yes / no

Signs someone got in

• "New login" emails you don't recognize.
• Posts, messages or follows you didn't make.
• The email or phone number on the account has changed.
• Your password suddenly stops working.

If it happens on Instagram, use its official hacked-account page. If there's already a penalty involved, follow the 7-day ban recovery plan. And be wary of anyone who messages you offering to get it back: it's one of the most common scams targeting creators.

Mistakes we see most

• Protecting your socials and forgetting your email. With your email, someone can reset everything else.
• Leaving text messages as your only method when the app offers another one.
• Sending your password over chat to a friend or a photographer "so they can post something," with nothing in writing.
• Not saving backup codes, then getting locked out when you switch phones.
• Connecting apps that "analyze your followers": many ask for your password, and you have no idea what they do with it.

Tools that help

• An authenticator app on your phone.
• A password manager, with your backup codes inside.
• Each platform's official help for two-factor authentication.
• The access log above, reviewed once a month.

What we'll never tell you to do: send passwords over chat, hand them to apps when you don't know who runs them, or leave your email unprotected. If a platform offers role-based access or management sessions, that's the way to go. For the privacy side (not being recognized), see privacy tips for new OnlyFans creators.

Frequently asked questions