Your account is your business. Lock it down like one.

Set up today

  • Turn on two-factor authentication on every platform and on your email. Use an authenticator app or passkey rather than SMS where you can.
  • Use a password manager and a unique password for each account, especially your email, which is the key to everything.
  • Save your backup or recovery codes somewhere offline.
  • Review who has access: managers, agencies, and old Meta Business or YouTube channel permissions.

Spot fake brand deals. Google's Threat Analysis Group documented attackers emailing creators fake sponsorship offers that impersonated real companies, then asking them to "test" software. That software was malware that stole browser cookies and saved passwords, and could get around 2FA by hijacking logged-in sessions. Hijacked channels were sold or used for crypto scams.

Red flags:

  • the offer asks you to download an app, "contract viewer" or file to "try the product"
  • password-protected ZIPs or unusual file types
  • the sender's domain doesn't match the brand's website
  • pressure to act fast, or a payment that's too good to be true
  • "Meta/Instagram copyright" DMs asking you to log in through a link

Impersonation: report fake accounts using each platform's report tools, and tell your audience you'll never DM asking for money.

If you're hacked

  1. Try to recover the account immediately through the official help page:
    • Instagram: instagram.com/hacked, and the help page below
    • TikTok: the "My account has been hacked" help page
    • YouTube: first recover the linked Google Account, then undo any changes
  2. Change your email password and log out all sessions.
  3. Revoke unknown third-party apps.
  4. Tell brands you're working with, and warn followers from another channel.