Short answer: To set up 2FA on Instagram, tap your profile → menu → Accounts Centre → Password and security → Two-factor authentication, select your Instagram account, and choose Authentication app. Scan the QR code, enter the six-digit code, and save your recovery codes. Enabling it on a linked Facebook account does not automatically protect Instagram — you must switch it on separately.
Why Instagram accounts get stolen so often
Instagram is one of the most heavily targeted consumer platforms, for a simple reason: accounts have resale value. Follower counts, handles, and verified badges are traded. Stolen accounts are used to run investment and giveaway scams against followers who trust the name at the top.
The most common attack is not sophisticated. It is a direct message claiming copyright infringement or offering a brand deal, with a link to a fake login page. You enter your password, and if SMS is your second factor, the phishing page asks for the code too and relays it in real time.
This is worth understanding before you set anything up: 2FA raises the bar substantially, but it does not make you immune to a convincing fake login page.
Step 1: Find the setting
- Open Instagram and go to your profile.
- Tap the menu (three lines) → Settings and privacy.
- Scroll to Accounts Centre.
- Tap Password and security → Two-factor authentication.
- Select the Instagram account you want to secure.
Meta moved this into Accounts Centre, which is why older guides point at menus that no longer exist.
Step 2: Choose the authentication app
Instagram offers three options:
- Authentication app — offline codes on your device. Pick this.
- WhatsApp — codes delivered through WhatsApp. Better than SMS, but dependent on another account.
- SMS — the weakest, and vulnerable to SIM swapping.
Tap Authentication app. Instagram may offer to set one up automatically if it detects one installed, or it will show a QR code and a text key.
Step 3: Scan and confirm
- Open your authenticator app and add a new entry.
- Scan the QR code. Setting up on the same phone? Copy the text key and paste it instead.
- Type the six digits back into Instagram.
Never screenshot the QR code. It contains your secret key in plain form, and screenshots sync to cloud photo libraries. Anyone who obtains it can generate your codes forever. If you want redundancy, scan the same code into a second app while it is displayed.
Choosing an app? See our roundup of authenticator apps.
Step 4: Save your recovery codes
Instagram provides a set of one-time recovery codes. Screenshot is the default temptation and the wrong answer — store them offline or in an encrypted password manager instead. Our guide on where to store backup codes safely ranks the methods.
Instagram support is heavily automated and account recovery can take weeks with no guarantee of success. These codes are frequently the only realistic route back in.
Step 5: Lock down the rest
- Login activity — review sessions and log out anything unfamiliar.
- Emails from Instagram — this setting shows every genuine email Instagram sent you in the last 14 days. If a suspicious message is not listed there, it is a phishing attempt. Use this before clicking anything.
- Linked third-party apps — revoke schedulers and analytics tools you no longer use.
- Your email account — secure it first. Whoever controls your email can reset Instagram. See our Google account guide.
Step 6: Remove SMS
Leaving SMS active as a fallback preserves the SIM-swap path around your authenticator. Remove it once your app is confirmed working and your codes are stored. The full reasoning is in our SMS vs authenticator app comparison.
Frequently asked questions
Does Facebook 2FA cover Instagram automatically?
No. Even with accounts linked in Accounts Centre, two-factor authentication must be enabled per account. Many people assume it carried over and discover otherwise too late.
What if I lose my phone?
Use a recovery code, or a device where you are still logged in. Instagram also offers video selfie verification in some cases. See recovering accounts after losing a 2FA phone.
Can I use Google Authenticator for Instagram?
Yes. Instagram uses standard TOTP, so any authenticator app works.
Will 2FA stop my account being hacked?
It stops password-only attacks entirely, which is the vast majority. It does not stop a real-time phishing page that captures your code as you type it. Treat every DM with a login link as hostile.
Why is my code invalid?
Clock drift, almost always. Turn on automatic network time. Other causes are covered in why 2FA codes get rejected.
Can I use 2FA on a business or creator account?
Yes, identically. If you run ads or manage a brand, also review who has access through Meta Business Suite.
The bottom line
Turn on the authenticator app, save the recovery codes somewhere that is not your camera roll, and remove SMS. Then build one habit that matters more than any setting: never log in through a link someone sent you. Open the app directly, every time.