How to keep your social media accounts safe

In Uganda, social media is more than entertainment. WhatsApp is how families coordinate, how SACCO members share updates and how shops take orders. Facebook pages and Instagram profiles bring in customers, and TikTok builds brands. That is exactly why criminals want your accounts. Once they get in, they message your contacts asking for "urgent" Mobile Money, sell fake products in your name, or lock you out of a business page you spent years building. This guide explains how to keep your social media accounts safe, platform by platform, and what to do if the worst happens.

How social media accounts get hacked

Understanding the tricks makes them easier to spot.

• Code theft: someone sends a message saying "I sent you a code by mistake, please forward it." That code is actually the key to register your WhatsApp or reset your password.
• Phishing links: fake pages that look like Facebook or Instagram login screens, often promising verification badges, prizes or copyright warnings.
• Reused passwords: if your password leaked from another website, attackers try it on your social accounts.
• SIM swap: criminals trick or bribe their way into getting a replacement SIM for your number, then receive your verification codes.
• Unlocked phones: a borrowed or stolen phone gives direct access to open apps.
• Fake "support" accounts: people posing as Meta or TikTok staff who ask for your login details to "fix" a problem.

Universal rules for every account

1. Never share verification codes with anyone, even a friend or relative. No genuine company will ask for them.
2. Turn on two factor authentication (also called 2FA or two step verification) everywhere you can.
3. Use a different password for each platform.
4. Keep your email account secure, because it is the master key for resetting other accounts.
5. Update your apps and phone software regularly.
6. Lock your phone with a PIN, pattern or fingerprint.

WhatsApp: the most targeted app in Uganda

WhatsApp hijacking is extremely common because one hijacked account gives access to dozens of trusting contacts.

Turn on two step verification

1. Open WhatsApp and go to Settings.
2. Tap Account, then Two step verification.
3. Create a six digit PIN that is not your Mobile Money PIN or birthday.
4. Add an email address so you can reset the PIN if you forget it.

Even if someone gets your SMS code, they will need this PIN to register your number on their phone.

More WhatsApp protections

• Check Linked Devices in settings and log out of any computer you do not recognise.
• Set privacy so only your contacts can see your profile photo and add you to groups.
• Consider adding a passkey if your app offers it.
• Be very wary of any message, even from a known contact, asking for money urgently. Call the person on a normal phone call first.

Facebook

• Go to Settings and privacy, then the Accounts Centre, and open Password and security.
• Turn on two factor authentication, preferably with an authenticator app such as Google Authenticator or Microsoft Authenticator rather than SMS alone.
• Check "Where you are logged in" and remove unknown devices.
• Turn on alerts for unrecognised logins.
• Review apps and websites connected to your Facebook account and remove old ones.

Protecting a Facebook business page

• Give staff only the level of access they need, and remove people who leave the business.
• Make sure at least two trusted people have full control, each with 2FA, so one hacked account does not lose the page.
• Ignore messages claiming your page will be deleted unless you "appeal" through a link. Check notices only inside the official app or Meta Business Suite.

Instagram

• Turn on two factor authentication in the Accounts Centre security settings.
• Save your backup codes somewhere safe, such as written in a notebook kept at home.
• Check login activity and log out of unfamiliar sessions.
• Do not trust direct messages offering blue ticks, followers or collaborations that require logging in through a link.

TikTok, X and others

The same principles apply. In each app's security settings, turn on 2FA, review logged in devices, link a secure email and use a strong unique password. Be especially careful with third party apps promising free followers, likes or views. They often harvest login details.

Protect your phone number against SIM swap

• Make sure your SIM is registered in your own name with correct details.
• If your phone suddenly loses network for no clear reason, contact your network provider quickly, as it could be a SIM swap.
• Where possible, use an authenticator app for 2FA instead of SMS codes.
• Do not publish your main phone number widely on public profiles if you can use a separate business line.

Signs your account may be compromised

• Friends say they received strange messages from you.
• You are logged out unexpectedly.
• Your password, email or phone number has been changed.
• Posts, stories or adverts appear that you did not create.
• You receive emails about logins or security changes you did not make.

What to do if you are hacked

1. Act fast. Try to log in and change your password immediately if you still have access.
2. Use the official recovery tools. Facebook and Instagram have recovery pages for hacked accounts. For WhatsApp, reinstall the app and verify your number; this logs the attacker out, although they may have set a two step PIN that causes a waiting period.
3. Warn your contacts through another channel, such as SMS or a post from a family member, so nobody sends money.
4. Secure your email and change passwords on any account that shared the same password.
5. Report fraud. If money was stolen, report to the police and your Mobile Money provider with transaction details.

Frequently asked questions

Is SMS two factor authentication enough?

It is much better than nothing. An authenticator app is stronger because it does not depend on your SIM card, which protects you against SIM swap attacks.

Can I recover a hacked WhatsApp without the old phone?

Yes, if you still have the phone number. Insert the SIM in any phone, install WhatsApp and verify. If two step verification was set by the attacker, you may need to wait before you can access it.

Should I post my phone number on my business page?

Customers need to reach you, so consider a dedicated business number with WhatsApp Business. Keep your personal number for private use and security codes.

Conclusion

Keeping your social media accounts safe comes down to a few strong habits: never share codes, turn on two factor authentication, use unique passwords, secure your email and phone number, and react quickly to warning signs. Spend fifteen minutes today going through the settings above. It is far easier than recovering a hijacked account later.