Buying from a trusted seller? The first few days matter more than the first few minutes. Log in the right way, leave the account as it is for 3 days, then lock it down with the checklist below.
For deals with trusted sellers. These steps are for sellers you trust, like us. Buying from someone you don't know? Never leave a paid account unsecured: use a middleman and work through the checklist below right away.
Day 0: logging in
- Log in with the password. You'll get a 6-digit code. Enter it and you're in.
- Got an 8-digit code (or longer)? Stop. It usually means the password was mistyped, or something else is off. Don't enter it and don't keep retrying: repeated attempts can put the account at risk. Message the seller first.
- Something not right? Message the seller first. Don't try to fix a login problem yourself. A good seller will walk you through the right steps.
Days 1 to 3: leave it as it is
Keep the email, password and phone number exactly as they are for the first 3 days. A burst of security changes right after a login from a new device is one of the things that gets accounts flagged, so waiting lowers the risk of a ban. Use the account normally in the meantime.
The safest option: move the name onto an account you already use
If you can, have the name swapped onto an account you've used for at least 14 days, not a newly created one. An established account is far less likely to be flagged. No account like that? Get Meta Verified for extra protection against bans. See how a guided swap works.
After day 3: the 9-step checklist
Bought from someone you don't know? Do this right away instead.
1. Change the email address
If the account came with an email, change it to one only you control, ideally a new address used for nothing else. If the original email (OGE) was handed over too, change that email account's password and recovery details as well.
2. Change the password
Use a long, unique password you don't use anywhere else. A password manager makes this painless.
3. Turn on two-factor authentication (2FA)
Use an authenticator app or a passkey / security key, not SMS. SMS codes can be stolen through SIM-swap attacks, where someone convinces a phone carrier to move your number to their SIM.
4. Save your backup codes offline
When you turn on 2FA you get backup codes. Write them down or store them in your password manager, not in your camera roll or notes app.
5. Log out of every other session
In your account's security settings, review where you're logged in and log out of every device and location that isn't yours.
6. Remove old phone numbers
Delete any phone number that isn't yours. A leftover number is a recovery route someone else could use.
7. Check connected apps and websites
Remove any third-party app or website that has access to the account and that you didn't add yourself.
8. Secure the email account too
Your username is only as safe as the email behind it. Turn on 2FA for the email account itself and check its recovery options.
9. Watch for "security" messages
After a high-value name moves, scammers often send fake "copyright", "verification" or "your account will be deleted" messages. The platform will never ask for your password or 2FA code in a DM. Don't click, don't reply.
Rule of thumb: nobody legitimate needs your password, your 2FA code or your backup codes. Not support, not a buyer, not a seller.
Extra protection for high-value names
- Use a separate email that never appears anywhere public.
- Use a hardware security key for both the account and the email.
- Get Meta Verified on Instagram for an extra layer of protection.
- Keep the account active. Post or log in regularly so the account isn't treated as abandoned.
Our security guide goes deeper into each of these.
What to do if something looks wrong
In the first 3 days, don't change anything yourself: message your seller first and they'll guide you through it. After that, if you get a login alert you don't recognize, change the password, log out other sessions and check your email settings, then contact the platform through its official help center only. Don't trust links in DMs or unexpected emails.