Join the club, become a member for free.
Get startedWhen you live abroad, your social accounts are how home sees you. They hold years of photos, your contacts, your messages and sometimes your work. Losing one is not a small thing.
Most accounts are not lost to clever hackers. They are lost to a reused password, a missing second login step or a convincing message. These 24 social media safety settings close those gaps, one platform at a time.
College Life, the global club for young internationals, is working with Bitdefender to help moved-abroad 18 to 35s keep their devices, data, money and identity safe while they live their whole lives online in a new country. In line with this mission, Bitdefender is providing College Life Club members with 50% off the first year for young professionals and graduates, and a free-trial option for students. Become a member of College Life Club (free) to get this benefit right now.
Social Media Safety Starts With Your Login
Every social media account is only as safe as the way you log into it. Fix the login, and most takeovers stop before they start.
So where should you begin? With a unique password for each platform and a second login step on top. Bitdefender SecurePass makes the first part easy: it generates and stores a different password for every account in an end-to-end encrypted vault, so a leak on one site cannot unlock your Instagram.
A unique password per account
Reused passwords are the most common way social accounts get taken. A password leaked from a forum, a shopping site or an old game gets tried on Instagram, TikTok and email, because criminals know how often people reuse. The UK's National Cyber Security Centre warns that if one account using a shared password is compromised, a hacker can try it on your other accounts. Give every platform its own long password, and let a password manager remember them, so you never have to choose between safe and memorable.
Two-step login on every platform
Two-step login, also called two-factor authentication, asks for a second check after your password, usually a code or an app prompt. The NCSC says that even if a criminal knows your password, they cannot get into accounts protected by two-step verification, in its social media guidance. Every major platform offers it in its security settings. Turn it on for each one, starting with the accounts you would hate to lose most, and the email address they all reset through. It takes about two minutes per platform.
An authenticator app instead of texts
Text message codes are better than nothing, but they depend on your phone number, which can change when you move abroad or be stolen in a SIM swap. An authenticator app makes codes on the phone itself, with no signal needed. SecurePass can also act as your authenticator, according to Bitdefender's support pages: you scan the platform's QR code into that account's entry, and the time-sensitive code appears next to the password. Choose one app, use it everywhere, and save the backup codes.
Login alerts switched on
Most platforms can alert you when someone logs in from a new device or location. That alert is often your first warning that a password has leaked. Turn alerts on in each platform's security settings, and make sure they go to an email or phone you actually check. When an alert arrives that you do not recognise, act straight away: change the password, sign out other sessions and check the account's recent activity before the intruder changes your details. Keep the alerts on even when they feel noisy; one real warning is worth a hundred routine ones.
A recovery email you still use
If you lose access, the platform will usually send a reset link to your recovery email. Many internationals still have an old university or home-country email set as the recovery address, which they no longer check. Update it to an address you use every day, and protect that inbox with its own unique password and two-step login. Our guide to securing your email account first explains why every other account depends on it. Check each platform's recovery settings once a year, and after every move, so the address stays current.
A recovery number that works abroad
Old recovery phone numbers are one of the most common reasons people abroad get locked out. If your account still lists a number from home that you can no longer receive texts on, a reset may be impossible when you need it most. Add your current number as soon as you have it, and remove old ones once the new number works. Keep backup codes too, so a lost phone or new SIM does not leave you locked out of years of photos and messages.
A strong login protects the door. The next settings limit what strangers can see and use, even when they never get in.
Privacy Settings That Cut Your Exposure
Privacy settings decide who sees your posts, your friends and your location. The less a stranger can see, the harder it is to target you with a convincing scam.
So what is the risk of a public profile? The NCSC notes that criminals can use your digital footprint, the information about you that is available online, to steal your identity or make phishing messages more convincing.
A private profile
Setting your profile to private means only people you approve can see your posts and stories. It does not make you invisible, but it stops strangers collecting your photos, your routines and the names of your friends. If you use an account for work or creative projects and need it public, consider keeping a separate private account for friends and family. Check the setting again after app updates, because platforms sometimes change defaults or add new features that start out public.
Hidden friend and follower lists
Your friend and follower lists tell a scammer exactly who to pretend to be. Copycat accounts often clone a profile and then message everyone on its friend list, asking for money or a code. Hiding those lists from the public makes that much harder. Most platforms let you control who can see your connections in the privacy settings. Hide them from everyone except people you have approved, and do the same for the list of accounts you follow. It takes a minute per platform and protects everyone you know, not just you.
Location sharing off
Many apps tag your location on posts or share it live with friends, sometimes by default. For someone living abroad, a public location history can reveal your home, your campus and your daily routine. Turn off location tagging by default and add it only when you choose. Review which friends can see your live location in each app, and remove anyone who no longer needs it. Post holiday photos after you get back, not while your room is empty. Check your camera's location setting too, since photos can carry location details inside the file itself.
Old posts reviewed
Years of public posts can reveal your date of birth, your first school, your pet's name and other answers to security questions. They can also put you in front of a future employer in ways you would not choose. Most platforms let you limit old posts to friends in one step. Do it, then scroll through and delete anything you would not want a stranger, a landlord or a recruiter to read. Our guide to social media habits covers the professional side.
Tagging approval on
Friends tagging you in photos and posts can spread your name and face far beyond your own privacy settings. Tag approval lets you review a tag before it appears on your profile. Turn it on, and check who can see posts you are tagged in. This also helps you notice when someone tags you in a spam post, which is a common way fake giveaways and scam links spread through a network of friends. Remove old tags you are not comfortable with while you are there.
Contact syncing off
Apps often ask to upload your phone contacts to "find friends". That shares other people's numbers with the platform and helps it suggest your account to people you might not want to find you. Turn off contact syncing unless you have a good reason, and remove previously uploaded contacts where the app allows. It also reduces the number of strangers who can find your profile through your phone number, which matters if your number has ever leaked. Ask flatmates to do the same, since their uploads can include your number too.
With your profile locked down, the next risk is the messages and accounts that try to trick you into opening the door yourself.
Spotting Fake Accounts and Scam Messages
Scammers do not always need your password. Often they persuade you to hand over a code, click a link or send money, using fake or hacked accounts that look trustworthy.
So how do you tell a real friend from a copycat? The NCSC advises contacting a friend by another method if something they post seems suspicious or out of character, in case their account has been hacked.
Copycat accounts of friends
A copycat account copies a friend's name and photo and sends you a new friend request or message. The real friend usually has no idea. Check whether you are already connected to them, look at when the account was created and how many posts it has, and message your friend through the account you already know. If it is a copy, report it, because the same account is probably messaging everyone your friend knows. Never accept a second friend request from someone you are already connected to without checking first.
"Verify your account" messages
A message claims to be from the platform's support team and says your account will be suspended for a copyright issue or policy breach unless you verify it through a link. The link leads to a fake login page. Platforms show real warnings inside the app, in your notifications or account status page, not through a direct message from a random account. The tell is the link. Check your account status in the app's settings and ignore the message. Report the message to the platform so it can remove the sender.
Fake brand giveaways
A message says you have won a giveaway from a brand or influencer you follow and asks you to pay shipping or log in to claim the prize. The account looks real but has a slightly different name or few followers. The NCSC points to verified badges, account age, nonsensical names and follower counts as things to check, while noting that followers can be bought. Visit the brand's official account directly to see whether the giveaway exists. Real giveaways never ask you to pay to receive a prize.
The friend asking for a code
A friend messages to say they accidentally sent a login code to your number and asks you to forward it. The code is for your account, and forwarding it hands it over. Often the friend's own account was hijacked the same way. The tell is any request for a code. Never forward one, however urgent it sounds. Call your friend to warn them, and if you already sent it, change your password and sign out all sessions straight away. Let SecurePass generate the new password, so the replacement is long, random and stored safely before the attacker can guess it.
Romance and investment openers
A stranger starts a friendly chat, compliments you and, after days or weeks, mentions an investment platform or a money problem. The FBI's Internet Crime Complaint Center recorded 17,910 confidence and romance scam complaints in 2024, according to its annual report. These scams are patient on purpose. The tell is money: any request to invest, lend or pay a fee. Stop replying, block the account and report it to the platform, however real the friendship felt. Talk to a friend you trust if you are unsure; an outside view helps.
Links in direct messages
Links sent in direct messages are a favourite way to spread phishing pages and malware, especially when they come from a friend's hacked account. Messages like "is this you in this video?" or "look what they posted about you" play on curiosity and worry. Do not tap links you were not expecting, even from friends. Ask them about it another way first. Fake recruiter messages work the same way; our guide to fake recruiter DMs shows the patterns. If a friend's account starts sending odd links, tell them straight away.
Even with good habits, accounts sometimes get taken. The last group of settings is about getting back in fast.
Social Media Safety When Something Goes Wrong
When an account is hacked, minutes matter. Criminals often change the email, phone number and password quickly to lock you out for good.
So what should you set up now, before anything happens? Backup codes, a clean list of connected apps and devices, and knowing where each platform's recovery page lives.
Backup codes saved
Backup codes are one-time codes that let you log in without your phone or two-step app. Every major platform offers them when you turn on two-step login. Download them and store them somewhere you can reach without your phone, such as an encrypted vault on your laptop or a printed copy in your document folder. Without them, a lost phone and a hacked account at the same time can mean waiting days for the platform's support team. Generate a fresh set whenever you use one or suspect they were seen.
The hacked-account route bookmarked
Each platform has a dedicated page for hacked or compromised accounts, often separate from the normal password reset. Find it now for your main accounts and bookmark it. If you are locked out, that page is usually the fastest route back. The NCSC's guide to recovering accounts lists the steps in order: contact the provider, check your email, change passwords, log out all devices, set up two-step login and tell your contacts. Keep the bookmarks on a device other than your phone, in case the phone is the thing you have lost.
Your followers warned
If someone else controls your account, they may message your friends asking for money, codes or clicks. Tell your contacts through another account or channel that you have been hacked and that they should ignore messages from your profile until you are back in. Ask close friends to report the account to the platform too, which can speed up the response. Once you recover the account, post a short note so people know it is safe again. Speed matters here, because scam messages from a trusted account spread fast.
Connected apps checked
Over the years, you have probably logged into games, quizzes and other apps using your social media account. Each one can keep access to some of your data, and a dodgy one can post or read on your behalf. Go to each platform's security settings, find the list of connected or authorised apps, and remove anything you no longer use or do not recognise. Do it once a term, and straight away after any suspicious activity. Fewer connected apps means fewer ways in for an attacker.
Old devices removed
Most platforms show a list of devices and sessions where your account is logged in. Check it for old phones, shared laptops, library computers and anything in a country you have not been to. Log out of everything you do not recognise or no longer use, then change your password. This takes a minute and closes the door on anyone who once had access, including a former flatmate or an old phone you sold. Do the same for your email account, which can reset everything else.
Impersonation reported
If someone creates a fake account using your name and photos, report it to the platform using its impersonation route. Ask friends to report it too. Keep screenshots of the fake profile and any messages it sent, in case the impersonation spreads or someone loses money. If the fake account is being used to apply for credit or services in your name, our guide to identity theft help explains how and where to report it. Most platforms act faster when several people report the same account.
These recovery settings take an afternoon to set up. They mean that if the worst happens, you get your account back in hours, not weeks.
Conclusion
Social media safety comes down to three things: a strong, unique login with a second step, privacy settings that limit what strangers can use, and a recovery plan ready before you need it. Most account takeovers rely on a reused password, a forwarded code or a convincing message, and these 24 settings close all three gaps.
Set them up platform by platform, starting with the accounts you would hate to lose and the email they all reset through. The purpose of this guide was to help you keep your devices, data, money and identity safe while you live your whole life online in a new country. To help you on this journey, College Life has partnered with Bitdefender to make your life easier. Join College Life Club for free and start taking advantage of this today.
FAQ
What is the most important social media safety setting?
Two-step login, together with a unique password for each account. The NCSC says that even if a criminal knows your password, they cannot get into an account protected by two-step verification. Turn it on for every platform you use.
How do I know if my social media account has been hacked?
Look for posts or messages you did not send, login alerts from unknown devices or places, changes to your email or phone number, and being suddenly logged out. If you see any of these, change your password, sign out all sessions and use the platform's hacked-account page.
Should my social media accounts be private?
For personal accounts, a private profile limits what strangers can collect about you, which makes scams and identity theft harder. If you need a public account for work or creative projects, keep a separate private account for friends and family.
Why do scammers ask me to forward a code?
The code is usually a login or verification code for your own account. Forwarding it lets the scammer log in as you. Never share a code, even with a friend, and change your password if you already did.
What should I do if someone is impersonating me?
Report the fake account to the platform, ask friends to report it too, and keep screenshots. Warn your contacts not to trust messages from it. If it is used for fraud in your name, report it to the police where you live.