Your social media privacy settings decide who can see your posts, find your profile and message you, and most people never change the defaults. A quick review takes about fifteen minutes and closes the gaps that scammers and strangers rely on. Here are the most common mistakes and what to do instead.
Why Social Media Privacy Settings Matter More Than Ever
Social media is now a favourite hunting ground for fraudsters. According to new FTC data on social media scams, nearly 30% of scam victims who reported a loss in 2025 said it began on social media, adding up to $2.1 billion. The same release points out that investment, shopping and romance scams were the main types, and that restricting who can see your posts is one practical defence.
In other words, privacy settings are not about hiding. They are about making it harder for a stranger to build a believable story about you.
Leaving Your Profile Public by Default
Many apps start with a public profile. That means anyone can read your posts, see your friends and learn where you work or when you are on holiday. Open the privacy section of each app and look for options such as who can see future posts, who can see your friends list and who can find you by phone number or email.
- Switch posts to friends or followers only unless you run a public page on purpose.
- Hide your friends or following list from the public.
- Limit who can look you up by email address or phone number.
- Review old posts in one go using the “limit past posts” style option if the app offers it.
Reusing One Weak Password Everywhere
If one site is breached, a reused password opens every account that shares it. The FTC recommends long passwords of at least 15 characters, or passphrases made of random words, and a password manager if you struggle to remember them. Make your social media passwords unique, starting with the email account that can reset all the others.
Skipping Two-Step Verification
Two-step verification, also called multi-factor authentication, adds a second check after your password. The FTC page above notes that authenticator apps and physical security keys are the strongest options, while text message codes are still better than nothing. Turn it on for every social account, then save your backup codes somewhere safe and offline.
Accepting Every Friend or Follow Request
Fake profiles often copy real photos and ask to connect before sending a message with a link or an “opportunity”. A simple rule helps: accept only people you know, or whose profile has a real history and mutual friends you can verify. If an old contact suddenly asks for money or pushes an investment tip, contact them another way before replying.
Forgetting About Connected Apps and Old Logins
Quizzes, games and third-party tools you once logged into with your social account may still have access to your profile. Go to the security or apps section and remove anything you no longer use. While you are there, look at the list of logged-in devices and sign out of ones you do not recognise.
Trusting Ads and Direct Messages Too Quickly
Platforms do not always check every advertiser thoroughly, so a slick ad is not proof that a shop is real. Before buying, search the company name together with the word “scam” or “complaint”. Learn the warning signs of phishing messages: invented account problems, requests to confirm personal details and links to “update” payment information.
A Simple Fifteen-Minute Privacy Checkup
Set a reminder to repeat this checkup every few months, because apps change their settings and add new features without much warning.
- Check who can see your posts, stories and friends list.
- Change reused passwords and turn on two-step verification.
- Remove unused apps and sign out of unknown devices.
- Update the app and your phone so security fixes are installed.
- Review your profile photo, bio and tagged posts for details you would not share with a stranger.
If you also run a blog or channel, protect that too: our guide to security basics for your own website and the tips on how to grow a channel with AI tools show how to keep a growing audience and your accounts safe together.
Frequently Asked Questions
Do I need to make my account private?
Not necessarily. A public account is fine for a business or creator page, but a personal profile is safer when limited to friends or followers.
How often should I check my privacy settings?
Every three to six months is a good rhythm, and always after a major app update or a data breach in the news.
What should I do if I clicked a suspicious link?
Change the password for that account right away, turn on two-step verification and watch for unusual activity. If you shared financial details, contact your bank and report the scam to your national consumer authority.
Your Next Step
Pick one app today and work through the list above. Once your most-used account is locked down, repeat the process for the others, and you will have removed the easiest openings for scammers.