NexSHOPX-官方新闻
Which parts of Instagram account security settings should you change? Only 5 locations in Meta's Accounts Center truly determine account ownership: password, two-factor authentication, passkeys, contact email, cross-app linking, and logged-in devices. Many people think that changing the password and enabling SMS verification is enough, but after Meta centralized credentials into the Accounts Center, this approach no longer blocks passwordless login channels.
Since 2025, Meta has been pushing forward the integration of security credentials across Instagram, Facebook, and Threads, with login, verification, and recovery all handled in the Accounts Center. The scattered toggles in the app from older tutorials are no longer effective. You must follow the correct order to complete credential replacement in these 5 areas to ensure that only you can log in.
Location 1: Password – Where is "Password and security" and Why Changing the Password is Just the Beginning
Changing the password is the first step, but far from everything. Go to Accounts Center > Password and security > Change password to update your login password. This path is also the clear answer to "Where to change the password in Instagram's Accounts Center."
However, simply changing the password cannot block already-established passwordless login methods, such as passkeys or logged-in device sessions. The password is just one entry point; the other 4 locations are the key.
Location 2: Two-Factor Authentication – How to Switch to Your Own Phone Number
In Accounts Center > Password and security > Two-factor authentication, replace the verification method with an authenticator app or phone number that you control. This is the first step in sovereignty transfer. If this step cannot be completed, it means the credentials you hold are incomplete, and all subsequent operations may be in vain.
To change two-step verification to your own phone number, operate within this menu: delete the old number and add your own. Note that if this is locked and cannot be modified, it usually means the account has triggered Meta's security checkpoint. You must first complete identity verification as required by the platform (e.g., selfie video verification). Such verification is handled according to platform rules.
Location 3: Passkeys – Private Keys Remain on the Other Party's Device, Why You Must Scrutinize Each Registered Credential
Meta's passkeys store encrypted private keys on local physical devices, allowing passwordless login via fingerprint or face recognition, and they are independent of the password. If you only changed the password after taking over the account but forgot to clear the passkeys bound to the previous owner's devices, they can still log in directly.
Therefore, in Accounts Center > Password and security > Passkeys, review all registered passkeys one by one, and delete any you don't recognize or that don't belong to you. This answers "Can I delete someone else's passkey on Instagram?" – Yes, and you must delete them all.
Location 4: Contact Email and Recovery Entry – Is the Transfer in "Personal Details" Truly Complete?
Accounts Center > Personal details > Contact info determines the password recovery path. Here, you must change to your own email and phone number. Many ask: "If I change my contact email, can the original owner still log in?" The answer depends on whether other credentials have been handed over.
If the original owner still has passkeys or logged-in devices, even if the email is changed, they can bypass it. So changing the email is only part of the loop, not the whole. In some cases, the original registration email may trigger a security lock due to platform mechanisms; this must be handled according to official procedures.
Location 5: Cross-App Linking and Logged-In Devices – How to Unlink from Facebook and See Who is Logged In
If this Instagram account is linked to a Facebook main account, the other party may be able to directly access it through Facebook's passwordless channel, and account activity will sync across apps. To unlink, go to Accounts Center > Accounts, and click "Remove" next to the corresponding account. This is the standard operation for "How to unlink a purchased Instagram account from Facebook." The same Accounts Center logic applies to Facebook as well, as referenced in Facebook Account Security Settings.
Additionally, in Accounts Center > Password and security > Where you're logged in, review all active sessions and log out any unfamiliar devices. This also answers "How to see which devices are logged into Instagram" – the list shows device types, locations, and times, making it easy to investigate.
The Correct Order: Why You Should First Bind Your Own Verification Methods, Then Clear Others' Sessions, and Finally Unlink Associations
The order of Instagram account security settings cannot be random. First, bind your own email and phone number in Personal details and Password and security, and enable 2FA; second, enter Where you're logged in and log out all unfamiliar sessions, and delete unfamiliar passkeys; finally, unlink any associated Facebook or other cross-app connections.
If the order is reversed, you might clear sessions before you have your own verification methods, locking yourself out; or unlink associations first, but the other party could take it back immediately due to remaining passkeys. Follow the order of "first establish yourself, then clear others" to achieve a smooth transfer.
When Encountering Security Checkpoints or Suspicious Login Resets: What You Can Do Yourself vs. What You Can't
If you see a suspicious login prompt after logging in and are asked to reset your password, don't rush to change it repeatedly. This is likely Meta's adaptive risk control, triggered by network environment changes or unusual behavior. Typically, you'll need to receive a verification code via your registered email or phone, or complete selfie video verification.
This type of identity verification is part of platform rules and cannot be bypassed by regular password changes or any tools. What you can do is complete configurable items within the Accounts Center, such as updating contact info and 2FA, but platform-mandated facial verification must be done by you. Don't trust any services that claim to do verification for you or bypass risk control – those are scams.
Instagram Account Security Settings Self-Check Checklist: How to Confirm the Previous Owner Can No Longer Access
Use this checklist to verify each item of Instagram account security settings. If any item is not met, the delivery is not complete:
| Check Item | Completion Standard |
|---|---|
| Two-factor authentication (2FA) | Verification method changed to your own app or phone number, and active |
| Passkey list | Number of registered passkeys is 0, or only your own devices remain |
| Contact information | Email and phone number all changed to yours, and can receive verification codes |
| Linked accounts | No unauthorized Facebook or Threads associations |
| Logged-in devices | Session list only contains your devices |
If any item cannot be completed, be sure to contact the delivery party within the after-sales window, rather than repeatedly changing the password yourself. If you repeatedly fail to log in during verification, refer to What to Do When Account Login Fails.
Where NexSHOPX Can Help in This Process, and Its Boundaries
NexSHOPX's category search and quick delivery process allows you to quickly verify account status upon receipt using the checklist above. The self-service ordering and limited-time after-sales support for login failures can help you confirm whether recovery entry points and verification methods have been transferred within the after-sales window. The complete Overseas Account Delivery Process also covers these steps. However, note that platform-side identity verification, real-name/KYC requirements, and Meta's risk control decisions are not within NexSHOPX's capabilities. In other words, whether an account passes review or gets banned depends on the platform; no one can guarantee it.
Compliance Reminder: Meta's Terms of Service, Local Laws, and Real-Name/KYC Requirements
All operations must comply with Meta's terms of service and local laws. Especially when it comes to account transfers, ensure your actions conform to Instagram's community guidelines and account usage policies. Do not attempt to bypass any identity verification or security review, as this could result in permanent account ban.
Frequently Asked Questions
Where do I change the password in the Instagram Accounts Center?
Go to Accounts Center > Password and security > Change password. The security settings entry in the Instagram app is now consolidated into the Accounts Center, so follow the path above. Passkeys are independent of the password; after changing the password, you still need to clear unfamiliar passkeys and historical sessions, because passwordless login channels won't close just by changing the password.
How do I change two-step verification to my own phone number?
In Accounts Center > Password and security > Two-factor authentication, first add and verify your phone number, then delete the old number. If the delete button is not clickable, it means the account currently does not allow self-service changes to verification methods. You need to complete identity verification as prompted by the platform, handled according to platform rules. The order should be to add your own verification method first, then delete the old one; otherwise, after deletion, you might be locked out due to lack of available verification methods.
Can I delete someone else's passkey on Instagram?
Yes. In Accounts Center > Password and security > Passkeys, all registered passkeys are listed. Check each entry's device name and creation time: if the device model or name doesn't match your usual devices, or the creation time is earlier than the date you took over the account, it's likely left by the previous owner. Delete any you don't recognize. It's recommended to clear all and then register a new passkey with your own device, so you don't have to rely solely on SMS for future logins.
How do I unlink a purchased Instagram account from Facebook?
Go to Accounts Center > Accounts, and in the account list, click "Remove" next to the Instagram account to unlink. If the account is also bound to pages or other apps, check and clean those as well. After unlinking, the other party cannot log in via Facebook.
How do I see which devices are logged in?
Go to Accounts Center > Password and security > Where you're logged in. This lists all devices that have logged in, including model, location, and last login time. Log out any unfamiliar devices one by one.
If I change the contact email, can the original owner still log in?
If the other party still has passkeys or logged-in devices, they can still log in even if you change the email. So you must also clear passkeys, logged-in sessions, and unlink all associated accounts to achieve a complete handover. If Threads is involved, refer to Threads Account Purchasing Guide to confirm whether cross-app associations have been cleared. It's recommended to follow the checklist in this article to verify each item.
Comments(0)