Meta Accounts Center security checklist for families

Facebook, Instagram and WhatsApp can share convenient account features. A security review should start by checking what you have actually connected. Shared sign-in or a compromised recovery email can affect more than one account; having several Meta apps installed does not, by itself, mean they all share a login.

This checklist is for your own accounts or for helping a parent or relative with their permission. Let the account owner enter passwords and codes. Work at their pace, and leave them able to sign in without you.

First, check which settings you have

Open settings inside Facebook or Instagram and look for Accounts Center or Meta Account. Meta began gradually replacing Accounts Center with an updated Meta Account in April 2026. The new experience can centralize passwords, two-factor authentication and contact details, while allowing people to keep different apps in separate Meta Accounts. Your screens may differ during the rollout. Meta’s account update

Review the profiles and apps listed. Check any connected-login options before changing them. If you want to separate accounts, first confirm you can sign in to each and reach its recovery email. Follow the app’s instructions rather than guessing through unfamiliar prompts.

Secure the recovery route

Confirm that the email address and phone number shown are still yours and working. Update stale details, and investigate anything you do not recognise. Secure the email inbox itself with a unique password and two-step verification, because password-reset messages often arrive there.

Meta’s Instagram Security Checkup covers recovery contacts, login activity and accounts that share login information. Use it to check the connections as well as the password. Instagram security guidance

Strengthen sign-in and review devices

• Use a long, unique password wherever a separate password is required. A password manager can help you keep track of them.
• Run Security Checkup and enable two-factor authentication. Use an authenticator app when it is practical for the person using the account.
• Consider a passkey where the app offers it. Make sure the owner understands how they will sign in after a lost or replaced phone.
• Review login activity and sign out devices you do not recognise. Turn on login alerts and check unexpected alerts inside the app.
• Save any recovery codes the app provides somewhere private that the owner can find. Do not send them through chat.

Meta recommends unique passwords, two-factor authentication and a review of existing sessions. Its newer account-support guidance also covers passkeys and Security Checkup. Account protection, current recovery and security tools

Check WhatsApp separately

Adding WhatsApp to Accounts Center is optional and was introduced off by default. Personal WhatsApp messages and calls remain end-to-end encrypted when it is added. WhatsApp and Accounts Center

In WhatsApp, open Linked devices and log out anything unfamiliar. Linking a computer or companion phone is a separate action from adding WhatsApp to Accounts Center. Only approve a device you are setting up yourself, and never follow an unexpected request to scan a linking QR code or share a registration code.

Review WhatsApp’s own account-security settings and enable two-step verification using the options shown. WhatsApp manages its passkeys independently. Linked-device guidance, two-step verification

Leave a simple family plan

Write down which email is used for recovery, where passwords and recovery codes are stored, and who can help with permission. Keep the record private. Recheck it after a new phone or changed email address.

Agree on one rule: an urgent request for money or a login code needs a separate check with the real person on a number you already know. A familiar profile photo is not enough.

If an account is already taken over, use the Facebook and Instagram recovery guide. If the mailbox is involved, use the hacked-email checklist too. Complete this review once access is restored.