Instagram quietly tracks every device and session signed into your account. If you worry someone else is in, that login list is where you’ll catch them — and boot them in a couple of taps.
This guide is written for Instagram users specifically, and it’s built to be beginner-friendly: every step is numbered, every screen is illustrated, and nothing assumes you already know where a hidden menu lives. Read with your phone nearby so you can act on each step.
We’ll start with the fastest, highest-value checks and move toward the more thorough ones, so even the first few minutes are well spent. Where a real tool helps, we link straight to the official one — never a sketchy third-party site.
In short: open the login activity screen, log out anything suspicious, change your password, and turn on two-factor authentication. Below, every one of those is broken into clear steps with a screenshot-style picture.
Approach 1: Spot the Intruder
You won’t need any technical skill for this — just your phone and a couple of minutes. The steps are ordered so you never have to double back.
1Open the login activity screen
In Instagram’s options, find the account-security area and open the login activity or ‘where you’re logged in’ list. It shows every active session with a location and device.
Scan it for anything that isn’t you — an strange city or device is the tell.
Last-active times are your friend here — a device that was ‘active’ while you were asleep, or in a place you’ve never been, is the clearest evidence of all.
- Open Settings > Account Center > Security
- Open login activity / where you’re logged in
2Log out anything suspicious
For any session you don’t recognize, choose log out. Instagram ends that session at once, cutting off whoever was using it.
If you’re unsure, logging out an strange session is harmless — you can always sign back in on your own devices.
Removing a device you turn out to own is harmless; you simply sign in again. That makes caution the right call — when unsure, remove it.
- Log out of any session you don’t recognize
- When unsure, log it out anyway to be safe
Approach 2: Secure It
Every step below uses built-in settings, so there’s nothing to install. Follow them top to bottom; the illustrations point out each control you’ll need.
3Change your password
Logging out a session doesn’t help if the intruder knows your password — they’ll sign right back in. Change it to something new and strong from a device you trust.
Pick a password you don’t use anywhere else.
Once this is on, even someone who somehow learns your password is stopped at the door, because they can’t produce the second code that only reaches you.
- Set a new, unique password from a trusted device
- Don’t reuse a password from another account
4Turn on two-factor authentication
Finish by enabling two-factor authentication so any future login needs a code only you receive. An authenticator app is more secure than text-message codes.
With this on, even a stolen password isn’t enough to get in.
Once this is on, even someone who somehow learns your password is stopped at the door, because they can’t produce the second code that only reaches you.
- Enable two-factor authentication
- Prefer an authenticator app over SMS codes
Warnings
- Avoid logging in through links in DMs or emails; go directly to the app to dodge phishing.
- If your linked email was changed, recover that first — whoever controls your email can reset Instagram again.
Make It Stick
- An authenticator app beats SMS codes, which can be intercepted via SIM tricks.
- Check login activity occasionally, not just when something feels wrong.
Common Questions
How did someone get into my Instagram?
Most often a reused or phished password. Once in, they stay logged in silently, which is why the session list and a fresh password matter together.
Will they know I logged them out?
They’ll simply find themselves signed out next time they open the app. There’s no explicit notification sent to them.
What if I can't get into my own account?
Use Instagram’s account-recovery flow to regain access, then immediately change the password and review the login list.
Useful Links
These first-party tools let you check and lock things down directly:
- Instagram — open it to check or manage this yourself.
- Have I Been Pwned — open it to check or manage this yourself.
- Google Security Checkup — open it to check or manage this yourself.
- Apple App Store — open it to check or manage this yourself.
Take what’s useful and leave the rest for later. The goal isn’t a fortress overnight, it’s steady control — and you’ve already started just by reading this far.
Make Privacy a Habit
Catching a problem is good; preventing the next one is better. The short routine below keeps your phone genuinely hard to watch, and it takes only a few minutes a month.
Add two-factor authentication to your key accounts, starting with email, and you’ve covered the vast majority of realistic risks. Come back to the methods above any time something feels off.
Why This Is Worth Doing
The reason these steps work is that they target how monitoring actually happens in practice, not the dramatic movie version. Ordinary people are followed through ordinary settings, and ordinary settings are exactly what you’ve just learned to control.
Common Mistakes to Avoid
- Acting in a visible hurry when a calmer, quieter approach would be both safer and more thorough.
- Trusting a flashy ‘detector’ app from outside the official store, which is a common disguise for the very thing you’re trying to remove.
- Forgetting to change a password after removing access, which simply lets the same person back in.
- Assuming an unfamiliar name is harmless without checking it, or deleting a real system component in a panic.
When to Get Extra Help
There’s no shame in asking for help if the steps here don’t fully settle your mind. Official support channels for your phone can walk through settings with you, and if safety is part of the picture, a support service that handles tech abuse is the right call.
Quick Recap
To bring it together for Instagram users, here’s the whole process at a glance:
- Open the login activity screen
- Log out anything suspicious
- Change your password
- Turn on two-factor authentication
Run through it once now, and the next time will take half as long.
Good to Know
- Reusing passwords is what turns one company’s breach into your problem across many accounts, so unique passwords are less about that one site and more about containment.
- Convenience and privacy trade off in small ways, but the trades here are tiny — a few extra taps now and then — for a meaningful gain in control.
- Two-factor authentication is the closest thing to a single high-impact fix: it makes a stolen password almost useless on its own.
- A surprising amount of ‘tracking’ turns out to be a setting you switched on and forgot, not a hack — which is good news, because settings are easy to undo.
Hold onto these and the specific steps above become easier to remember, because you’ll understand the logic underneath them.