Got your name from a seller you trust? Then the first few days count for more than the first few minutes. Sign in properly, leave everything alone for 3 days, then work through the checklist below.
This is for deals with sellers you trust, like us. Bought from a stranger? Never leave an account you paid for unprotected: use a middleman and run the full checklist below straight away.
Day 0: signing in
- Enter the password. A 6-digit code comes next. Type it in and you're through. (The same steps are on how to buy.)
- Seeing an 8-digit code, or a longer one? Stop. Usually the password went in wrong, or something else isn't right. Don't enter that code and don't keep trying, because repeated attempts can put the account in danger. Talk to the seller before anything else.
- Anything feel off? The seller hears about it first. Don't try to solve a login problem on your own. A decent seller will talk you through what to do.
Day 1 through day 3: hands off
Leave the email, password and phone number just as they are for 3 days. A rush of security changes straight after a sign-in from a new device is one of the things that gets accounts flagged, so holding off cuts the ban risk. Meanwhile, use the account the way you normally would.
Safest move: put the name on an account you already use
Where possible, have the name swapped onto an account you've had for 14 days or more, not one you just made. An account with some history is much less likely to get flagged. Don't have one? Meta Verified gives you extra protection against bans. Here's how a guided swap works.
From day 3: the 9-step checklist
Bought from a stranger? Skip the wait and do this now.
1. Swap in your own email
If an email came with the account, change it to one only you control, ideally a fresh address you use for nothing else. If you were also handed the original email (OGE), change that inbox's password and recovery details too.
2. Set a new password
Pick a long one you don't use anywhere else. A password manager takes the pain out of it.
3. Switch on two-factor authentication (2FA)
Go with an authenticator app or a passkey / security key, not text messages. SMS codes can be hijacked with a SIM swap, where someone talks a phone carrier into moving your number onto their SIM.
4. Keep backup codes offline
Turning on 2FA gives you a set of backup codes. Write them on paper or put them in your password manager, not in your photos or a notes app.
5. Sign out everywhere else
Open the account's security settings, see where it's logged in, and end every session on a device or in a place that isn't yours.
6. Clear out old phone numbers
Remove any number that doesn't belong to you. A number left behind is a recovery door someone else could walk through.
7. Review linked apps and sites
Cut off any outside app or website with access to the account that you didn't connect yourself.
8. Protect the email account as well
The handle is only as safe as the inbox behind it. Turn on 2FA for the email itself and look over its recovery options.
9. Ignore fake "security" messages
Once a valuable name changes hands, scammers love sending bogus "copyright", "verification" or "your account will be removed" notes. The app will never DM you asking for your password or 2FA code. Don't tap, don't answer.
House rule: no real person ever needs your password, 2FA code or backup codes. Support doesn't, buyers don't, sellers don't.
Extra armour for pricey names
- Pick a separate email that never shows up anywhere public.
- Add a hardware security key to both the account and the inbox.
- Turn on Meta Verified on Instagram for one more layer of protection.
- Keep the account in use. Post or sign in now and then so it never looks abandoned.
Our safe login guide digs further into each one.
If something looks wrong
During the first 3 days, change nothing yourself: message your seller first and they'll walk you through it. Past that point, if a login alert shows up that you don't recognise, change the password, sign out of other sessions and check your email settings, then reach the platform only through its official help center. Treat links in DMs or surprise emails as untrustworthy.