Instagram confirms that it's beginning to roll out long-awaited two-factor authentication
Instagram Finally Adds Two-Factor Authentication To Fight Hackers — Instagram accounts are worth stealing. Now at 400 million users including celebrities, brands, and artists making a living, it's time to add another lock to its doors.
Context & Ripple Effects
Instagram's 2016 two-factor rollout closes a gap that had widened as the service grew to 400 million users, including celebrities and brands whose accounts carry real commercial value. The related coverage shows this was only the opening move: by mid-2018 Instagram was building a non-SMS two-factor system that works with apps like Google Authenticator and Duo specifically to thwart SIM hijackers, and later that year paired account verification for public figures with support for 2FA apps.
First-order effects
- Instagram's highest-value users — celebrities, brands, and artists making a living on the platform — get a second lock on accounts that were previously protected by password alone, directly raising the cost of the account-theft that made Instagram logins worth stealing.
Second-order effects
- The SMS-based version of 2FA introduced here proved vulnerable to SIM hijackers, forcing Instagram to build the app-based alternative with Google Authenticator and Duo that it announced in 2018 rather than standing pat on its first implementation.
Third-order effects
- Authentication alone didn't end the problem: Instagram went on to layer on identity checks via government IDs for suspected inauthentic behavior and dedicated hacked-account recovery tooling, pointing toward account security as a permanent product surface rather than a one-time feature.
The trend: Platform account security is shifting from a single password gate to layered defenses — second factors, identity verification, and recovery paths — as the value of hijacked social accounts keeps rising.