Use your browser to navigate to the Facebook homepage and log in there, instead. Be suspicious of links: If you click a link and it opens a Facebook log-in page, don’t type in your credentials.

The only place you’ll ever share them is the Facebook website or app. Never share your password or codes: Facebook will never text, email or call you to ask for your log-in information or the two-factor authentication code.

Contact them another way to ask if it is real.

Trust no one: If you get a message from anyone - a friend, family member or official sounding stranger - asking for help, security codes, money or personal information, do not reply.

This is not necessary for the vast majority of casual Facebook users. A small dongle you carry on you at all times like the kind made by Yubico, a security key needs to be plugged into or tapped on the device you’re trying to log in on.

Security key: Instead of using a text message or smartphone app, this option will let you authenticate your identity with a physical security key.

Using an app instead of text protects you from a serious but uncommon type of hack called a SIM swap. We recommend downloading a free, reputable authentication app like Twilio’s Authy or Google Authenticator ( iOS, Android).

Authentication app: This works similar to the text option, but you will open a third-party app to get the numeric code instead of a message.

This is the simplest option and a huge improvement over just a log-in email and password alone.

Text message (SMS): Facebook will text a number to your phone that you have to enter into the website or Facebook app when you log in, after you enter your password.

Free 1 password