For adults using their own authorised account
Use the genuine platform and current instructions for your device. A trusted helper can explain the controls while you keep passwords, codes and account ownership private. Check eligibility before creating or using an account.
Step 1 of 9
In this guide
Choose a genuine service and eligible account
Choose a genuine service and eligible account
Choose one task you want to learn: read a community group, keep up with relatives or share an occasional update. Use the service’s genuine app from its normal app store or known website. Search advertisements and messages offering “account support” are not a substitute for the real service.
This guide is for adults learning their own authorised account. Australian age restrictions apply to covered social platforms: eSafety’s current under-16 guidance explains the rules and affected services. Check eligibility and use the genuine process; do not use a false date of birth, another person’s identity or a workaround.
If you already have an account, confirm its identity before making a second one. Learn how to return through your normal sign-in and recovery route. A helper can explain controls while you operate them; they do not need your password, one-time codes or ownership of the account.
Start with an eligible account on the genuine service and one useful task. Keep account ownership and recovery with you rather than create duplicate or borrowed identities.
Next: Learn the feed, profile and message controlsLearn the feed, profile and message controls
Learn the feed, profile and message controls
The feed is a stream of posts and recommendations; your profile is information and content associated with your account. A friend/follow connection controls some relationships but does not make every post private. A group may have its own membership and visibility rules. Read those before contributing.
A like/reaction, comment and share are different actions. A comment can appear with the original post; sharing can distribute it to another audience. Sponsored posts are advertisements, and an attractive recommendation is not the platform’s guarantee that an offer or person is genuine.
Messages are separate from public comments, but the recipient can copy or forward them. Check the recipient and conversation before typing. For your first practice, read a known community page and find its genuine About/help information without buying, posting, following unknown accounts or giving location/contact permissions you do not need.
Identify where an action appears and who may see it. Reading a known page is enough for initial practice; a private message is not a guarantee against copying.
Check an unexpected profile or message
Check an unexpected profile or message
Be cautious with a new duplicate friend request, urgent money demand, prize fee, account-warning link or pressure to move a conversation elsewhere. Read the actual account name/handle and the request, rather than rely on a familiar photo. A genuine account can also be taken over.
Contact the person through a number or route you already know, separately from the unexpected message. For a business, use its known website or established contact, not the link or number supplied in the request. Do not send money, identity copies, passwords or approval codes while deciding.
eSafety describes fake-profile warning signs. A sparse profile or inconsistent story can raise concern, but a low friend count, language, photo, badge, mutual connection or video call alone does not prove identity either way. No single visual check makes an unfamiliar account safe. If money or access has already been lost, use the genuine bank/provider promptly and appropriate scam reporting rather than keep chatting to investigate.
Pause and verify an unexpected request independently. Keep money, codes and identity details private; suspicion is a reason to stop, not publicly accuse someone based on appearance.
More checks6 detailed checks
Review audience, contact and tagging settings
Review audience, contact and tagging settings
In the genuine service’s settings, review who can see your profile details and future posts, contact or follow you, tag/mention you, and see any location or activity information. Settings and defaults vary by account, platform and version; do not assume everything is private because one option is changed.
For Facebook, its current privacy help points to Settings & privacy, Settings, then Audience and visibility for relevant controls. Privacy Checkup can help review choices. Read the actual option and intended audience; stories, reels, older posts and groups may have separate rules.
Choose settings suited to your purpose and check their explanation before confirming. A profile/tag-review control does not remove an original post from everyone else’s view. People who can see content may still copy it. Avoid publishing full birth dates, identity documents or live travel/home-location details just because the audience appears limited.
Review each relevant audience/contact control and its scope. Settings reduce exposure but do not recall copies or make all past content and other people’s posts private.
Next: Protect sign-in and recovery without sharing codesProtect sign-in and recovery without sharing codes
Protect sign-in and recovery without sharing codes
Use a unique strong password/passphrase and the genuine service’s supported passkey or multi-factor options where available. Australian social-account security guidance explains sign-in, code-sharing and app-permission precautions. Keep recovery details current and store recovery information privately. Check the supported instructions for your actual account; avoid removing the only working sign-in method while setting up another.
A message asking you to forward a sign-in code, scan an unexpected sign-in QR code or approve a notification can be trying to take over your account. Open your usual app independently to review a genuine notice. Friends, helpers and “recovery agents” do not need your authentication secrets.
If your account behaves unexpectedly, use the provider’s genuine recovery process from a trusted device and our phishing and fake-website guide. Do not pay an unsolicited person who promises to hack the account back or install remote-control software because a social message says support requires it.
Keep supported sign-in/recovery under your control and never share approval codes. Unexpected access needs the genuine recovery route rather than an unsolicited recovery offer.
Practise a small update and check the audience
Practise a small update and check the audience
Use a harmless example, such as a short greeting without names, address, travel plans or photos of other people. Open the normal post composer and locate the audience control before adding anything sensitive. Facebook’s posting guidance, for example, places an audience selector in the composer before Post.
For practice, review the audience and exit/discard the draft without publishing if you are not ready. If you choose to post for real, confirm the intended audience and actual account first. A comment on someone else’s post follows that context; it is not the same as a separately addressed private message.
Before sharing a photo or forwarding content, check consent, background details and whether the claim/source is reliable. Do not tag another person, expose their contact details or post children’s information as a training exercise. Know where the edit/delete controls are, while recognising deletion may not remove copies others already made.
Use a harmless draft and inspect the audience before any real post. Share only content you are comfortable supplying to that audience, with appropriate consent.
Next: Choose notifications and a manageable routineChoose notifications and a manageable routine
Choose notifications and a manageable routine
Review the app’s notifications and choose useful alerts rather than accept every suggestion. A notification, live video or expiring offer does not require an immediate response. Learn to mute/unfollow ordinary unwanted content without assuming you must leave the whole service.
Keep app permissions proportionate to features you actually use. A camera or photo selection may be needed for a chosen upload; that does not mean every app needs continuous location or your complete contacts. Read the actual prompt and use the supported limited option when it suits the task.
Use the genuine help or eSafety Guide for your platform’s controls. Business pages, group administration, paid promotions and online selling need their own authority and checks; they are beyond this first personal-account lesson. If a helper is teaching you, finish by doing the ordinary task yourself while keeping your credentials private.
Set a manageable routine and permissions that match actual use. Completing a personal-account lesson does not authorise business administration or spending.
Next: Check the ordinary task and know where help isRespond to impersonation, scams or abuse
Respond to impersonation, scams or abuse
If an account impersonates you or sends a suspected scam, stop interacting and use the platform’s genuine report/block controls as appropriate. Keep safe relevant account links, dates and message details privately if needed for a report. Do not spread a suspected scam, retaliate or warn others by reposting private material.
For threats, intimate-image abuse or other serious harm, use eSafety’s reporting guidance and appropriate trusted support. Do not pay a blackmailer or send further intimate content. Do not copy, save or forward sexual images of anyone under18 or illegal material; use official reporting guidance rather than create your own evidence collection. Where contact is part of coercive control, obtain an appropriate safety plan before changes that could alert the person.
For lost money, contact the genuine bank/payment provider promptly. For account takeover, use the platform’s recovery process; for exposed identity information, our identity-protection guide explains separate follow-up. A platform report does not guarantee immediate removal, repayment or complete account recovery.
Stop harmful interaction and choose the genuine platform/provider or specialist support route. Preserve only safe relevant details privately; reporting does not guarantee a particular outcome.
Back to the symptom checkerCheck the ordinary task and know where help is
Check the ordinary task and know where help is
Can you open the genuine app/account, read a known page, distinguish a message from a public comment and find the audience control before a draft post? Check that you know how to leave a draft, find normal settings/help and pause an unexpected request. You do not need a public post or a new friend request to prove the lesson worked.
Keep a short personal note of the feature you learned and where its genuine help is; do not record passwords or codes on a shared lesson sheet. If the interface changes, use the provider’s current instructions rather than a screenshot from an older course. Review relevant settings when you start using a new feature.
For help learning those controls, our computer training can discuss a practical session suited to your device and goals. Stop once the intended task is understood. Suspicious access, financial loss or abuse needs the specific response route, not repeated practice with the harmful message.
Confirm the useful task, audience awareness and genuine help route without a risky test. Stop practice once the goal is understood and use specific support for suspicious or harmful activity.
