The Social Media Habits That Quietly Put People at Risk

The Social Media Habits That Quietly Put People at Risk

I've written separately about the privacy settings I lock down on every platform, but settings are only half the picture. The other half is habit, the small everyday choices people make without thinking twice, and those habits are usually what actually gets someone into trouble, not a setting they forgot to change. These are the five I see trip people up most often, the ones that have nothing to do with a locked-down profile and everything to do with what someone does day to day once they're already logged in.

Accepting Every Friend Request Without a Second Look

The habit I see most is treating a friend or follow request as basically harmless, something to accept on autopilot because saying no feels awkward even to a stranger you'll never actually meet. A fake profile built to look like a mutual friend, sometimes using a cloned name and photo from someone real, gets accepted the same way a genuine request would, and once it's accepted that account can see everything your normal privacy settings would otherwise have hidden from a stranger. I check for shared friends, a profile history that actually looks lived-in rather than freshly created, and photos that don't look lifted from somewhere else before I accept anything from someone I don't actually know, and I'd rather leave a request pending for a day than accept something I can't quite place. Once someone's in, they're usually in for good, since almost nobody goes back later to prune a friend list the way they'd review a password, which means one careless accept years ago can still be sitting there quietly today.

Answering "Fun" Quiz Posts That Double as Security Questions

These circulate constantly, the kind that ask for your first pet's name, the street you grew up on, your first car, framed as a bit of harmless nostalgia everyone in the comments is playing along with. The problem is those are almost word for word the security questions banks and email providers still use to verify identity or reset a password, and answering publicly hands that information to anyone watching, not just the friends you meant to share it with. I don't answer these anymore, and if I want to reminisce about a first car I'll just message a friend directly instead of posting it somewhere searchable. It's a small habit shift that costs nothing and closes off a genuinely common way people get themselves compromised without ever being hacked in the technical sense.

Posting Real-Time Instead of After the Fact

A post that says where you are right now, whether that's a check-in, a geotagged photo, or just a caption that makes your current location obvious, tells anyone watching two things at once: exactly where you are, and by extension exactly where your home isn't. I've written about turning location tagging off at the app level, but the habit that matters even more is simply timing what I post. I share photos from a trip after I've left, not while I'm still there, and I've gotten comfortable with the idea that nobody actually needs to know where I am in the moment, no matter how good the photo is right now. It feels like a small delay. It closes off a specific and fairly obvious risk.

Reusing an Email Password as a Social Login

I still see people use the same password for their main social account that they use for their personal email, treating the two as separate enough not to matter even though one is usually the recovery method for the other. If a social account gets compromised through a data breach on a completely different site, and that same password unlocks the email account tied to it, whoever has it can often reset every other account linked to that inbox before you even notice something's wrong. A password manager generating a genuinely unique password for every account, social platforms included, closes this off completely, and it takes less effort to set up than most people assume once they actually sit down and do it properly.

Ignoring the Tag and Mention Review Queue

Most platforms let you approve what gets attached to your name before it appears on your profile, a tag, a mention, a photo someone else uploaded, but the setting only works if you actually check the queue instead of leaving it to pile up unread. I've been tagged in things I'd never have posted myself, sometimes just an unflattering photo, sometimes something that gave away more context about my life than I'd have chosen to share. Reviewing that queue regularly, not just switching the approval setting on and forgetting about it, is the habit that actually makes the setting worth having in the first place. I've started treating it the same way I treat checking for known data breaches on my main accounts, a short recurring task rather than a one-off fix, because new tags and mentions never actually stop arriving.

Why the Habit Matters as Much as the Setting

None of this replaces locking down your actual privacy settings, that groundwork still matters and I'd genuinely start there if you haven't already. But settings only cover what happens automatically. The rest comes down to habits, and habits are the part people tend to skip because they don't feel like a "setting" worth thinking about, right up until one of them causes a real problem. The NCSC has straightforward guidance on staying safe on social platforms if you want a second source to check your own habits against, and my free Safety Toolkit covers the account-level basics worth having in place underneath all of this. I'd rather build a few small habits now than find out the hard way which one I'd been skipping.