If you installed an app that promised to show who visited your profile If you've already entered your password into it, this text is about what to do now. And if you haven't installed it yet, it explains why it's not worth it: the information these apps promise. It doesn't exist. Instagram, Facebook, TikTok, and X don't tell anyone who created a profile, not even the profile owner.
What exists is a category of application that uses this promise to collect credentials. The roadmap of this guide is practical: first contain the damage, then close the doors.
Step 1: Regain control of the account
Do it in this order, and preferably from a device different from the one on which the app was installed.
- Change your social media password. Use a new password that is not used for any other service.
- Change the password for the linked email address. This is the step that most people skip, and it's the most important: whoever has the email can recover everything else.
- Close the other sessions. Instagram and Facebook list connected devices; disconnect anything you don't recognize.
- Review the authorized applications. In the security settings, there's a list of apps and websites that have access to your account. Remove any unknown items—that's often how access persists even after you change your password.
- Enable two-step verification. Prefer the authenticator app to SMS, which is vulnerable to SIM card swapping.
- Check the recovery email and phone number. If the attacker changed any of them, fix them before anything else.
Step 2: Clean the device.
- Uninstall the app.
- Review the permissions granted, paying special attention to accessibility and the device administrator. No social networking app needs both of those.
- Run a scan with Play Protect or a known antivirus program.
- Restart your device and check if any strange icons have reappeared.
Step 3: Cancel the subscription you may not even know you have.
Many of these apps charge a weekly subscription with automatic renewal, which is contracted during a three-day "free" trial. The amount is small enough to go unnoticed on the bill.
On Android, open the Play Store, tap your profile picture, go to Payments & Subscriptions, and review the list. On iPhone, go to Settings, tap your name, and then Subscriptions. Cancel any subscriptions you don't recognize, and if there were any incorrect charges, request a refund from the store itself.
If the account was used to scam your contacts
This is a common scenario: once they gain access, the intruder sends messages to their contacts asking for money via Pix (Brazil's instant payment system), usually with a story of urgency.
Notify your contacts through another channel—family group, phone call, story—as soon as you regain control of your account. If someone has already transferred funds, advise them to file a police report and notify the bank immediately, because there is a mechanism for disputing the transaction with a short deadline. Report the account used in the scam within the app itself.
Because the promise was false from the start.
It's important to understand this so as not to repeat it. The platforms do not expose who visited a profile on any available interface to external developers. A third-party application only accesses what the official API provides, and there is only aggregated data: reach, impressions, age range, and approximate location of the audience.
What's confusing is the list of views of stories, This is what Instagram actually shows. It only applies to stories, only for 24 hours, and only to posts from your own profile. It's not a visitor list.
How to identify the next one before installing
- It asks for social media login within the app itself, instead of using official authentication.
- Name with stalker, tracker, profile viewer or who viewed my profile.
- Screenshots displaying lists of names and photos of "visitors".
- Recent reviews complaining about charges or hacked accounts.
- Privacy policy absent, generic, or hosted on a free domain.
A ten-second verification process resolves the issue: if the app asks for your password to function, it's the problem, not the solution.
What can you really track?
If you're curious about who's interested in your content, convert your profile to a professional one in your Instagram or Facebook settings. At no cost and without installing anything, you'll be able to see accounts reached, traffic sources, age range, city, and peak activity times of your audience—as well as saves and shares, which measure real interest much better than a profile visit would.
SEE MORE:
- App that takes a photo of who entered the wrong password on your phone.
- Application that unlocks your cell phone by voice
- Safe apps for chatting with people nearby.
How a login slips out of your control without you realizing it.
Understanding the mechanism helps avoid repeating the mistake. The most common scam is the fake login screen: the app opens a page that mimics the social network's page, you enter your username and password, and this data goes to a third-party server before anything happens. The next screen may even show your real feed, because the service accessed your account in the background.
There is also the legitimate way, called social login authorization, where the network opens its own official screen and only grants the application limited permission. The practical difference is significant: in this model you never type your password within the app, and you can revoke access later without changing anything. If a service asks for your password directly, it is outside the standard.
Once an attacker has the credentials, they often keep the session open even after you change your password, because the already authenticated session remains valid until it is closed. Therefore, any recovery procedure includes disconnecting all devices, not just changing the password.
Permissions checklist before installing any social app.
The evaluation takes two minutes and avoids all the hassle. Before clicking install, look at these points on the app page and the first few screens:
- Who is the developer?Real name, own website, and other published apps. A newly created profile with only one app is a red flag.
- What permissions does he request?A statistics app doesn't need contacts, SMS, a phone, or accessibility.
- How does he log in?If the official network screen opens, that's fine; if it asks for a username and password in a separate field, give up.
- Data policyIt needs to exist, be in Portuguese or another legible language, and state what is collected and with whom it is shared.
- Ad volumeA full-screen ad that appears on every tap indicates an app that relies on impressions, not service.
- Size and offline functionalitySimple tools tend to be lightweight; a small app that requires an internet connection for everything is processing your data on someone else's server.
It's also worth checking the store's own data security section, where the developer declares what it collects. A vague statement or one that conflicts with the requested permissions is reason enough to look elsewhere.
Common mistakes after a health scare
The first mistake is changing the password and stopping there. Without logging out of active sessions, anyone who logged in remains logged in. The second mistake is reinstalling the same application, thinking the problem was a faulty version, when the problem is the business model. The third mistake is using the same new password across multiple services, which turns the next data breach into a new incident.
Another common mistake is ignoring the email address registered to the account. If the hacker changed the recovery address, you need to recover the email first, then the social media account, in that order. And some people forget to warn their contacts: hacked accounts are used to ask for money and codes, and a quick warning in groups prevents friends from falling for the scam.
Finally, many people miss the charge. Apps of this type usually activate subscriptions during registration, and the bill only becomes noticeable months later. Check your active subscriptions in the app store and your card statement for the last three months.
What Android and iOS offer as standard features to protect your account.
On Android, Play Protect analyzes installed apps and blocks installations of known dangerous ones. Installation from unknown sources is disabled by default and should remain so, as this is the most common method used by apps that wouldn't pass the store's review. Permissions can be reviewed one by one in Settings, in the apps section, including accessibility permissions, which are the most frequently abused by malicious programs.
On iOS, Settings shows which apps have access to photos, contacts, location, and microphone, with the option of limited access instead of full access. Both platforms also offer location services and remote device locking, useful when the problem started with a lost phone.
Regarding the law: accessing someone else's account without authorization is a crime under Article 154-A of the Penal Code, and the improper handling of your personal data is grounds for a complaint under the General Data Protection Law. Filing a police report is particularly useful when the account was used to defraud third parties.
Frequently asked questions about hacked accounts and visitor apps.
Desinstalar o aplicativo resolve?
It helps, but it's not enough. Uninstalling stops local data collection and doesn't end open sessions or cancel the subscription. The complete process is to change your password, disconnect devices, revoke third-party access, cancel charges, and activate two-step verification.
Preciso formatar o celular?
In most cases, no. Formatting is only justified if persistent symptoms arise, such as ads outside of apps, icons reappearing on their own, or the inability to uninstall something. Before that, try removing the app using Android's safe mode and run a scan with Play Protect.
Alguma versão paga desses apps funciona?
No. The limit is technical, not commercial. No social network provides a list of who visited a profile through a public interface, so paying only transfers money to whoever invented the list.
Como saber se meus dados vazaram em outro serviço?
Android and iOS password managers warn you when a saved password appears in a known data breach, and your Google account provides the same warning in Security Checkup. This is a signal to change that password everywhere it has been reused.
