How to Recover a Hacked Instagram Account

By

Last updated: October 8, 2026

Decision tree for recovering a hacked Instagram account: security email, login link, then support request with identity check

Finding that your Instagram password no longer works, that the email address on the account has changed, or that strange posts and messages are going out under your name is stressful. The important thing is to act in a sensible order, because the path you can use depends on whether you can still sign in.

This guide walks through both situations: you can still get in, and you are locked out. It also covers how to secure the account afterward and how to avoid the "recovery services" that make things worse. Menu names in the Instagram app change from time to time, so where wording may differ, this guide describes the option generically and points you to Instagram's own Help Center. Instagram also has a dedicated page for hacked accounts at instagram.com/hacked, which you can open in a desktop or mobile browser.

One more naming note: Instagram's Help Center says Meta is gradually moving people to Meta Accounts, so you may see either "Accounts Center" or "Meta Account settings" as the place to manage your account settings.

Signs Your Instagram Account Has Been Hacked

  • You are suddenly logged out and your password is rejected.
  • You receive emails saying your email address, phone number or password was changed, and you did not do it.
  • You get login codes or "was this you?" alerts that you did not request.
  • Posts, stories, comments or direct messages you did not create appear on your profile.
  • Your username, bio, profile photo or linked accounts have changed.
  • Friends tell you they received odd links or requests for money from you.

Quick Guide: Which Recovery Route to Use

What happenedWhat to try first
You got an email saying your email address was changed"Secure my account" in the message from security@mail.instagram.com
Password changed, but you still control the email or phone on the accountForgot password? → Send login link
Email and phone both changedRequest support from a mobile device, then identity verification
You can still log inStep 2: change password, review logins, turn on 2FA

Step 1: Check Your Email for Security Messages

Before doing anything else, open the inbox of the email address linked to your Instagram account. Instagram's Help Center says that if you received an email from security@mail.instagram.com telling you your email address was changed, you may be able to undo the change by selecting secure my account in that message. Use that option quickly if it is genuine. If other details, such as your password, were also changed and you cannot switch the email back, request a login link or security code instead (Step 3).

Be careful here. Scammers also send fake "your account has a problem" emails. Only trust a message if it comes from that exact sender address, or if you can confirm it in the app under your account's security or login activity pages, or by opening Instagram's official site yourself rather than following a link in the email.

Step 2: If You Can Still Log In

If you can still open the account, treat it as an emergency clean-up:

  1. Change your password immediately. Go to your account settings, find the password and security section, and choose a long, unique password that you have never used elsewhere.
  2. Review login activity. In the security or Accounts Center (or Meta Account settings) area, look for a list of devices and locations where you are logged in. Log out of any you do not recognize.
  3. Check the email and phone number listed for the account. If anything looks unfamiliar, replace it with your own and remove the other.
  4. Turn on two-factor authentication (see the section below).
  5. Review connected apps and websites. Remove third-party apps you do not recognize or no longer use, since some may keep access to your account. Also check Accounts Center and remove any linked accounts you do not recognize, as Instagram's Help Center advises. Our guide on checking which devices and apps have access to your account covers this in more detail.
  6. Delete suspicious posts and messages the intruder sent, and warn friends not to click links that came from you.

Professional or creator account? Instagram's Help Center has separate guidance for professional accounts where you can still log in but a hacker is still taking actions on the account. Follow that official path from the hacked-account help page if changing your password does not stop the activity.

Step 3: If You Are Locked Out

If your password no longer works and you cannot get in, use the official recovery routes from the login screen on your phone, ideally the device you normally use for Instagram, on your usual home network.

  1. Request a login link. Instagram's Help Center describes the current flow: on the login screen, tap Forgot password?, enter the username, email address or phone number on the account, tap Send login link, complete the captcha, then tap Next. Open the link in your email or text message and follow the instructions.
  2. Try the trusted device. Recovery often works best on a phone or computer that has previously logged into the account, because Instagram recognizes it.
  3. If the login link does not work, Instagram says you may be able to request support from a mobile device. When asked, enter a secure email address that only you can access. Instagram then sends next steps to that address.
  4. Identity verification. Instagram's Help Center says that for accounts with photos of you, you may be asked to record a video selfie turning your head in different directions; for accounts without photos of you, Meta's support team emails you and asks for the email address or phone number you signed up with and the type of device you used at sign-up (for example iPhone, Android or iPad). Follow only the instructions shown inside the official app or Instagram's own website. The Help Center says the video is never shown on Instagram and is deleted within 30 days, and that if your identity could not be confirmed from the video, you can submit a new one for review.
  5. Be patient. Decisions may take some time. Check the email associated with your request, including spam folders, for a response.

If you search for help, open only results on instagram.com or help.instagram.com, or type instagram.com/hacked yourself. Check the address before typing anything.

Step 4: Lock Down the Account

Facebook accounts are hacked in similar ways, so see how to recover a hacked Facebook account as well.

Enable two-factor authentication

In the security settings, find the two-factor authentication option. You will normally see a choice between an authentication app, text messages, and in some cases a security key. Our guide to SMS vs app vs security key compares them and explains how to keep backup codes safe. An authenticator app such as Google Authenticator, Microsoft Authenticator or an open-source alternative is generally stronger than text messages, because SIM-swap fraud can redirect SMS codes. Write down or securely store the backup codes if Instagram offers them.

Secure the email account behind it

If an attacker got into your Instagram through your email, changing the Instagram password is not enough. Change the email password, enable two-factor authentication there, and check its forwarding rules and recovery options for anything you did not set up. If it is a Gmail address, follow our steps to recover and secure a hacked Google account.

Use a unique password

Reusing a password across sites is a common reason accounts fall. A password manager can generate and remember a unique password for Instagram and everything else.

Review linked accounts

If Instagram is linked to Facebook or another Meta account, check those accounts too, since an attacker may reach more than one profile.

Recovery Scams to Avoid

Once you post about being hacked, scammers may offer help. Be cautious:

  • Nobody can legitimately "recover your account for a fee" through a private direct message or a random website.
  • Do not send your password, login codes or a copy of your ID to anyone claiming to be Instagram support in a direct message.
  • Do not follow links from unknown accounts that promise instant recovery.
  • Be suspicious of any request to pay with gift cards or cryptocurrency.

Instagram's real recovery process happens inside the app and through its official Help Center, not through third-party middlemen.

If You Cannot Get the Account Back

This can happen, especially with older accounts that have no working email or phone number. You can:

  • Keep trying the official route from a recognized device over the following days.
  • Tell followers on your other platforms that the account is compromised, so they do not trust its messages.
  • Report the impersonating account, if the hacker is using it, from a friend's account using the report options.
  • If it was a business account, tell customers and check any linked ad or payment accounts.
  • Start a new account with strong security from the start.

If you lost money or someone is threatening you with private images, stop communicating with them, keep screenshots, and report it to your local police and to the FBI's Internet Crime Complaint Center (IC3), and to the FTC at ReportFraud.ftc.gov.

Frequently Asked Questions

How did my Instagram account get hacked?

Common causes are a reused password leaked in another breach, a phishing message or fake login page, a hacked email account, or a third-party app with too much access. Often you cannot tell exactly which. Fix all the weak points.

Can I recover it if the hacker changed my email?

Often, but not always. Check the old email inbox for a message with a way to revert the change, then follow the official "hacked account" options. Verification may be required.

Is it safe to submit a selfie video to Instagram?

Only if you are inside the official app or on Instagram's official site. Never send verification photos or videos to someone who messages you claiming to be support.

Should I delete my account after being hacked?

Usually not immediately. Deleting may remove your chance to regain the content. Try recovery first.

Will two-factor authentication stop this happening again?

It greatly reduces the risk from stolen passwords, but not from every trick. Stay alert to phishing, especially messages asking you for codes.

Related Guides

Conclusion

Recovering a hacked Instagram account comes down to acting in the right order: check your email for security notices, use the official recovery flow from a trusted device, and then rebuild security with a unique password and two-factor authentication. Avoid anyone who charges to "hack it back" for you. Once you are in, spend ten minutes reviewing login activity and connected apps so the same door cannot be used twice.

Comments

Post a Comment

Popular posts from this blog

How to Tell If Your Email Has Been Hacked and What to Do

By
Image
Last updated: October 8, 2026 Your email account is the master key to almost everything else you own online. Bank alerts, shopping receipts, social media logins and "forgot password" links all land in your inbox. If someone else gets into it, they can often reset the passwords of your other accounts too. That is why spotting a hacked email account quickly matters so much. This guide shows the common warning signs, how to check whether someone has really been in your account, and what to do, in order, if they have. It covers Gmail, Outlook, Yahoo and iCloud Mail, with links to each provider's official help page. Common Signs Your Email May Have Been Hacked No single sign proves a break-in, but several together are a strong hint. Watch for these: Friends say they received strange messages from you. Links, "urgent" requests for money or odd attachments sent to your contacts are a classic pattern. Sent folder items you did not write. Sometimes attackers d...
Read more

How to Create a Strong Password You Can Actually Remember

By
Image
Last updated: October 8, 2026 Most of us know we should use strong passwords, yet we still end up with "Summer2024!" or the same password on ten websites. The reason is simple: strong passwords seem impossible to remember. The good news is that a strong password does not need to look like random noise. Length matters more than complexity, and there are easy ways to make long passwords memorable. This guide explains what actually makes a password strong, what the current US government guidance says, how to build a password you can recall, how to check whether your existing passwords are weak or leaked, and when to hand the job over to a password manager. What Makes a Password Strong? Attackers rarely sit and guess by hand. They use software that tries huge numbers of guesses, starting with the most common passwords, known leaked passwords and predictable patterns. The Cybersecurity and Infrastructure Security Agency (CISA) sums up a strong password with three tips, and ...
Read more