Instagram alerts you when someone tries to log in to your account from a device or web browser it doesn't recognise. With two-factor authentication on, these login requests show which device tried and where it is, and you can approve or deny them. Check the attempt under Where you're logged in (or Login activity): if it was you, choose This Was Me; if not, choose This Wasn't Me and reset your password, which logs every other device out. An alert alone doesn't mean the account is lost, and a password reset email you didn't ask for can simply be someone mistyping their own details. Be wary of the emails themselves: fake "suspicious login" messages are a common phishing trick.
What the alert means
Instagram describes these warnings as login requests. When you've set up two-factor authentication, you get an alert whenever someone tries to log in to your account from a device or web browser Instagram doesn't recognise. The alert can arrive as a push notification, in your Activity or as an in-app notification, and it tells you which device tried to log in and where it's located. You can approve or deny it straight away.
"Doesn't recognise" covers more than strangers. A new phone, a browser you haven't used before or a login after clearing your browser can also be unfamiliar to Instagram. What matters is whether you recognise the device and the place.
How to check the login
You can see devices that recently logged in to your account at any time.
- In the app, go to your profile, open the Menu and look for Where you're logged in under Password and security in Accounts Center. On a computer, select More, then Settings, then Password and security, then Where you're logged in.
- If your account still shows the older layout, open Security, then Login activity.
- If you recognise the login, select This Was Me, then Confirm.
- If you don't recognise the device or location, select This Wasn't Me and follow the on-screen instructions to reset your password and secure your account.
Instagram notes that you may not see these two options if there hasn't been a login from a device or browser it doesn't recognise. In that case you can still log out of any device in the list.
Approve or deny a login request
Tap the notification to see the location and type of device. Tap Approve if you recognise it, Deny if you don't. When you deny a request, Instagram asks you to reset your password, so that anyone trying to get in with your current password no longer can.
You can turn these requests on or off under Security, Two-factor authentication, Additional methods, Login requests. To receive them you may need to allow push notifications from Instagram.
A password reset email you didn't ask for
A related scare is an Instagram password reset email you never requested. Instagram says this doesn't necessarily mean your account has been hacked: someone trying to log in to their own account may have mistyped their email address or username and entered yours. Only people who know your password or who click the login link in that email can log in.
So don't click the link if you didn't ask for it. If you're worried, open the Instagram app yourself, change your password and turn on two-factor authentication.
Fake "suspicious login" emails
Alert emails are a favourite phishing disguise, because they make people act fast. Before you click anything:
- Check the sender. Instagram says official security emails only come from @mail.instagram.com, @support.instagram.com, @facebookmail.com, @support.facebook.com and @global.metamail.com.
- Check Recent emails in your settings. Instagram shows the official emails it sent you in the last 14 days, with security and login emails listed separately. An alert that isn't there didn't come from Instagram.
- Remember that Instagram never contacts you about profile security through Direct messages.
More examples: how to spot fake Instagram emails and DMs.
What to do, by situation
| What you see | Likely meaning | What to do |
|---|---|---|
| A login request for a device you just used | You on a new phone or browser | Approve it, or select This Was Me |
| A login request you don't recognise | Someone may know your password | Deny it, then reset your password |
| A password reset email you didn't request | Possibly someone mistyping their own details | Don't click the link; change your password in the app if you're worried |
| An alert email that isn't listed under Recent emails | Probably phishing | Don't click anything; delete it |
| You suddenly can't log in | Someone may have taken over the account | Go to instagram.com/hacked |
If it wasn't you
Treat a login you don't recognise as a sign that your password is known to someone else. Instagram warns that this can happen when you use the same password on another site that suffers a data breach, or when your account is linked to an unauthorised third-party app. While you can still log in:
- Change your password. Instagram logs you out of all other devices when you do.
- Turn on two-factor authentication.
- Confirm that the email address and phone number in your settings are still yours.
- Check Accounts Center and remove linked accounts you don't recognise.
- Revoke access for any suspicious third-party apps.
If posts, comments or messages appear that you didn't send, read Instagram posting things you didn't. If the email on the account has already been changed, see how to undo an email change. If you can't get in at all, follow our hacked-account guide.
Frequently asked questions
Does a suspicious login attempt mean my Instagram was hacked?
Not necessarily. Instagram flags logins from devices or browsers it doesn't recognise, which can be you on a new phone. If you don't recognise the device or place, deny the request or select This Wasn't Me and reset your password.
Should I tap This Was Me or This Wasn't Me?
This Was Me if you recognise the device and location, then Confirm. This Wasn't Me if you don't: Instagram then walks you through resetting your password and securing the account.
Why do I get login alerts when it's me?
Instagram alerts you about devices and browsers it doesn't recognise, so a new phone, a different browser or a cleared browser can trigger one. Confirm it with This Was Me. If the alerts name devices you don't own, change your password.
Is an email about a suspicious login attempt real?
Check the sender's domain and look under Recent emails in your Instagram settings, which lists the official emails from the last 14 days. If the email isn't there, treat it as phishing and don't click.
Not sure whether someone got in?
Tell us what the alert said and what you see in your login activity. We'll check your case for free and tell you which official steps fit. We never ask for your password or any code.
Sources
- Turn login requests on or off on Instagram (Instagram Help Center) help.instagram.com
- View your recent Instagram login activity (Instagram Help Center) help.instagram.com
- Why you received an Instagram password reset email that you didn't request (Instagram Help Center) help.instagram.com
- Review recent emails sent from Instagram (Instagram Help Center) help.instagram.com
- Why Instagram tells you your account is at risk (Instagram Help Center) help.instagram.com
- If you think your Instagram profile has been hacked (Instagram Help Center) help.instagram.com