Move fast. First look for Instagram's security email about the change and use its link to secure your account. If that doesn't work, go to instagram.com/hacked from a phone or computer you've used before and follow the steps. Expect an identity check such as a video selfie. Once you're back in, change your password, turn on two-factor authentication and log out every device you don't recognise.
Signs your account was hacked
- You were logged out and your password no longer works.
- You received an email saying your email address, phone number or password was changed, and it wasn't you.
- Posts, stories or messages appeared that you didn't create. Crypto "investment" posts are a classic.
- Two-factor authentication was switched on or changed by someone else.
- Friends tell you "you" sent them strange messages asking for money or codes.
Step 1: Check your email for Instagram's security message
When the email address on an account is changed, Instagram normally sends a message to the old address. Genuine security emails come from security@mail.instagram.com and include a link to secure your account or reverse the change. If you find one, use it as soon as possible.
Step 2: Use Instagram's hacked-account flow
- Go to instagram.com/hacked, ideally from a phone or computer you've logged in from before, on a network you normally use.
- Choose the option that matches your situation: your account was hacked, you forgot your password, or someone is impersonating you.
- Instagram may offer to send a security code to an email address or phone number linked to the account. If the hacker changed both, choose the option that says you can't access them.
- Follow the steps exactly. If one route fails, don't start ten new requests in a row. Wait and try again calmly.
Step 3: Confirm your identity
If Instagram can't reach you through your old contact details, it may ask you to prove the account is yours. For accounts that show photos of you, this is usually a video selfie in which you turn your head in different directions. Other options may be offered depending on the account.
- Do it yourself, on your own device, in good light.
- Video selfies are used to check you're a real person and match the account's photos. Instagram says they're stored securely and aren't visible to other people on Instagram.
- Never send a video selfie, ID or code to a person in your DMs who claims they'll "submit it for you".
Step 4: Lock your account down once you're back in
- Change your password to a long, unique one you don't use anywhere else.
- Turn on two-factor authentication, preferably with an authentication app rather than SMS. Save your backup codes somewhere safe and offline.
- Check where you're logged in and log out of every device and location you don't recognise.
- Check your contact details: make sure the email and phone number on the account are yours.
- Review connected accounts and apps in Accounts Center and remove anything you don't recognise.
- Secure your email account too. If the hacker got into your email, they can take Instagram again.
Step 5: Warn your followers
Hacked accounts are used to scam friends and followers. Once you're back, post a story saying your account was compromised, that any messages asking for money or codes weren't from you, and delete posts the hacker published.
What not to do
- Don't pay "hackers" who say they can get your account back. They can't, and you'll often lose money and your remaining data.
- Don't share login codes with anyone, including people claiming to be from Meta.
- Don't negotiate with the hacker. Paying a ransom rarely gets the account back.
- Don't delete your old emails. Instagram's messages about the change may be your best way back.
If money was taken or someone is using your identity, report it to your local police or national fraud reporting service as well as to Instagram.
Frequently asked questions
What should I do first if my Instagram was hacked?
Look in your old inbox for Instagram's security email about the change. Genuine ones come from security@mail.instagram.com and include a link to secure the account or reverse the change. If there isn't one, go to instagram.com/hacked from a device you've used before.
The hacker changed my email and phone number. Can I still recover my account?
Often, yes. In the instagram.com/hacked flow, choose the option that says you can't access your email or phone. Instagram may then ask you to confirm your identity, usually with a video selfie if the account shows photos of you.
Should I pay the hacker, or someone who says they can hack it back?
No. Paying a ransom rarely gets the account back, and people offering to hack it back for you are scammers who often take your money and your remaining data.
How do I stop my account being hacked again?
Use a long, unique password, turn on two-factor authentication with an authentication app, keep your backup codes offline, log out devices you don't recognise and secure your email account too.
Stuck on a step?
Tell us what the hacker changed and where the recovery flow stopped. We'll tell you, for free, what's still possible. We never ask for your password or codes.
Sources
- If you think your Instagram profile has been hacked (Instagram Help Center) help.instagram.com
- Hacked Instagram account (Instagram Help Center) help.instagram.com
- What to do if the email for your Instagram account was changed (Instagram Help Center) help.instagram.com
- Review recent emails sent from Instagram (Instagram Help Center) help.instagram.com
- Why you might be asked to upload a video selfie to confirm your identity on Instagram (Instagram Help Center) help.instagram.com
- What happens to your selfie after you've sent it to Meta (Instagram Help Center) help.instagram.com
- instagram.com/hacked (Instagram) instagram.com