How to Fill Out the Instagram Account Recovery Form Step by Step

If you are panicking right now, the next steps are simple. In this guide, Talha Aslan and team walk you through the form step by step. We cover what information it asks for, the mistakes we see most often and what to do when no code arrives. For the bigger picture after a takeover, see our guide to recovering a hacked Instagram account. Here, we focus only on the form.

1. Stay calm and check the inbox of the email linked to your account.
2. If Instagram sent you a security email, use the link inside it first.
3. Then start the recovery flow at instagram.com/hacked.
4. Enter details that are really linked to the account.
5. Finally, follow the code or verification instructions exactly.

What should you do in the first five minutes?

The first five minutes matter, because attackers usually change the email and phone fast. So check your inbox first. When the account email changes, Instagram may notify the old address. That message can include a link to reverse the change. If you find one, use it before you touch the form.

Next, make sure your email account itself is safe. If the attacker also controls your email, every code Instagram sends goes straight to them. Therefore, change your email password and sign out of other sessions. Only then move on to Instagram.

• Check the inbox, spam and promotions folders.
• Look for unknown forwarding rules in your email settings.
• Keep your SMS inbox open and visible.
• Write down your username, old email and phone number on paper.

This prep keeps you from guessing while you fill out the form. In addition, it lowers the risk of restarting the flow again and again with wrong details.

Which address is the official Instagram account recovery page?

The official starting point for Instagram account recovery is instagram.com/hacked. In addition, the Instagram Help Center page for people who think their account was hacked sends readers to the same address. In other words, you never need a random site from the search results to reach the form.

This matters because people search for “Instagram support” in a panic. Some results look like Instagram and ask for your password. Others lead to social media profiles that promise to “unlock any account in one hour.” None of these are official.

The rule is easy. If the address bar does not show instagram.com or facebook.com/help, do not enter a password, a code or an ID. The help link on the Instagram app login screen also takes you to the same official flow. For example, tapping the option to get help logging in opens the recovery choices.

What information should you prepare before you start?

Gather the facts about your account before you begin. Instagram checks whether the details you enter match the account. That is why you need exact details, not guesses.

For example, if you created the account years ago with an old email, note that address too. Recovery sometimes runs through that first address. Also, remember which device you last used to log in. Applying from the same device and the same network often gives a more consistent picture.

How does the Instagram account recovery form work step by step?

The Instagram account recovery form has a few screens, and each one asks for one thing. Menu labels change over time. So we explain the logic of each step rather than exact button names. The flow usually runs in this order:

1. Open instagram.com/hacked.
2. Pick the situation that fits you, such as a hacked account, a forgotten password or lost access.
3. Enter your username, email or phone number.
4. If Instagram recognizes it, it sends a code or a login link.
5. Enter the code and set a new password.
6. If the code route is closed, Instagram may ask you to verify your identity.

So do not rush any step. A single typo in your username can lead you to another account. It can also trigger a “user not found” style message. If the attacker changed your username, searching for the old one may fail. In that case, the email or phone route is more reliable.

In short, treat the form as a matching exercise, not a test. Every detail you enter should match what the account holds.

Which option should you select?

Choose the option that honestly describes your situation. If someone got into your account, pick the hacked option. If you only forgot your password, pick the password option. The wrong choice sends you down an unsuitable path and wastes time.

For example, it is a different problem when your password is correct but you still cannot log in. We cover that in our article on recovery when the password is correct but login fails. On the other hand, if Instagram disabled your account for a rule violation, the hacked flow is the wrong place. That case calls for an appeal.

• Someone got in and changed the email: the hacked option.
• You forgot the password but still have the details: password reset.
• The account shows a “disabled” notice: the appeal flow.
• You lost your two-factor device: the backup code route.

Keeping these four cases apart is the simplest way to shorten the recovery.

Should you enter the username, email or phone number?

The safest choice is the detail you still control. If you can open your email, use the email. If your phone line is in your hands, use the number. The username finds the account, but it does not decide where the code goes.

Here is the catch. If the attacker swapped in their own email, the form may not find the account with yours. So in that case, try your phone number or username instead. Enter the phone number in international format with the country code, such as +1 for the United States.

Also, if several accounts share one email, the flow may ask which one you want back. Pick the right one by its profile photo and username. Requesting a code for the wrong account can delay the real one.

That way, you change only one variable per attempt. As a result, it becomes easy to see which detail works.

What if no code arrives during Instagram account recovery?

If no code arrives, wait first and then switch channels. Asking for many codes within a minute can make the system limit your requests for a while. So after one request, give it a few minutes and check your inbox and spam folder.

1. Check the spam, promotions and updates folders.
2. Check SMS blocking or filter settings on your phone.
3. Try the phone instead of email, or the other way around.
4. Wait a short while, then request one new code.
5. If no channel works, look for the identity verification option.

We explain this in detail in Instagram security code not received. If the problem is the password reset email, read our guide to a password reset email that never arrives. We will not repeat those here. Just keep one point in mind: if the code never reaches you, the contact details on the account are probably no longer yours.

When does Instagram ask for a video selfie?

If your account has photos that show your face, Instagram may ask for a short video selfie. In this step, you record a video that shows your face from different angles. Instagram then compares the video with the images on the account.

In practice, good light, a plain background and a steady hand make this easier. Do not wear a hat, sunglasses or heavy filters. Also, follow the on-screen prompts in order. If you skip the head-turn prompt, the recording may fail.

• Face a window or daylight.
• Hold the phone at face level.
• Follow the prompts slowly.
• Do not rush to send a second video after the first one.

If this step gets stuck, see Instagram video selfie verification stuck. If your face never appears on the account, this option may not show up at all. Then you move on to the other channels.

What are the most common mistakes on the form?

In practice, the mistakes we see most are not technical. They come from rushing. A panicked user sends the same form over and over and tries different details each time. In the end, the system sees an inconsistent pattern.

1. Misspelling the username or not knowing the new one the attacker set.
2. Entering an email that was never linked to the account.
3. Typing the phone number without the country code.
4. Requesting dozens of codes in one hour.
5. Using a different device and network on every attempt.
6. Recording the video selfie in poor light or with glasses.
7. Starting a new form without opening the link in the email you already got.

For example, imagine a user who applies from a café, then from home, then from the office. Each request comes from a new location. That pattern can look like an attacker. Therefore, apply from a device you used before and from a familiar network when you can.

What should you never do during Instagram account recovery?

Be suspicious of any shortcut during Instagram account recovery. Strangers who offer to “open your account” for money are not official. The same goes for accounts that offer fake ID documents and “support teams” that ask for your password. These routes are risky, and they break platform rules.

• Never send fake or borrowed documents; Instagram treats this as an attempt to get around its systems.
• Keep your password and every code to yourself.
• Never try to access someone else's account.
• Do not open a new account to dodge the process and keep the same identity going.

Also, watch out for emails that claim to come “from Instagram.” Some look official but are phishing. We show how to tell them apart in is the Instagram account disabled email fake. In short, the official flow is the only safe channel. Nobody can guarantee a result.

How does the form change when two-factor authentication is on?

With two-factor authentication on, a new password alone is not enough. You also need to pass the second step. That step asks for a code from an authenticator app, an SMS code or one of the backup codes you saved.

If the attacker set up two-factor on their own device, things get harder. In that case, the code route is closed to you and identity verification becomes the main path. On the other hand, if you set up two-factor yourself and only lost the device, backup codes can save you.

We cover backup code logins in lost your 2FA device: log in with a backup code. After you get the account back, create new backup codes and store them offline. That way, you may never need the form again.

How long should you wait after you apply?

Instagram does not promise a fixed response time for recovery requests. So we will not invent one either. On the code route, the result usually shows up right away. Identity checks, however, may take a while to review.

Sending the same request again and again does not speed things up. Instead, a new request may replace the old one and affect your place in line. So check your inbox regularly, confirm that messages really come from Instagram and follow the instructions as written.

• Write down the date and time of your request.
• Record the email and phone you used.
• Take a screenshot of every message you receive.

Specifically, these notes help you remember what you tried if the process drags on. Moreover, they let you brief a professional quickly if you ask for help.

When do you need an appeal instead of the hacked form?

If nobody hacked you, and Instagram disabled your account for a rule violation, the hacked form is the wrong door. In that case, the login screen usually shows a disabled notice with an option to appeal.

We explain the difference between deactivated, suspended and deleted accounts in this comparison. Choosing the right door saves more time than anything else.

What should you do first after you get the account back?

The moment you get back in is the moment to stop a second attack. The attacker may have left traces. So set aside a few minutes for a security check.

1. Set a strong new password you use nowhere else.
2. Confirm that the email and phone on the account are yours.
3. Log out of unknown devices in your login activity.
4. Turn on two-factor authentication with an authenticator app.
5. Create backup codes and keep them somewhere safe.
6. Clean up the list of connected apps and websites.

Then check your profile details, bio link and recent posts. Attackers often add harmful links to the bio or message your followers. A short note to your followers also helps you rebuild trust. For the device cleanup, see how to remove suspicious devices from Instagram login activity.

Is recovery different for business accounts?

The form is the same for business accounts, but linked assets make it messier. If the account connects to a Facebook Page, an ad account or a business portfolio, the attacker may have used those links too.

So after you get a business account back, review Accounts Center and the people with access to your business portfolio. Remove admins you do not know, check ad spend and confirm your payment methods. For example, an attacker may try to run ads in the short time they hold the account.

• Review the user list in your business portfolio.
• Check the latest campaigns in the ad account.
• Reconfirm the link between your Page and Instagram.

Meanwhile, keep customers informed through other channels while recovery runs. For what happens to ads when a business profile goes down, see Instagram business account disabled: what happens to ads.

When does professional help make sense for Instagram account recovery?

Most people can finish Instagram account recovery on their own. However, things change when the code route is closed or the video selfie fails. The same is true when the account drives real business revenue. Then a well organized process makes a difference.

At that point, Talha Aslan and team work only through official channels. We pick the right form, submit requests in a consistent order and track every reply. We do not deal in fake documents, rule-breaking methods or “inside contacts.” With our Instagram account recovery service, we manage the process through official channels. Still, Instagram makes the final call, and no recovery can be guaranteed.

For example, with a business account we first list which details the owner still controls. Then we choose the right flow and apply from one device with consistent details. We verify every incoming email and filter out fake messages. We also suggest a short-term contact plan so customers can still reach the business. As a result, the owner avoids panic moves, and the process stays on record.

In short, help is not about buying a result. It is about running a careful, patient process. Try the steps above yourself first.

Which device should you use during recovery?

If possible, use a phone or computer you already used to log in. Instagram can link requests from a familiar device and network to normal account use more easily. So rather than applying from a brand new phone, try to get hold of your old device.

Also, turn off any VPN during recovery. A VPN can make your request look like it comes from another country, which paints an inconsistent picture.

• If you still have your old device, update the app and start there.
• Choose a known network, such as your home or office Wi-Fi.
• In a browser, use a normal window instead of a private one.
• Keep the app and operating system up to date.

For example, if you used the same phone for years, that phone can be a useful reference. In short, consistency is a quiet but powerful part of every recovery step.

How can you tell if an email from Instagram is real?

Many messages may land in your inbox during recovery, and some may be fake. Instagram offers a section in the app where you can see emails it sent you recently. So if a message looks suspicious, check the app's security settings before you click anything.

Fake messages usually create urgency, such as “act within 24 hours or your account will be deleted.” They also ask you to type your password or code into a form. The official flow, by contrast, asks for the code on its own screen. It never asks for your password by email.

• Read the sender's domain name carefully.
• Hover over the link to see the real address.
• Watch for typos and odd wording.

When in doubt, do not open the message. Instead, type instagram.com/hacked into your browser yourself. That way, you almost remove the risk of giving details to a fake page.

How do you protect your followers while recovery runs?

While someone else holds your account, your followers are at risk too. Attackers message friends from hijacked accounts, ask for money or share fake promo links. That is why telling the people around you is an important step.

For example, post a short notice on another network, in a messaging status or to your email list. Say that the account is not under your control right now. Ask people not to reply to its messages and never to send money.

• Tell close contacts that your account was taken over.
• Ask followers to report the hijacked profile.
• If you run a business, add a short, calm note to your website.

Also, if the attacker opened a fake account in your name, report it separately. We explain how in how to report an Instagram impersonation account. This limits the damage to your reputation while you wait.

What options are left if recovery fails?

If every step fails, honesty matters: some accounts do not come back. Still, check a few things before you give up.

• Can you still open your original email address?
• Can you get back the phone line you used to create the account?
• Does the account have a photo that shows your face?
• Is there an unopened message from Instagram in your inbox?

If you answer yes to any of these, try the flow again with that detail. On the other hand, if you plan to open a new account, read the rules first. Creating a new account to replace a disabled one can lead to new restrictions. We explain the risk in what happens if you create a new account after a ban.

How do you prevent the next attack?

The best recovery is the one you never need. So once you are back in, put lasting protections in place. Most take a few minutes and protect you for months.

1. Use a long, unique password just for Instagram.
2. Turn on two-factor with an authenticator app instead of SMS.
3. Store backup codes offline.
4. Turn on two-factor for your email account as well.
5. Ask your mobile carrier about extra protection for your number.
6. Check the sender before you click links in any message.

Also, run the security checkup in the app from time to time. If the account is critical for your business, give team members their own access and stop sharing the password. For example, grant your agency access through the business portfolio rather than sending it a password. Then a single mistake cannot put the whole account at risk.

What should you remember when you fill out the form?

To sum up, the Instagram account recovery form is your strongest tool when you fill it out calmly and with correct details. Use the official address, choose the right situation, enter details that belong to you and follow every instruction.

• Use only instagram.com/hacked and official help pages.
• Check your email for a security link first.
• Do not request codes over and over; switch channels.
• Record the video selfie calmly in good light.
• Stay away from anyone who sells a guaranteed result.

If the process is stuck and the account is critical for your business, learn more about our Instagram account recovery support. We use official channels, give you an honest picture and never promise a guaranteed result. Whichever path you take, the first step belongs to today.

Core guide: What Is Digital Marketing? Its types, examples and how it is done, on one page with an interactive film that travels through the brain.