Instagram Account Hacked: How to Recover It Step by Step

Instagram account hacked: what should you do first?

Instagram account hacked? Open the official recovery page at instagram.com/hacked and ask for a login link or security code on the email or phone tied to the account. If you can still sign in, change the password and turn on two-factor authentication right away. Never pay anyone who promises to "get it back."

In an Instagram account hacked emergency, panic is the most expensive mistake. So work through the steps in order. The sequence below follows the flow described in the official Instagram Help Center page.

1. If you can still log in, change your password immediately.
2. If you cannot, request a login link from the official recovery page.
3. Check your inbox for an Instagram message saying your email address changed.
4. Secure every other account that shares the same password.
5. Warn friends and customers not to trust messages from your account.

Staying calm and following this order raises your chances. However, no method guarantees an outcome, because the final decision always belongs to Instagram.

How do you know your account was really hacked?

Not every login problem is a hack. Sometimes you mistype a password, and sometimes the app simply glitches. Still, a few signs together point to a real takeover.

• Your email address or phone number changed and you did not change it.
• Your password no longer works, or the app says the account cannot be found.
• Posts, stories, or messages you never sent appear on your profile.
• You get login alerts from devices you do not recognize.
• Your username, bio, or profile photo changed without you touching them.
• New accounts appear in your following list.

For example, a single odd email is not proof by itself. On the other hand, a message saying your email address was changed deserves immediate attention, because attackers usually replace recovery details first.

When you are unsure, err on the side of safety. Changing your password and adding extra protection never hurts, even if the account turns out to be fine.

What if you can still log in to your hacked Instagram account?

If you can still sign in, time is on your side. The attacker may keep a session open. Therefore you need to close the door first. Instagram's help pages point the same way: change the password, turn on two-factor authentication, and verify your contact details.

1. Choose a long, unique password that you have never used anywhere else.
2. Turn on two-factor authentication, ideally with an authenticator app.
3. Confirm that the saved email address and phone number belong to you.
4. Review your login activity and sign out of devices you do not recognize.
5. Check connected apps and linked accounts, then remove anything unfamiliar.
6. Delete any posts, stories, or messages you did not create.

To generate a strong password, try our password generator. Then store the result in a password manager, so you never have to memorize it.

Instagram account hacked and locked out: how does official recovery work?

When you cannot get in, the only reliable path is Instagram's own recovery flow. According to the Help Center, you can ask Instagram to send a login link to the email address or phone number on the account. The forgot password option on the login screen is where that flow starts.

The logic is simple. First, you enter your username, email, or phone number, and Instagram sends a link or code to the saved contact. However, if the attacker changed those details, the messages may go to them. That is why extra verification steps exist.

Screen names and button labels change over time. So rely on the official Instagram Help Center page for hacked accounts rather than on any exact menu wording.

• Submit requests only through instagram.com or the app's own screens.
• Wait for the result of one request instead of opening many at once.
• Never share a security code with another person.

The outcome depends on Instagram's verification decision. Nobody, including our team, can promise to speed up or guarantee it.

Is that email really from Instagram? How can you check?

The most common trap after a hack is a fake email that looks like it came from Instagram. These messages push urgency, with lines like "your account will be removed" or "verify now." They send you to a fake login page, so you risk losing your password a second time.

According to Instagram's help content, the company contacts you about your account through the emails tab in the app's security area. That tab is the one place where you can confirm genuine messages. The exact menu name can change, so confirm the path on the official page.

• Look closely at the sender address, because lookalike domains often differ by one letter.
• Hover over a link to read its real destination before you tap.
• Do not open attachments that arrive with account warnings.
• Type the address into your browser yourself instead of tapping the link.
• Report the suspicious message to Instagram, then delete it.

In short, a message that does not appear in the in-app tab probably did not come from Instagram. Still, the current official instructions have the last word.

What is video selfie verification, and when does Instagram ask for it?

A video selfie is one way Instagram confirms that you are the real owner. According to the Help Center, if you request support for an account that has photos of you, you may be asked to record a short video while turning your head in different directions.

The goal, put simply, is to check that you are a real person and that you match the account. Instagram explains how it handles such data on its own privacy pages. If you have concerns, read that information at the source.

These mistakes come up often:

• Recording in poor light so your face is not clear.
• Trying to send someone else's photo or a pre-recorded video.
• Covering your face with a hat, mask, or sunglasses.
• Rushing through the instructions without reading them.

Using someone else's image breaks the rules and counts as an attempt to bypass the system. If the account is not yours, do not try this method. Apply only for your own account, with your own face.

The verification type also varies by account. So you may not be asked for a video at all. In that case, Instagram shows you a different option.

Instagram account hacked and the email address changed: what now?

Attackers often change the saved email and phone number first, so that reset messages go to them. According to the relevant Help Center page, if Instagram emailed you about an email change, you may be able to undo it through the security link in that message.

So check your old inbox right away. The security message may be sitting in spam. For details, read the official page for accounts whose email was changed.

1. Log in to your old email account and search for recent Instagram messages.
2. If you find the change notice, use only the official security link inside it.
3. If your email account was also taken over, recover that one first.
4. Once Instagram access returns, refresh every saved detail.

If your email account is compromised too, the order changes. In that case, follow our guide on how to recover a hacked Gmail account, because Instagram access often depends on the inbox.

What common mistakes make recovery harder?

The most damaging moves are well-meant actions that confuse the process. Sending several requests through different channels at once, for instance, can give the system inconsistent signals.

A new account is not a recovery method. Moreover, opening one to dodge a restriction breaks Instagram's rules. For a hacked account, the goal is to prove ownership of the account you already have.

How do you warn followers and contacts after your Instagram account hacked?

In an Instagram account hacked case, while the attacker holds the profile, your followers may trust messages sent in your name. Attackers know this, so they send lines like "I need money urgently" or "vote for me at this link" to scam your friends, so warning people matters as much as recovery.

If you cannot reach the account, use another channel. Call, text, or post from a different social profile to tell people what happened.

• Keep it short: "My Instagram account was taken over, please ignore messages from it."
• Ask people not to send money, codes, or clicks to anything from the account.
• Post an announcement from another account if you have one.
• Tell business partners and customers separately.

Once you regain access, share a brief note as well. That way you also warn anyone who received suspicious messages during the gap. For a business account, this note is the most natural way to protect trust.

What should you check in the first hour after you get the account back?

After an Instagram account hacked incident, regaining access is only half the job. The attacker may have left a back door, so you need to inspect the account piece by piece. Because of that, we suggest the following order for the first hour.

1. Change the password to a new one you have never used.
2. Verify that the email, phone number, and username are yours.
3. Sign out of all devices, then log in only on your own.
4. Check connected apps and linked accounts, and remove what you do not know.
5. Review posts, stories, messages, and comments, and delete anything you did not make.
6. Restore your profile details, link, and bio.

Next, look for a drop in engagement. Our Instagram engagement rate calculator helps you measure it. Spam sent during the hack can sometimes reduce reach, and our shadowban guide explains what to do about that.

How do you set up two-factor authentication and a strong password?

Two-factor authentication makes it much harder for an attacker to enter, even when your password leaks. At login, you need a second proof in addition to the password. So the safest option is usually an authenticator app, because the codes are generated on your phone.

SMS codes are better than nothing. However, they weaken if someone takes over your phone number. So choose an app-based method when you can, and keep your backup codes somewhere safe.

Follow these principles for a strong password:

• Use a different password for every service.
• Also make it long. A phrase of several words can beat a short, complicated string.
• Avoid guessable details such as birthdays, phone numbers, or your username.
• Use a password manager and never share its master password.

Also write backup codes in a notebook or store them in an encrypted vault. Do not leave a screenshot in your gallery. If someone steals the phone, those codes go with it.

Why do connected apps and login activity matter?

Getting into an account does not always require the password. A permission you gave to an app can keep some access open even after you change the password. That is why cleaning the connected apps list after recovery is essential.

Instagram's help content also suggests removing access for suspicious third-party apps and deleting unfamiliar links in the accounts center. Menu names may change, so check the current path on the official page.

Apps that sell followers, show "who viewed your profile," or promise automatic likes are especially risky. They ask for your login or request broad permissions. For example, a profile viewer app can hand your account to someone else with a single tap.

• Remove the permission of any app you have not used in recent months.
• End any session from a location or device you do not recognize.
• Change the password again after each removal.

Also, repeating this review every three months is a healthy habit.

Why should you never trust people who offer to get your account back?

People whose accounts were stolen are desperate, so they meet strangers online who say "I can get your account back." These people usually ask for money first, then an ID photo, and finally your password. As a result, you lose twice.

However, Instagram has no secret channel that requires you to pay for access to your own account. In fact, the official process is free and runs on the app's own screens. You can also read the help page for profiles that post unauthorized content.

• Still, anyone who demands payment up front is suspect.
• Most people claiming to be "an Instagram employee" are fake.
• Never send your password, security code, or ID photo to a third party.
• Stay away from anyone who offers a fix by logging in to someone else's account.
• Ignore anyone who asks for gift cards or crypto as payment.

Unauthorized access to an account breaks Instagram's rules and exposes you to new risks. Forged documents are just as forbidden. Methods like these count as trying to bypass the system, and they lower your chances of recovery.

What is the difference between a hacked account and a disabled account?

People mix up these two situations, yet the solutions differ. In a hacked account, someone else has taken control. In a disabled account, Instagram itself has suspended the account over an alleged rule violation.

If your account closed because of a rule violation rather than a hack, read our other article. We cover it there in detail: Instagram account keeps getting disabled, permanent fix. We will not repeat it here.

Instagram account hacked and it is a business profile: what changes?

The risk grows for business accounts, because the account is not just a profile. It is also customer communication and advertising infrastructure. Once inside, an attacker can message your customers, change your shop details, or try to reach your ad account.

If your business profile connects to a Meta business asset, check two places. One is Instagram access, and the other is business manager permissions. If you lost access there, see our guide on losing access to a Meta business account.

• Review payment methods and authorized people on the ad account immediately.
• Remove admins or partners you do not recognize.
• Consider pausing running campaigns for a short time.
• Check your bank statement for charges you did not make.

If you suffered a financial loss, contact your bank. This article is not legal or financial advice, so talk to a qualified professional about serious damage.

How does a hack affect your reputation, and how do you protect it?

A hacked account can shake follower trust. If the attacker posted inappropriate content or sent scam messages to your audience, you have to repair that afterward. So act quickly and openly to keep the damage small.

First, remove the harmful content. Then post a short statement. You do not need detail; saying that the account was compromised and is now secure is enough. Also, sharing technical specifics or blame adds nothing.

Reputation problems can also spread to other channels. For example, angry customers may leave negative reviews on your Google profile. In that case, the steps in our guide to reporting fake Google reviews may help.

• Reply to customer messages briefly and politely.
• Contact people who received the scam messages one by one.
• Return your content schedule to normal over the next few weeks.

Also expect views and engagement to dip for a while. Do not panic. Instead, a few weeks of steady, rule-following posts usually restore the balance.

What are the most common ways accounts get hijacked?

Most cases of an Instagram account hacked come from human behavior, not technical flaws. Attackers rarely need sophisticated tools. Getting you to type your password into the wrong page is enough, so knowing the usual routes is half the defense.

• Fake login page: A page that looks like Instagram sends your password straight to the attacker.
• Reused password: A breach on another site exposes your Instagram password too.
• Shady app: Apps that promise followers or likes ask for your login.
• Stolen email: If an attacker enters your inbox, the reset link goes to them.
• Social engineering: Someone posing as a friend asks for a code or a vote link.

For example, a message saying "you are in a photo contest, vote for me" is a classic trap that leads to a fake login page. Even if the message comes from someone you know, their account may be compromised. So confirm any request for a code through another channel first.

This is not about blaming you. Experienced users fall for these tricks too.

How can you spot a fake login page?

Fake pages look very much like the real one, but the address bar gives them away. Checking the browser address before you type credentials takes seconds and stops most attacks.

• Check that the address ends exactly in instagram.com; extra words and extra letters are warning signs.
• Open the app directly instead of tapping a shortened link in a message.
• Stop if a page asks for your security code together with your password.
• On a phone, long-press the link to preview its real address.

If you realize you typed your password on a suspicious page, change it at once in the official app. Then review login activity and remove unknown devices. Also change the password everywhere you reused it.

In short, security often comes down to one correct tap. When in doubt, trust the app itself rather than the link.

What can you do if you cannot recover the account?

Sometimes the account does not come back despite every attempt. That is a hard outcome, but preparation limits the damage. Do not give up before the official process ends, and build a parallel safety plan at the same time.

1. Wait for the result of your official request and answer follow-up messages only through the official channel.
2. Separate other services tied to the account, such as ad accounts and payment methods.
3. Tell customers and followers about a different way to reach you.
4. Update the Instagram link on your website and email signature for now.
5. If you open a new account, treat it as a continuity plan and not as a substitute for recovery.

Opening a new account is not forbidden. What breaks the rules is using one to evade a restriction. A hacked account is different, because the old one still belongs to you. So open a new account only to keep in touch.

Also, back up your photos and videos regularly. A personal archive is a big advantage in a loss like this.

How do you protect accounts shared with family or staff?

Accounts with several users are only as strong as the weakest person. One employee's infected phone can put the whole account at risk. So separate access by person wherever you can.

A common mistake in small businesses is everyone knowing the same password. When an employee leaves, the password stays the same, and that person keeps access. Instead, grant access per person and remove it the same day someone leaves.

• Do not share the password in messaging apps.
• Ask everyone who manages the account to use two-factor authentication on their own device.
• Limit admin rights to those who truly need them.
• Review the list of authorized people every three months.

Then build a similar routine for the accounts of children and teens. Talking through security rules together works better than banning things. A password manager and two-factor authentication apply to these accounts as well.

How long does recovery take?

We cannot give an exact time, because it depends on Instagram's verification decision, the state of the account, and the details you provide. For example, some users return within a short time through an email link, while others wait for extra verification.

There are useful things to do while you wait. Instead of opening new requests and muddying the process, do the following.

• Check your inbox, including spam, on a regular basis.
• Avoid switching the device or network you used for the request.
• Keep the details in your support request consistent.
• Review the security of your other accounts.

If recovery drags on, you may consider opening a new account to keep your work going. However, that does not solve the old account, so your effort to recover it should continue. Always check current processes and expectations on the official Help Center.

When can our team help?

Recovering an Instagram account is Instagram's own process, and nobody outside can bypass it. Still, you may need a guide to understand where you stand, prepare the right information, and set up security afterward.

As Talha Aslan and team, we help you stay within the official flow. We give no guarantee of results, because the decision is not ours. You can read about our scope on the Instagram account recovery service page.

Examples of support you can ask for:

• Clarifying the order of the official recovery steps.
• Checking that the details in your application are consistent.
• Setting up security and access after recovery.
• Reviewing roles and payment safety on business accounts.

We never ask for your password or security code. If someone does, they are not us and they are not Instagram.

What is a lasting checklist to keep your account from being hacked again?

Recovery ends, but security does not. The list below lowers the chance of a repeat. Because of that, once you set everything up, reviewing it a few times a year is enough.

1. Use a unique, long password for every account.
2. Keep two-factor authentication on, preferably app-based.
3. Protect your email account with the same care.
4. Install apps only from official app stores.
5. Check the address before you tap unfamiliar links.
6. Review login activity and connected apps every three months.
7. Give people their own access on shared business accounts.

Also set one security rule for everyone who shares the account. For example, use permissions instead of sharing passwords, and remove a departing employee's access on the same day.

Security habits feel boring, yet they are the cheapest way to protect your account. After you set them up, the rest is regular checking.