Instagram Email and Phone Number Changed by a Hacker? How to Recover

Panic makes people skip steps, so work through this list from top to bottom. Each step only matters if the one before it did not work. In other words, you do not need to try everything at once.

1. Open the inbox of your old email address, including spam and promotions.
2. Find the email change notice that comes from security@mail.instagram.com.
3. Tap the link in that notice that lets you secure your account, then follow the prompts.
4. If there is no notice or the link fails, request a login link from the login screen.
5. If the login link also fails, start the support flow at instagram.com/hacked.
6. When Instagram asks for an email for replies, give one that only you can access.

This guide covers one scenario only: a hacker changed both the email and the phone number. For the wider topic of stolen accounts and passwords, read our guide to recovering a hacked Instagram account.

Why do hackers change the email and phone number first?

The attacker wants to keep the account. Knowing your password is not enough for that, because you could simply request a reset link to your own email or phone and take the account back. So the attacker replaces your recovery channels within the first few minutes.

As a result, reset links now land in their inbox, not yours. Next, they often change the password, and sometimes they also tie two factor authentication to their own device. Meta lists a changed email address or password, and a changed name or date of birth, among the signs of a hacked account.

In short, swapping the email and phone is the most critical step of the attack. However, Instagram leaves you a way to undo that step through your old address. Speed matters here. The sooner you act, the less time the attacker has to touch other settings.

If this feels hard to handle alone, or the account drives revenue for your business, our team can help you work out which step fits your case through our instagram account recovery support. That said, most of the steps below are things anyone can do on their own.

How does the Instagram email change notice work?

According to the Instagram Help Center, two separate emails go out when someone changes the email address on a profile. The new address receives a message asking to confirm the change. The old address receives a message that lets you reject it. That second message exists for you.

The official page says the message to your old address comes from security@mail.instagram.com. It also says the message contains a special link that reverses the change and helps secure your account. In addition, Instagram states that it starts this process only after someone changes the email from the profile page, and that it does not change your email without your permission.

• New address: the attacker's inbox, which gets the confirmation request.
• Old address: your inbox, which gets the reversal link.
• Sender: security@mail.instagram.com.
• Purpose: reject a change you did not make and secure the account.

Therefore, if you still control your old inbox, you hold a strong card. The official page does not state how long the link stays valid. For that reason, we recommend using it right away.

How do you find and use the secure my account link?

First, search your old inbox. Typing mail.instagram.com into the search bar usually works. If the message is not in your main inbox, check spam, junk, promotions, and social tabs as well. Some email apps sort messages automatically, so the notice may sit in another folder.

Once you find it, tap the link inside. Instagram's help page describes this as the secure my account option. The exact wording on screen can vary by language and app version. After that, the screen may ask you to set a new password and review the account.

1. Open the link on a phone or computer you used with the account before, if possible.
2. Pick a new password you have never used anywhere else.
3. After you log in, check that the email and phone fields belong to you again.
4. Finally, log out of any sessions you do not recognize.

You can create a strong password with our password generator. The official help page also says that if the hacker changed the password too and you cannot undo the email change, you should request a login link or a security code.

How can you tell if the notice email is real?

Attackers know you are in a hurry, so they send fake security emails too. Because of that, confirm that a message really came from Instagram before you tap anything. The Instagram Help Center explains that official security emails come only to your email address, from a short list of domains.

• @mail.instagram.com.
• @support.instagram.com.
• @facebookmail.com.
• @support.facebook.com.
• @global.metamail.com.

On the other hand, the domain alone is not proof, since senders can spoof it. If you can still log in, there is a stronger check. Under Accounts Center, the sign in and security area shows a Recent emails list. According to the official page, it shows security and login emails from the last 14 days. Menu names can differ between accounts.

Also, Instagram states plainly that it never contacts you about your account security through Direct Message in the app. So a Meta support DM is almost certainly fake. For a similar trap, see our post on the fake Meta copyright violation message.

What changes if the phone number changed too?

Your phone number is the second channel for reset codes and login links. If the attacker replaced it with their own line, SMS codes now reach them. So getting the email back may not be enough on its own. You also need to fix the phone field as soon as you get in.

The official help page does not describe a separate reversal link for phone number changes. Therefore, when the phone changed, your main routes are the reversal link in your old email, the login link, and the instagram.com/hacked flow. Once you regain access, check that the phone and email in settings are correct, as the official page advises.

Example scenario: A boutique owner notices one evening that she cannot log in. The notice sits in her old inbox, and the link brings the account back. However, the phone field still shows a stranger's number. If she does not replace it right away, the attacker can try another reset over SMS.

If security codes never arrive, we cover the causes in our post on Instagram security code not received.

How does the instagram.com/hacked flow work if the link fails?

If there is no notice, the link does not open, or you lost access to your inbox, your next stop is instagram.com/hacked. Meta's official policy page also points users with hacked Instagram accounts to this address. You can open it in a desktop or mobile browser.

The flow usually starts by asking you to identify the account. You enter your username, email, or phone number. Then the system shows which options are open to you: a login link, a security code, or an identity check. The options on screen can vary with the state of the account.

1. Open instagram.com/hacked.
2. Choose the option that says your account was hacked.
3. Enter the detail that identifies the account.
4. For replies, give an email address only you can access.
5. Follow the instructions in the email you receive, and complete identity checks if asked.

Restarting this flow many times in a short window does not speed things up. Instead, each request can open a new thread and make tracking harder. Focus on finishing one request properly. Also, keep every email with a case number or subject line in a separate folder.

When do the login link and security code help?

A login link is a one time link that lets you in without your password. The official help page describes the steps. You tap Forgotten password on the login screen, enter your username, email, or phone number, pass the captcha, and receive the link by email or SMS.

Here is the catch. If the attacker changed both email and phone, the link can go to their channels. So the login link only helps if one recovery channel still belongs to you, or if you already reversed the email change. Otherwise, the official page sends you to the hacked accounts page.

If the login link fails, the official page says you can request support from a mobile device. In that request, use a secure email address that only you can access. Instagram then sends the next steps to that address.

If two factor authentication is on and you lost your device, backup codes come into play. We cover that in our guide on logging in with an Instagram backup code.

What information does Instagram ask for during identity checks?

What Instagram asks for depends on the account. The official help page separates two cases. If the account has no photos of you, Meta support may send an automatic reply. That reply can ask for the email or phone number you signed up with and the type of device you used at sign up.

• The email address or phone number you used at sign up.
• The sign up device type: iPhone, Android, iPad, or other.
• A secure email address for replies that only you can access.

If the account has photos of you, things differ. In that case, Instagram may ask you to record a video selfie while you turn your head in different directions. This way, the system can compare the face in the video with the photos on the profile.

That is why remembering your sign up details helps a lot. If you forgot which email you used years ago, search your old inboxes for Instagram's welcome message. That search often reveals the original address.

How does video selfie verification work?

Video selfie verification is a method Instagram uses to confirm that you own the account. The official page says Instagram never shows this video on the platform and deletes it within a set period. Check the current retention period on the help page itself.

A few practical habits improve your chances. For example, choose a bright spot, remove glasses, hats, or masks that cover your face, and follow the prompts without rushing. Also, holding the camera at face level usually helps.

1. Stand near daylight or in a well lit room.
2. Clean the front camera and center your face in the frame.
3. Turn your head slowly in the directions the screen asks for.
4. After you submit, check your email regularly.

According to the official page, you can submit a new video if Instagram cannot confirm your identity. If the screen freezes or keeps looping, run through the checklist in our post on video selfie verification stuck.

Instagram email and phone number recovery routes compared

The table below puts the four main routes side by side for a case where the hacker changed your email and phone. First, look at the condition in the second column. That way you do not waste time on a step that cannot work for you.

In short, the fastest route is the link in your old email. The other routes take longer, and the result depends on Instagram's review.

What if the hacker also took over your email account?

In some attacks, the hacker first breaks into your email account and then resets your Instagram password from there. In that case, even if the reversal notice reaches your inbox, the attacker can see it first and delete it. So you need to recover the email account before anything else.

The Instagram Help Center is clear here. Instagram cannot help you recover your email account, and it points you to your email provider's own recovery options. Providers usually ask for a phone number, security answers, or other details.

1. Recover the email account through your provider's official recovery page.
2. Change the email password and turn on two step verification.
3. Check forwarding rules and connected apps in the mailbox.
4. Then try the Instagram reversal link or a login link.

If you use Gmail, follow our guide to recovering a hacked Gmail account. The official page also notes that if you cannot access your sign up email and the account has no link to Facebook, Instagram may not be able to give you access.

Does it change things if the hacker also turned on two factor authentication?

Yes, it gets more complicated. If the attacker ties two factor authentication to their own device after swapping the email and phone, you need a code from their device even when you know the password. That scenario needs its own approach.

Still, the first step stays the same: try the reversal link in your old email and the instagram.com/hacked flow. The details differ, though, because the attacker now holds the device or app that makes codes. We walk through it in our post on what to do when a hacker turned on two factor authentication.

On the other hand, Instagram may also lock your account for a while after the attack. When Instagram sees unusual activity, it can ask for extra verification to protect the account. If you see that kind of warning, follow the steps in our guide on how to unlock a locked Instagram account.

In short, you need to know which scenario you face before you pick a flow. Write down the warning on screen and save a screenshot.

Which details actually help with recovery?

Instagram asks for only a few things during recovery. However, preparing them speeds things up. In our field experience, the most useful details are the ones that show, independently, that the account belongs to you. For example, the sign up email and sign up device fall into this group.

• The email address or phone number you used to create the account.
• The type of device you used when you first signed up.
• Instagram notices in your old inbox, especially the email change message.
• Photos on the profile that clearly show your face, for the video selfie.
• A secure email address that nobody else can access.

Some details do not help. Follower counts, the content of old posts, or how valuable the account is for you are not what the verification screen expects. Moreover, sending a photo of your ID to a place you cannot verify creates extra risk.

So share only what the official flow asks for, and only inside the official flow.

Why should you avoid people who offer to recover your account for money?

Right after a hack, people may show up in your comments or DMs promising to recover the account. They usually ask for a fee, your password, or your verification codes. We strongly advise against this path, because it often ends in a second scam.

The Instagram Help Center warns about people who claim to be from Instagram's security team and ask for your username or password. It also tells you never to share your password, ID number, or financial information. Accessing someone else's account or sending fake documents also breaks the rules and can make your case worse.

• Stay away from strangers who promise to recover the account for sure.
• Never share verification codes with anyone.
• Do not reply to accounts that DM you on behalf of Meta.
• Refuse payment requests, especially in crypto or gift cards.

We explain how this scam works in our post on fake Instagram account recovery services.

What should you check in the first 30 minutes after you get the account back?

Getting back in does not mean the job is done. The attacker may have left a back door before leaving. For that reason, spend the first half hour on a systematic check. The official help page recommends similar steps once you can log in.

1. Change your password again, or send yourself a password reset email.
2. Turn on two factor authentication and store the backup codes safely.
3. Confirm that the email and phone number in settings belong to you.
4. Remove any linked accounts you do not recognize in Accounts Center.
5. Revoke access for suspicious third party apps.
6. Log out of devices you do not recognize in your active sessions.

Then review your profile. Fix the bio link, name, or posts the attacker changed. It also helps to post a short story telling followers you got the account back, and that they should ignore messages from that period.

Example scenario: The attacker may have placed a crypto link in your bio. If you do not remove it, your followers can get hurt.

How do you protect your Instagram email and phone number from now on?

Lasting protection starts with solid recovery channels. Your Instagram email and phone number work like the keys to your account. So every account tied to them needs at least the same level of security as Instagram itself. Moreover, a weak email password leaves the door open no matter how strong your Instagram password is.

• Turn on two step verification for your email account as well.
• Use a separate, strong password for every service.
• Prefer an authentication app and store backup codes offline.
• Check your security emails regularly.
• Do not tap links in messages that try to create panic.

In addition, using passkeys on services that support them lowers the risk of password theft. We explain how they work in our post on what a passkey is. Put simply, you build two layers: a strong email account and a strong Instagram account.

On the phone side, consider the line security options your carrier offers. That makes it harder for an attacker to move your number to another SIM card.

What should you watch for if a business account was hacked?

For professional or business accounts, the risk goes beyond access. The attacker can also change the linked ad account, shop settings, or contact buttons. Therefore, along with the recovery steps, check the business assets tied to the account.

• Review ad payment methods and recent spending.
• Check the contact email, phone, and website link on the profile.
• Go through the list of staff and agencies with access.
• Tell customers to ignore messages that ask for payments or orders.

The official help page points professional accounts where a hacker is still taking actions to a separate help article. So if you run a business account, read that page as well and follow its steps in order.

Which mistakes should you avoid during recovery?

Some panic moves make the process longer. For example, sending several requests from several devices at the same time makes tracking harder. Also, trying to bargain with the attacker over DM rarely works and can leak more information.

• Do not delete the notice in your old email, because the reversal link lives there.
• Never give an email the attacker can access in your verification request.
• Do not open a new account and pose as the old one.
• Keep verification codes to yourself, even as a screenshot.

In short, stay calm, pick one official flow, and see it through. That approach makes things easier for you and for Instagram's review team.

How long does recovery take, and what can you do while you wait?

Official sources give no fixed timeline. Cases that the reversal link solves usually wrap up within minutes. Requests that need identity checks depend on Instagram's review, and the time varies from case to case.

Meanwhile, the most useful thing you can do is check the secure email you provided. Instagram sends the next steps there. Also, keep an eye on the spam folder.

• Do not send the same request again and again.
• Tell close contacts that someone took over your account.
• If the account belongs to your business, inform customers through another channel.
• Keep screenshots and incoming emails, and do not delete them.

This way you stay on top of the process and limit the harm the attacker can do to your followers. Nobody can guarantee recovery. Still, completing the official flow fully gives you the best possible chance.

When does it make sense to get expert help?

If the link in your old email brought the account back, you likely need no help. However, some cases are more tangled. For example, if the hacker also stole the email account, holds the two factor device, or your verification requests keep failing, a planned approach matters.

As Talha Aslan and team, we first pin down which scenario you are in. Then we guide you through the official flows in the right order with the right details. We never ask for your password, we never use methods that break the rules, and we never promise a sure result, because the final decision belongs to Instagram.

If Instagram disabled the account during this process, or you cannot move forward on your own, you can describe your situation on our page about how to recover a suspended instagram account. Then we can review together which step makes sense for your account.

Core guide: What Is Digital Marketing? Its types, examples and how it is done, on one page with an interactive film that travels through the brain.