Hacker Turned On Two-Factor Authentication on Instagram: What Now?

Panic makes it easy to do things in the wrong order. So follow these steps in sequence during the first hour:

1. Do not log out of Instagram on any device. An open session may be your strongest asset.
2. Search the inbox linked to the account for messages from security@mail.instagram.com.
3. If you are still logged in, change your password in Accounts Center and remove unknown devices.
4. Logged out already? Tap "Forgot password?" on the login screen and request a login link.
5. If the link fails, request support from a mobile device and complete identity verification.
6. Never share details with strangers who offer paid help.

In short, the goal is to stop relying on the code channel the attacker controls. Use the channels where you can prove ownership instead. The sections below explain each step in detail.

Why would an attacker turn on two-factor authentication?

After taking over an account, an attacker wants to stay in control. Two-factor authentication (2FA) adds a second code on top of your password. Normally it protects you. However, when the attacker sets it up, the same layer becomes their shield.

For example, the attacker may link an authentication app on their own phone. From then on, any login from a new device asks for a code that only appears on their screen. You can know the correct password and still get stuck at the second step. The attacker also tends to change the email and phone number. We cover that scenario in our guide on what to do when an Instagram hacker changed the email and phone number.

So the problem here is not an error message. It is a set of security settings working against you. That is why the fix is not to force the settings but to go through Instagram's ownership checks.

Knowing this early saves time. Waiting on the code screen, tapping "resend" again and again or restarting your phone will not change the outcome. Put your energy into the routes that actually work: an open session, the security email and identity verification.

Why does the login code go to the attacker instead of you?

According to the Instagram Help Center, when 2FA is on, Instagram asks for a code whenever someone tries to log in from a device it does not recognize. The code goes to whichever method is set on the account. That can be an authentication app, SMS or WhatsApp.

If the attacker chose the method, the code also lands with them. That is why requesting it over and over does nothing. The code is being sent; it is just not being sent to you.

• Authentication app: The code appears in an app on the attacker's phone. You get no notification at all.
• SMS: The code goes to the number the attacker added.
• WhatsApp: Instagram offers this only after SMS is on, so the code still reaches the attacker's number.

If your phone works fine but no code arrives, and you changed nothing yourself, you are most likely in this scenario. For a delivery problem on an account you still control, see our guide on an Instagram security code not received.

One more clue helps. Instagram usually emails you about important account changes. If your inbox has a message saying 2FA was turned on or a new method was added, you know for sure the change was not yours. Keep that email, because its date can help during recovery.

How can you tell which situation you are in?

To pick the right route, first figure out what you still have. The table below sums up the four situations we see most often and the first route to try in each one.

This table is a starting map, not a promise. Still, knowing your row cuts down on pointless attempts. It also lowers the risk of the account getting locked even further.

What should you do in Accounts Center if you are still logged in?

If Instagram is still open on your phone or tablet, you are in luck. Do not log out; try to reverse the settings from that session. The Help Center describes the path this way: tap More at the bottom left, then Settings, then Accounts Center, then Password and security.

1. Change your password under Password and security.
2. Open Two-factor authentication and select the account.
3. Remove the authentication app or phone number you do not recognize, then add your own method.
4. Check that the email and phone in your personal details belong to you.
5. Remove any linked account in Accounts Center that you do not recognize.

That said, Instagram may ask for the current code before some changes. If the attacker holds the code, this step can stall. In that case, move on to the hacked account flow below instead of forcing it. Menu names also change over time, so look for a similarly named section if the wording differs.

If you find this hard to handle alone, or the account is critical for your business, our disabled instagram account recovery page explains how we support people through the official channels. We state clearly there that we cannot guarantee recovery.

How do you log unknown devices out of your account?

Changing the password may not be enough on its own. If the attacker's session is still open, they can keep acting on the account. The Instagram Help Center describes a section called "Where you're logged in" under Password and security in Accounts Center.

There, you open your account, scroll down to "Select devices to log out", tick the devices you do not recognize and tap "Log out". If Accounts Center is not available to you yet, the Login activity section in settings does the same job. For an unfamiliar login there, choose "This wasn't me" and follow the on-screen steps to reset your password.

Be careful not to log out your own device by mistake. We walk through the screens in our guide on how to remove suspicious devices from Instagram login activity. For the official wording, see Instagram's page on viewing your recent login activity.

Which flow do you use if a hacker turned on two-factor authentication and you are logged out?

If no device is still logged in, use the flow Instagram offers for hacked accounts. The Help Center suggests requesting a login link first. On the login screen, tap "Forgot password?", enter your username, email or phone number and send the link.

Next, complete the human check and open the link you receive. If you cannot reach any of your contact details, the Help Center points you to instagram.com/hacked. You can open it in a desktop or mobile browser. It then takes you through a flow where you pick why you cannot access the account.

• Choose the option that says your account was hacked.
• Enter a secure email address that only you can access.
• Follow every on-screen instruction without skipping ahead.

The full official steps are on Instagram's page about what to do if you think your account was hacked. We also explain the wider process step by step in our guide on an Instagram account that got hacked.

Can Instagram's security email help you?

Yes, and it is often the fastest route. When the email on an account changes, Instagram writes to both the new and the old address. The message to your old address comes from security@mail.instagram.com. It includes a special link that lets you reverse the change.

The Help Center describes this as a link to secure your account. If it works, it undoes the email change and moves you into securing the account. As a result, you also get a chance to reset the 2FA the attacker set up.

On the other hand, fake emails copy the same look. Therefore, check the sender address before you click anything. Instagram's settings also include a section that lists recent official emails from Instagram, so compare against it when in doubt. If a message looks fake, do not touch the link.

Do backup codes you saved earlier still work?

Backup codes let you finish logging in when 2FA is on but a code cannot reach you. The Instagram Help Center says you must be logged in to view or refresh them. That is why it advises copying and saving them in advance.

So could you have codes if the attacker turned 2FA on? Only if you used 2FA before and saved your codes. Also, if the attacker generated a new list, your old codes may stop working. The Help Center's heading suggests that new codes replace the current ones.

If you do have saved codes, try them anyway; you have nothing to lose. Losing your own 2FA device is a completely different case. We cover it in our guide for when you have lost your 2FA device and need a backup code. For the official description, see Instagram's page on using a backup code.

How does Instagram verify your identity?

If the login link does not work, the Help Center suggests requesting support from a mobile device. After that, Instagram's security team may ask you to verify your identity. The method depends on whether your account has photos of you.

• Accounts without photos of you: You get an automated reply. It asks for the email or phone you signed up with and the type of device you used at sign up.
• Accounts with photos of you: You may need to record a short video selfie turning your head in different directions. Instagram says the video is never shown publicly and is deleted after a set period.

The most common mistake here is guessing. If you do not remember your sign up email or first device, search old emails for clues first. We list everything you need in our guide on the information you need for Instagram account recovery. If the selfie step hangs, read our notes on video selfie verification that gets stuck.

Also, keep your support message short and clear. State when you lost access, that you did not turn on 2FA and which details changed. Give facts Instagram can check rather than a long emotional story.

Can a trusted device get you back in?

When you log in with 2FA on a device, Instagram offers "Trust this device". According to the Help Center, that device then skips the security code the next time you log in.

However, this helps you only if you used 2FA before. If the attacker turned 2FA on for the first time, you probably have no trusted device on record. In addition, 2FA lets the account holder remove trusted devices, so the attacker may have removed yours as well.

There is still one thing worth trying. A phone or computer you used often is a familiar device from Instagram's point of view. If possible, start the recovery flow from that device and on a network you normally use. This does not guarantee anything; it simply adds signals that help Instagram recognize you.

Meanwhile, avoid VPNs or networks that route you through another country. An unusual location can look like another suspicious login. Your home or office connection paints a more consistent picture.

Is this the same as losing your own 2FA device?

No, and mixing them up sends you down the wrong flow. When you lose your own device, the 2FA settings are still yours. You have only lost the gadget that makes the codes. In that case, backup codes or a second method you added are usually enough.

When an attacker turns 2FA on, they effectively own the settings. You most likely have no backup code, no second method and no trusted device. So the answer is the ownership route, not the code route.

Which mistakes make recovery harder?

Some panic moves drag the process out. These are the mistakes we see most in practice. Read them as habits to avoid, not as a guarantee list.

• Requesting many codes or links in a short time, which can lead to a temporary restriction.
• Typing a different email address on every attempt, which makes it harder for Instagram to recognize you.
• Guessing answers during identity verification.
• Logging out of your last open session in the hope that something resets.
• Opening a new account with the same name and messaging old followers, which can look like impersonation.

Instead of tapping "send code" again and again, wait a while after each attempt. Use that time to check your inbox, spam folder and old addresses. One calm, consistent request is worth more than five rushed ones.

Why should you not trust anyone claiming to be "Meta support"?

Scammers show up as soon as an account is taken over. The Instagram Help Center states clearly that Instagram does not contact you about account security through direct messages in the app. Therefore, any DM from a "Meta support team" is fake.

The Help Center also tells you not to reply to messages asking for your password, ID number or card details. You can report suspicious emails to phish@instagram.com. If you already typed your password into such a message, change it, log out of unknown devices and go back to the recovery steps.

We describe the typical signs with sample scenarios in our guide on fake Instagram account recovery services. Put simply, reject any message that rushes you, asks for payment or asks for a code.

Can people who promise to recover your account for money really do it?

No. No outsider has a back door into Instagram's systems that removes 2FA. These offers usually take a payment and disappear. Otherwise they collect your remaining details and launch a second attack.

For instance, someone who asks for the code you just received "for verification" may be using it to log in to another of your accounts. So never send codes, passwords or ID photos to strangers. Accessing someone else's account or preparing fake documents breaks the rules. It also puts your account at permanent risk.

A professional team can only help you use the official channels correctly. Instagram makes the final decision. Anyone who promises a sure result is not telling you the truth. If you get such an offer, end the conversation, block the account and report it.

How do you set up 2FA in your own name after you get back in?

Once you are back in, the first job is to take control of 2FA. The Instagram Help Center asks you to set up at least one method. It also lists the authentication app as the recommended option.

1. Tap More, then Settings.
2. Open Password and security in Accounts Center.
3. Tap Two-factor authentication and select your account.
4. Turn off any method you do not recognize, then add your own authentication app.
5. If you like, add SMS with your own number as a second option.

If you want codes through WhatsApp, Instagram first asks you to turn on SMS. Also note that the authentication app setup works only in the Instagram app for Android and iPhone. The official steps are on Instagram's two-factor authentication page.

Where and how should you store backup codes?

Get your backup codes right after you set up 2FA. According to the Help Center, you find them under Accounts Center, Password and security, Two-factor authentication, then Additional methods. The same screen has a "Get new codes" option to refresh the list.

Here is our practical advice on storing them:

• Keep the codes off your phone, for example in a trusted password manager.
• If you write them on paper, keep the sheet somewhere safe at home, not in your wallet.
• If a screenshot goes to a cloud photo library, make sure that cloud account also uses 2FA.
• Delete old copies whenever you get a new list.

That way, if a code ever fails to arrive, you can get back in without going through recovery.

Why should you check connected apps and contact details?

An attacker may leave a back door on the way out. Examples include a third-party app with access to the account, an unknown linked account or an extra email address. The Instagram Help Center also advises revoking access for suspicious third-party apps after you regain the account.

So on the day you get back in, check three things. First, confirm that the email and phone are yours. Next, review the linked accounts in Accounts Center. Finally, review the apps that have access to your account. We explain why this matters in our guide on checking Instagram connected app permissions.

Also change the password of your email account. Instagram accounts are often taken over through the email account first. If the email is not secure, the same thing can happen again.

What if your email account was hacked too?

In some attacks, the email account falls first and Instagram follows. In that case, Instagram's security email also lands with the attacker. So the order matters: recover the email first, then Instagram.

Use your email provider's own recovery flow. A recovery phone, old passwords and a device you use often help there too. If you use Gmail, we cover the steps in our guide on a hacked Gmail account. Once the email is back, check the inbox, the spam folder and the trash.

In addition, look for forwarding rules or filters the attacker may have added. A rule like that can quietly pass Instagram's messages to another address. After you remove such rules, go back to the Instagram flow. From then on, security emails reach you directly.

What should you do if the attacker is posting from your account?

Attackers often use a hijacked account to post fake offers, crypto pitches or urgent requests for money. That puts your followers and your reputation at risk. Instagram may also take action against the account because of those posts.

While you have no access, you can still do the following:

• Tell friends and customers through another channel that the account was taken over.
• Ask followers not to answer any request for money or codes from the account.
• Save screenshots of the posts with dates, which help with the cleanup later.

Once you are back in, review the attacker's posts, stories and sent messages. If needed, share a short note with your followers to clear things up. That way you limit the loss of trust.

What else should you watch if it is a business account?

With a business or creator account, the risk goes beyond the profile. The account may be tied to a Meta business portfolio, an ad account or team members. An attacker can use those links to run ads or change page permissions.

So check the business side in parallel with the Instagram recovery. Review payment methods, the people with access and the most recent ads in the ad account. If you also lost access to your business assets, follow the steps in our guide on how you lost access to a Meta business account.

If several people log in to the account, limit the password to one person after recovery. Grant access through Accounts Center and business portfolio roles wherever possible. Role-based access instead of a shared password lowers the chance of the same incident happening again.

How long does recovery take, and what can you do while you wait?

Instagram does not commit to a fixed timeline for recovery requests. Some requests resolve quickly, while others take longer. So be careful with any source that quotes a specific number of days.

Your options while waiting are limited but important. Warn your followers through another channel, such as your website or other social profiles. Let people close to you know, in case the attacker asks them for money in your name. If you also see a lock warning, follow the steps in our guide on an Instagram account locked message.

Keep an eye on emails from Instagram as well. A reply from support can end up in spam, and missing it slows everything down. For official channels and typical waiting situations, read our guide on how long Instagram account recovery takes. Do not resend the same request at short intervals.

How do you avoid the same attack next time?

A few habits lower the risk a lot once you are back in. None of them needs technical skill, only some routine.

1. Use a different, long and unique password for Instagram and for your email.
2. Set up 2FA with an authentication app and store backup codes somewhere separate.
3. Do not click links in messages about copyright strikes, verification badges or account deletion threats.
4. Check where you are logged in once a month and remove devices you do not recognize.
5. Review third-party apps with access to your account regularly.

For example, fake copyright messages are one of the most common starting points for account takeovers. We show what they look like in our guide on the fake Meta copyright violation message. Then you can spot the next trap in its first line.

When does professional help make sense if a hacker turned on two-factor authentication?

Outside help can make sense if a hacker turned on two-factor authentication and the steps above got you nowhere. The same goes if the account is your main sales channel. At Talha Aslan and team, our work here is not magic. We identify which flow fits your situation, help you prepare consistent details and run the request through official channels.

Instagram decides the outcome, so we do not guarantee recovery and we never suggest anything that breaks the rules. Our instagram account recovery page explains how the process works and what information we ask for. If you want to try on your own first, follow the order in this guide. Very often the most critical step is noticing an open session or the security email in time.

Core guide: What Is Digital Marketing? Its types, examples and how it is done, on one page with an interactive film that travels through the brain.