If your account has been hacked, go to instagram.com/hacked, enter your details and request a login or security code sent to your email address or phone number. As soon as you’re logged in, change your password, secure your linked Facebook account, and don’t pay anyone promising instant account recovery.
We live so much of our lives online these days that our social media profiles increasingly feel like a part of us. So it’s understandable becoming anxious and agitated if one of those accounts gets hacked. But don’t panic. Most hacked accounts can still be recovered if you act quickly enough. The most important thing is not to fall for the many scam recovery services that seem to populate search engine results. Take a deep breath and read on.
How to tell if your Instagram account was hacked
There are several warning signs that should tell you something is not quite right. Your email address or password may have been changed, temporarily locking you out; the same could apply to your name or date of birth. You may notice posts, DMs or friend requests that you don’t remember making. Some friends may even complain that you’ve sent them spam or scams. You might also have received login alerts traced to unusual locations.
First, do these things right now
- Go to instagram.com/hacked
- Enter your username, phone number or email
- Request a login link/security code sent to your email address or phone number
- Log in and change password immediately
- Log out of all other sessions (More → Settings → Accounts Center → Password and security → Where you’re logged in)
- Secure your email account (because if someone accessed your Instagram, they may also be able to access your email). Change your password and switch on two-factor authentication (2FA)
- Don’t engage with anyone offering paid ‘recovery’ services. It’s a scam
How to recover your account through Instagram’s official process
Go to instagram.com/hacked and enter your username/email/phone. Click the login link or enter the security code. If this doesn’t work, you may have to get in touch with Instagram support. Complete identity verification if requested (e.g. a video selfie which will be matched to your account photos). If you’ve still got access to your email/phone then the process will likely take minutes. Additional checks may require a wait of a few hours or days.
As an alternative to visiting instagram.com/hacked, you could try going to the login screen of the app and hit Forgot password? Then enter the username, email address, or phone number associated with your account, and click Send login link. Click the login link in your email/text message (SMS) and follow the on-screen instructions.
Submit one request, and be patient. Sending multiple requests from different devices will not speed up the process. In fact, it can look like bot activity.
What if the hacker changed your email and phone number?
Don’t panic. Instagram has well-established mechanisms to verify you regardless of the contact information on the account. As mentioned above, it sends a recovery link to a secure email you still control, bypassing the swapped details.
You might also have received an email at the time the hacker changed your details. This should include a “Revert this change” link which you can click immediately to regain control of your account.
If all else fails, there’s always the video-selfie route to verifying your identity, which Instagram may use if you request support.
If your Instagram and Facebook accounts are linked, “Log in with Facebook” can restore access without needing the hacker’s password. But remember to secure your Facebook account first if it was hacked too.
What if your account was disabled after it was hacked?
Hackers often use hijacked accounts to post spam or scam content. This in turn may trigger Instagram’s automated controls, disabling the account. If this happens, you’ll need to appeal the disablement as well as recover access.
If your account was disabled, you’ll see a message to this effect when you try to log in. Follow the on-screen instructions asking Instagram to review the decision.
How to report a hacked Instagram account
Follow the steps outlined above, going to instagram.com/hacked. If the account belongs to someone else, tap the three dots in the top right of the account à Report à Report Accountà ‘They’ are pretending to be someone else.
Watch out for Instagram “recovery” scams
Fraudsters are masters at exploiting fear and anxiety. A great example of this are the Instagram recovery scams that have grown in recent years. They know that there’s no native phone support for anyone that’s been hacked and lost access to their personal account. So they fill the void with fake recovery services.
The bottom line is this:
- Any Instagram support number in an ad or a comment is a scam
- Anyone promising instant recovery is a scammer
You should never hand over personal or account details to these entities. Or pay them for their non-existent service. Recovery can only happen through Instagram. And it is free of charge.
After you’re back in - lock it down
To prevent your account getting hijacked again, it pays to take a few moments to improve resilience. Consider the following tips:
- Set a new, unique password stored in a password manager (and change it anywhere you reused the old one)
- Turn on 2FA via an authenticator app or passkey — not SMS (as text messages can be intercepted)
- Log out of all active sessions; review login activity
- Re-secure linked Facebook/Threads
How to prevent it happening again
Phishing is the most common way hackers get hold of Instagram logins. It’s increasingly hard to spot fake emails, texts and DMs mocked up to look like official messages. Domains can be spoofed to look like legitimate ones. And fraudsters use tried-and-tested tactics to trick you into clicking through or entering your details. They might flag a fake copyright violation. Or promote fake competitions and giveaways.
The best defense is skepticism. Question everything you read online, especially if it’s an unsolicited message with a too-good-to-be-true offer or an urgent request to take action in order to avoid a penalty. Never enter credentials from a link.
Complement this best practice with password hygiene: use strong, unique passwords stored in a password manager. And complement this with 2FA via passkey or authenticator app. Be sure that your recovery email is also locked down in the same way.
Getting your account back is step one, keeping it secure is what matters next.
Account takeovers often start with phishing links, stolen credentials, or malicious downloads. See how ESET HOME Security Premium helps block these threats and protect your devices and online activity while you stay in control.
ESET expert tips and insights
“One thing I’d add is that many Instagram takeovers now start outside Instagram altogether. Criminals have always been rather successful when targeting the email account linked to Instagram and other platforms because it acts as the recovery key to everything else. It effectively acts as a hub, so if that email account doesn’t have sufficient security, many things can go wrong and account recovery itself becomes nearly impossible.
If an attacker gains access to your email, they can often reset your Instagram password, intercept recovery messages and lock you out before you realize what’s happened, which is too late. That’s why recovering Instagram shouldn’t stop with just changing your social media password. Users should make sure their email has multi factor authentication turned on and it would also be a good idea to double check any email forwarding rules that may have been added by an attacker.”
- Jake Moore, Global Security Advisor
Conclusion
Getting locked out of your Instagram account can feel traumatizing. But it needn’t be. The key is to act fast and only follow official Instagram channels. With luck, account recovery could be as simple as a few clicks away. Or at least, providing a video selfie to Instagram support.
Once you’re back in, turn recovery into resilience by following some best practices to keep that account more secure in future. Or, even better, do it now before hackers have singled you out for account takeover.
Frequently asked questions
1. How do I recover a hacked Instagram account?
Go to instagram.com/hacked, enter your details and request a login or security code sent to your email address or phone number. If this doesn’t work, try Instagram support, which will send an email with next steps and may request a video selfie to confirm your identity. As soon as you’re logged in, change your password, secure your linked Facebook account, and don’t pay anyone promising instant account recovery.
2. What if the hacker changed my email and phone number?
You can still recover the account. Instagram can send a recovery link to a secure email you control. And if that doesn’t work, it can request video-selfie to verify you’re the real owner regardless of the contact details the attacker set. If your Facebook is linked, logging in through Facebook can also restore access.
3. Does Instagram have a phone number I can call for help?
No. Instagram doesn’t offer phone support for personal accounts. Any number you see in an ad, a video, or a comment is a scam. Recovery only happens via official Instagram channels, and it is free.
4. How long does it take to recover a hacked account?
It should take minutes, unless you go down the video selfie route. If the latter, and it’s not possible for Instagram to confirm your identity via automated tools, it may require manual confirmation, which could take a few days. It’s usually faster when you still have access to your original device, email, or phone number. Submit one request and wait rather than resubmitting repeatedly.
5. Why was my account disabled after it was hacked?
Hackers often use hijacked accounts to post spam or scam content. This, in turn, may trigger Instagram’s automated controls, disabling the account. If this happens, you’ll need to appeal the disablement as well as recover access.
6. Is it safe to pay a “recovery service” to get my account back?
No. Legitimate recovery is free and is only available through Instagram. Paid services and “experts” who ask for your password, 2FA codes, or a fee are scammers.
