If your Instagram account suddenly logs you out, changes its email address or starts sending strange messages to followers, treat it as a possible compromise. A hacker may have changed your password, contact details or two-factor authentication settings. Acting quickly can reduce the damage.
This 2026 guide explains how to recognize a hacked account, use Instagram’s official recovery route, respond if the hacker changed your email or phone number, and secure the account after you regain access. Do not pay anyone who contacts you promising instant recovery—use Instagram and Meta’s official channels only.
Signs your Instagram account may be hacked
- You receive a password, email or phone-number change alert that you did not request.
- Your usual password no longer works or you are logged out unexpectedly.
- Posts, Stories, comments or direct messages appear that you did not create.
- Your profile photo, bio, username, email or phone number has changed.
- Unknown devices or locations appear in login activity.
- Friends tell you they received suspicious links, money requests or verification-code requests from your account.
One unusual login alert does not automatically prove a successful hack, but investigate it through the app or official website. Do not open account-recovery links sent by strangers in DMs.
First: if you can still access Instagram
If you are still logged in on any trusted device, secure the account before logging out.
- Open Instagram and go to Accounts Center → Password and security.
- Change your password to a unique password that you do not use on other websites.
- Open Where you’re logged in or the login-activity control and sign out unfamiliar sessions.
- Check the email address and phone number linked to the account. Replace any details you do not control.
- Review connected accounts and remove unfamiliar linked profiles or third-party apps.
- Turn on two-factor authentication and save recovery codes somewhere secure.
Also secure the email account connected to Instagram. If a hacker controls your email inbox, they may be able to reset the Instagram password again.
How to recover a hacked Instagram account when you cannot log in
Start with Instagram’s official recovery page: instagram.com/hacked. Open it directly in your browser rather than following a link from an unsolicited message.
- Choose the option that best describes your problem, such as a hacked account or an inability to access the account.
- Enter your Instagram username, email address or phone number when requested.
- Follow the on-screen recovery steps. Depending on the account and situation, Instagram may offer a login link, security code or another verification method.
- If the first method does not work, select the option indicating that you cannot access the listed email or phone number, if it is shown.
- Provide a secure email address that only you can access when Instagram asks for one.
- Follow the instructions sent by Instagram or Meta and complete any identity check requested.
Recovery options are adaptive and may differ by account, device, country and security history. Meta says its recovery flow can offer different verification options, including an optional selfie video in some cases. A selfie video is not guaranteed to appear for every account.
Meta has also announced a central support hub and a Meta AI support assistant in countries where it is available. If those tools appear inside the official Instagram app or Help Center, use them there; do not trust a person claiming to be Meta support in a DM. See Meta’s account support update.
What if the hacker changed your email address?
Check the original email inbox that was previously linked to Instagram. When an account email is changed, Instagram may send a security message from security@mail.instagram.com with an option to reverse or secure the change.
- Search your inbox, spam and archived folders for messages from security@mail.instagram.com.
- Open the message about the email change and inspect the sender and destination carefully.
- If the message is genuine and you did not make the change, use the official link to reverse or secure it.
- After regaining access, change the Instagram password and secure the email account itself.
Do not trust a message just because the sender name says Instagram. Check the actual sender address and avoid entering your password on a page reached through an unfamiliar link. If the reversal link is missing or no longer works, continue through Instagram’s hacked-account flow.
What if the hacker changed both your email and phone number?
You may still have a recovery route. Use the official hacked-account page and follow the option for people who cannot access the contact details on the account. Instagram may ask for a new secure email address and additional identity verification.
Depending on the account, the verification method may include:
- A login or security link sent to a contact method that Instagram can still verify.
- Details associated with the account, such as the original sign-up email or phone number and the device used when you registered.
- A video selfie if the account contains photos of you and Instagram offers that check.
- Other on-screen checks based on your account’s security history.
Answer accurately and submit only through Instagram’s official app or website. Do not send identity documents, passwords or verification codes to a recovery agent on Telegram, WhatsApp or Instagram DMs.
How video-selfie verification may work
If Instagram offers a video-selfie check, follow the instructions shown in the app. It may ask you to move your head in different directions so the system can check that you are a real person and compare your appearance with photos associated with the account.
- Use the official in-app camera flow.
- Choose a well-lit place and keep your face visible.
- Follow the movements and instructions on screen.
- Do not upload a pre-recorded clip or someone else’s video.
- Watch the secure email address you supplied for the result and next steps.
Not every account is eligible for this method, and approval is not guaranteed. If Instagram says it could not confirm your identity, follow the option it provides for another attempt or another verification method. Do not assume a particular review time; it can vary.
Secure your account immediately after recovery
Once you regain access, complete this checklist before returning to normal posting.
1. Create a new, unique password
Use a password manager to create a strong password that is not shared with your email, Facebook or other services. Never reuse a password that may have been exposed.
2. Enable two-factor authentication
Open Accounts Center → Password and security → Two-factor authentication and follow the instructions. Where available, an authenticator app or passkey can provide an additional option beyond SMS. Keep recovery codes somewhere private and separate from the phone.
3. Review login sessions
Open the login-activity or Where you’re logged in section. Sign out devices and locations you do not recognize. If you are unsure, sign out other sessions and log back in only on devices you control.
4. Check contact details and linked accounts
Confirm the email and phone number are yours. Review Accounts Center for unfamiliar Facebook or Instagram profiles connected to your account. Secure any linked Facebook account too.
5. Remove suspicious third-party access
Review apps and websites connected to Instagram. Revoke access for follower trackers, automation tools or services you do not recognize or no longer use.
6. Warn followers about scam messages
Delete fraudulent posts and Stories where possible. Consider publishing a brief warning that suspicious DMs or links sent during the compromise were not from you. Ask friends not to send money or verification codes to the compromised account.
How to prevent another Instagram hack
- Never enter your password on a page reached through an unexpected DM or email.
- Ignore messages claiming your account will be deleted unless you click an appeal link. Check account alerts inside Instagram’s official settings instead.
- Never share a login code, authenticator code or recovery code with another person.
- Secure your email account with a unique password and two-factor authentication.
- Keep Instagram and your phone operating system updated.
- Review login activity and connected apps from time to time.
- Use a passkey or authenticator-based 2FA if offered and suitable for your account.
Meta says Instagram will not contact you through DMs to ask for your password or sensitive login details. Its security guidance recommends two-factor authentication and keeping recovery contact information current.
How to recognize Instagram recovery scams
After an account is hacked, fake recovery services often target the owner while they are stressed. Watch for these red flags:
- Someone guarantees recovery in minutes or claims to have a private contact inside Meta.
- They ask for your password, login code, recovery code or remote access to your phone.
- They demand cryptocurrency, gift cards or an upfront fee to “unlock” the account.
- They send you to a look-alike login page or ask you to install an unofficial Instagram app.
- They claim to be Instagram support but contact you from a personal account or unrelated email address.
Do not pay or share credentials. Account recovery should be handled through Instagram’s official process. Report and block suspicious accounts.
Frequently asked questions
1. How do I recover a hacked Instagram account?
Go directly to instagram.com/hacked, choose the option that matches your situation and follow the recovery instructions. Instagram may offer a login link, security code or identity verification.
2. Can I recover Instagram if the hacker changed my email?
Check the original inbox for a security message from security@mail.instagram.com with an option to reverse or secure the email change. If that does not work, use Instagram’s official hacked-account page.
3. What if the hacker changed my email and phone number?
Use instagram.com/hacked and choose the option for not having access to the listed contact details. Instagram may request a secure email address and additional identity checks based on your account.
4. Does Instagram always ask for a video selfie?
No. Video-selfie verification is one possible method and may appear for accounts with photos of the owner. Other accounts may receive different identity checks.
5. How long does Instagram account recovery take?
There is no guaranteed recovery time. It depends on the verification method, account details and review process. Follow the official instructions and monitor the secure email address you supplied.
6. Can I contact Instagram by phone to recover my account?
Do not rely on phone numbers found in search results or social posts claiming to be Instagram support. Use the official app, Help Center and instagram.com/hacked.
7. Should I pay someone to recover my Instagram account?
No. Do not pay strangers who promise guaranteed recovery or ask for your password and codes. Use Instagram’s official recovery process.
8. How do I log out a hacker from my Instagram account?
If you can still access the account, open Accounts Center → Password and security → Where you’re logged in, review sessions and log out unfamiliar devices. Change your password and enable two-factor authentication.
9. Can a hacker get back in after I change my password?
Possibly, if they still control your email, phone, linked account, active session or connected third-party app. Secure those access points, sign out unfamiliar sessions and enable two-factor authentication.
10. How do I stop Instagram from being hacked again?
Use a unique password, enable two-factor authentication or a passkey where available, secure your email account, remove suspicious app access and never share login codes.
Final takeaway
Start with Instagram’s official hacked-account recovery page, check your original inbox for a genuine email-change alert and complete only the verification steps Instagram offers for your account. After recovery, secure your email, change your password, review login sessions and enable two-factor authentication. Never pay a stranger or share your login codes to get your account back.
Related guide: Instagram profile best practices.
