If your Instagram is hacked, act fast: check your email for a security message from Instagram that lets you undo an email change, request a login link from the “Forgot password” screen, and use Instagram’s official recovery page if you are still locked out. Once you are back in, change your password, turn on two-factor authentication and remove anything the hacker added. This InstaPv guide takes you through each step in order.
Key Takeaways
- Look for an email from security@mail.instagram.com and use it to reverse an email change.
- Request a login link or security code from the login screen.
- If that fails, go to instagram.com/hacked and follow the identity checks.
- Once back in, change your password, turn on 2FA and review linked accounts and apps.
- Warn your followers, since hackers often message friends to spread scams.
Signs Your Instagram Account Has Been Hacked
Sometimes a takeover is obvious because your password suddenly stops working. Other times the signs are quieter. The UK National Cyber Security Centre’s guide to recovering a hacked account lists warning signs that apply well to Instagram:
- You cannot log in, or your password, email or phone number has changed.
- Friends mention messages or posts you never sent.
- You get alerts about logins from places or devices you do not recognise.
- Security settings, such as two-factor authentication, have been switched off.
- New posts, stories or follows appear that you did not make.
If any of these apply, assume the account is compromised and start the recovery steps below straight away.
Step 1: Check Your Email for a Security Message
When an account’s email address is changed, Instagram normally sends a message to the old address. Instagram’s help page on what to do if your account was hacked says that if you received an email from security@mail.instagram.com about an email change, you can use the option in that message to undo it.
Search your inbox, spam and junk folders. Be careful, though: scammers also send fake “Instagram” emails. Our article on Instagram phishing scams explains how to tell a real security notice from a trap.
Step 2: Request a Login Link or Code
If the hacker changed your password but you still control your email or phone number, the login screen is your fastest route back.
- Open the Instagram app or website and tap Forgot password.
- Enter your username, email address or phone number.
- Request a login link and complete the security check if one appears.
- Open the link from your email or text message and set a new password.
When the hacker changed your contact details too
If neither your email nor your phone number works any more, a login link will not reach you. In that case, move on to Instagram’s dedicated recovery process.
Step 3: Use Instagram’s Official Recovery Process
Instagram’s help page points people to instagram.com/hacked, which works in a mobile or desktop browser. If the login link does not work, it also explains how to request support from a mobile device using a secure email address that only you can access.
You may be asked to confirm details such as the email or phone number you signed up with and the type of device you used. For accounts that contain photos of you, Instagram may ask for a short video selfie of you turning your head. Instagram says these videos are deleted within 30 days and never shown publicly.
| Your situation | Best first step | What you will need |
|---|---|---|
| Email changed, password still works | Undo the change using the security email | Access to your original inbox |
| Password changed, email unchanged | Request a login link via Forgot password | Your email or phone number |
| Email and phone both changed | Go to instagram.com/hacked | Sign-up details, device type, possibly a video selfie |
| Still logged in on one device | Secure the account immediately | Access to Settings and Accounts Center |
Step 4: Lock the Account Down Once You Are Back In
Getting back in is only half the job. The hacker may have left ways to return, so work through these checks before doing anything else.
- Change your password to a long, unique one you have never used elsewhere.
- Turn on two-factor authentication. Our guide to turning on Instagram two-factor login shows the exact steps.
- Confirm your email and phone number are yours and up to date.
- Review Accounts Center and remove any linked accounts you do not recognise.
- Revoke suspicious third-party apps that have access to your account.
- Log out of other sessions so only devices with your new password stay signed in.
Check your email account too
The NCSC warns that attackers often add forwarding rules or filters to email accounts to intercept password resets. Open your email settings and delete any forwarding rules you did not create, then change that password as well.
Step 5: Warn Your Followers and Clean Up
Hijacked accounts are often used to message friends with fake investment offers, prize claims or requests for login codes. Post a story or send a short message letting people know your account was compromised and asking them to ignore odd messages from the past few days.
Then look through your posts, stories, highlights, bio and following list. Delete anything the hacker added and unfollow accounts you did not choose. Look carefully at any new followers too, since takeovers sometimes come with a wave of spam profiles; our tips on spotting fake Instagram accounts help here.
It can also help to see how your profile looks from the outside. Log out, or browse with InstaPv if your account is public, and check your username as a stranger would. This shows whether anything unwanted is still visible.
How to Stop It Happening Again
Most takeovers start with a reused password or a phishing message, so a few habits go a long way. Use a password manager, keep 2FA switched on, and never type your login into a page you reached through a message link.
For more ways to protect yourself, browse our Privacy & Safety guides, or read practical how-tos in the Instagram guides section.
Safety note: Be very wary of anyone offering to “recover” your account for a fee, including people who reply to your posts about being hacked. Recovery services contacting you through DMs are usually scams. Never share your password, login codes or the video selfie with anyone outside Instagram’s official process.
Frequently Asked Questions
How long does it take to recover a hacked Instagram account?
It depends on your situation. If you can undo an email change or use a login link, you may be back in within minutes. If the hacker changed all your contact details and you need identity verification, it can take longer. Follow each step Instagram asks for and keep checking the email address you provided.
Should I create a new account while I try to recover the old one?
You can, but it is usually better to wait while recovery is in progress. A new account can confuse followers who are already receiving scam messages from the hijacked one. If recovery fails, the NCSC suggests creating a new account and telling your contacts which one is genuinely yours.
Can someone hack my Instagram just by viewing my profile?
No. Viewing a public profile, whether in the app or through an anonymous viewer like InstaPv, does not give anyone access to your account. Hackers need your password, a login code or a session on your device. That is why phishing messages and reused passwords are the main risks to guard against.
Should I trust a DM asking for my password or login code?
No. Treat any direct message that asks for your password, a login code or a backup code as a scam, even if it uses Instagram’s name and logo. Recover your account only through the app’s login screen or instagram.com/hacked, which you type into the browser yourself, and report the suspicious message.
