Activity you didn't create means, according to Instagram, that your password may be compromised, very often through an app you once handed your login to. If you can still get in, the password goes first because changing it ends every session; dubious apps, two-factor, your contact details and Accounts Center links follow. Professional account still being misused? Search Meta Business Suite for managers you don't know. No access left? Head for instagram.com/hacked. Afterwards, delete the scam content and warn your followers.
Symptoms of a shared account
- Content in your name you never made, usually pushing crypto gains, "investments", giveaways or suspiciously cheap products. Instagram's own example of an investment scam promises to turn $100 into $1,000.
- Replies and DMs in your name, often carrying a link or a plea for money.
- "Try again later" errors, which Instagram says can appear when inauthentic activity is detected: Try again later.
- Unknown sessions in Accounts Center: logging out everywhere.
Still signed in? Do this, in this order
The first step ends every open session, so it has to come first.
- New password (or a reset email to yourself). Something strong and unique: at least six characters mixing numbers, letters and symbols. Instagram signs out every device the moment you change it.
- Cut off suspicious apps. Any app you've handed your login or a token to can, Instagram warns, run the account completely. Services trading likes or followers for your login are the classic culprit.
- Two-factor authentication on.
- Phone and email in settings: put them back if they were changed.
- Accounts Center: unlink anything you don't recognise.
Professional accounts: hunting for hidden managers
On a creator or business account where actions continue after the password change, Instagram points you to business access:
- On a computer, sign in to Meta Business Suite (business.facebook.com) with your Instagram details.
- Open Business Settings, then People under Users.
- Found managers you never added? Instagram's way to remove them is to switch the account to personal, then back to professional.
The price: as a personal account you temporarily lose the business tools, ad management and in-app statistics, ads included. Statistics are held for 90 days, so switching back within that window restores them.
Already locked out?
Once the password, email or phone have been changed, the list above won't help. First look for a message from security@mail.instagram.com about the email change; Instagram says it lets you reverse it. Failing that, instagram.com/hacked takes over, possibly ending with a video selfie. Full walkthrough: hacked account.
Clean-up and damage control
- Remove the intruder's content: posts, stories, highlights, comments and anything left in sent chats.
- Warn people, with a story once you're back or elsewhere if you aren't. Spell it out: nobody should send money, codes or private details to your account.
- Get scam posts reported. "Scam, fraud or spam" is a report reason anyone who received a message can use.
- Victims who paid need to call their bank and file a police report straight away.
Stopping a repeat
- Authenticator-app two-factor, with backup codes saved somewhere safe.
- No Instagram login for any like or follower service, ever.
- Login alerts on, and a regular look at your active sessions.
- Trust only security mail from Instagram's official domains: fake Instagram emails.
The whole list: security checklist.
Common questions
Why is my account posting things I didn't post?
Instagram's explanation: your password may be in someone else's hands, frequently via an outside app you once trusted with it.
Will a new password alone stop it?
It closes every session, but the intruder may return through a connected app or changed contact details, so finish the whole list above.
Followers got scam DMs from me. What do I say?
That it wasn't you, that money and codes must not be sent, and that the messages should be reported. People who already paid should go to their bank and the police.
The intruder keeps going on my business profile. Next step?
Look for unfamiliar people in Meta Business Suite's business settings; a switch to personal and back removes them.
Intruder still active?
Tell us what's appearing and which parts you can still reach. At no cost, we'll name your next step. No passwords or codes needed.
Sources
- What to do if your Instagram profile posts unauthorized content (Instagram Help Center) help.instagram.com
- I have a professional Instagram account and I'm able to log in, but a hacker is still taking actions on my account (Instagram Help Center) help.instagram.com
- If you think your Instagram profile has been hacked (Instagram Help Center) help.instagram.com
- Avoid getting scammed on Instagram (Instagram Help Center) help.instagram.com
- Report a post or profile on Instagram (Instagram Help Center) help.instagram.com
- Securing your Meta Account with two-factor authentication (Instagram Help Center) help.instagram.com