A login alert means a device or browser new to Instagram just tried your account. With two-factor on, you see which device and roughly where, and can let it in or block it. Check the session list in Accounts Center: confirm it if it's yours, reject it and set a new password if not (other sessions then end). One alert doesn't mean the account is gone; an unexpected reset email is often just someone's typo. The alert emails themselves deserve suspicion, since fakes are a classic phishing lure.
What triggered the alert
Instagram's name for these is login requests. Once two-factor authentication is on, any sign-in from hardware or a browser Instagram hasn't met triggers one, whether as a push alert, an Activity entry or an in-app banner. It names the device and its rough location, and you decide right there whether to let it through.
Unfamiliar to Instagram isn't the same as suspicious. New phones, fresh browsers and wiped cookies all trigger it. What counts is whether the device and place mean something to you.
The first five minutes
- Don't click links in an alert email yet. Open the Instagram app yourself.
- Find the session. Accounts Center › Password and security › Where you're logged in (on desktop via More › Settings). Older app versions keep it under Security › Login activity.
- Familiar? Tap This Was Me and confirm.
- Unfamiliar? Tap This Wasn't Me; Instagram then walks you through a password reset.
- Buttons missing? They only appear after a login from something Instagram didn't recognise. Any listed session can still be logged out by hand.
Answering a login request
Opening the alert shows device and location. Approve means yes, that was me; Deny means no, and Instagram follows up with a password reset so the old password stops working for whoever had it.
The feature lives in the two-factor settings under additional methods (Login requests), and it relies on Instagram being allowed to send you push notifications.
An unrequested password reset email
A reset email out of the blue feels alarming, yet Instagram points out it's often innocent: another user fat-fingered their own email or handle and typed yours. Getting in still requires your password, or a click on the link inside that very email.
So don't click. Uneasy anyway? Open the app directly, choose a new password and add two-factor authentication.
Telling real alerts from fake ones
Fake "suspicious login" emails work because they make people hurry. Three checks before you touch anything:
- The sender's domain. It has to be one of Instagram's official sending domains; the list is in error messages.
- Recent emails. Settings keeps two weeks of real Instagram mail. Not listed there? Not from Instagram.
- The channel. Security never comes up in Direct.
More examples: fake Instagram emails and DMs.
Quick reference
| What you see | Most likely | Your move |
|---|---|---|
| Alert for the phone you set up this morning | Your own new device | Approve / This Was Me |
| Alert for a device that isn't yours | Your password is probably known to someone | Deny, then a new password |
| Reset email you never requested | Likely a stranger's typo | Leave the link; optionally update your password in-app |
| Alert email that Recent emails doesn't show | Phishing | Delete without clicking |
| Sudden lockout | Possible takeover | instagram.com/hacked |
It wasn't you: what now
A stranger's login usually means your password is out there. Instagram's examples: reusing it on a website that later got breached, or connecting the account to an outside app it never approved. Act while you're still in:
- new password (it ends every other session);
- two-factor authentication on;
- your own email and phone in settings, nobody else's;
- unknown linked accounts removed from Accounts Center;
- shady third-party apps disconnected.
Posts or messages you didn't send? See Instagram posting things you didn't. Email already changed? Reversing an email change. Locked out completely? Hacked account.
Common questions
Is a login alert proof that I've been hacked?
No. New phones and browsers trigger alerts too. It's a warning, not a verdict: if the device or place isn't familiar, reject it and change the password.
This Was Me or This Wasn't Me: how do I decide?
Only confirm sessions you can place, a phone you own, a city you were in. Anything else gets This Wasn't Me, which leads straight into a password reset.
Why do my own logins set off alerts?
Instagram judges devices, not people: new hardware, another browser or wiped cookies all look new. Confirming them is enough. A device you've never owned is a different story; change the password.
How do I know an alert email is real?
Two checks: an official Instagram sending domain, and a matching entry in Settings › Recent emails. Fail either and it's phishing.
Not sure whether it was you?
Screenshot the alert or your session list and send it to us. We'll say for free whether action is needed. Your password and codes stay yours.
Sources
- Turn login requests on or off on Instagram (Instagram Help Center) help.instagram.com
- View your recent Instagram login activity (Instagram Help Center) help.instagram.com
- Why you received an Instagram password reset email that you didn't request (Instagram Help Center) help.instagram.com
- Review recent emails sent from Instagram (Instagram Help Center) help.instagram.com
- Why Instagram tells you your account is at risk (Instagram Help Center) help.instagram.com
- If you think your Instagram profile has been hacked (Instagram Help Center) help.instagram.com