Speed matters more than anything else here. Search your old inbox for Instagram's message about the change and use its secure-your-account link. No such email? Open instagram.com/hacked on a phone or laptop this account already knows and pick the option that matches. Expect to prove who you are, often with a video selfie. Once you're in again: new password, two-factor authentication through an app, and every unknown device logged out.
Is it really a hack?
These are the giveaways, roughly from most to least obvious:
- out of nowhere, you're logged out and your password is rejected;
- an email tells you the address, number or password on the account changed, and you made no such change;
- posts, stories or DMs appear that you never wrote, very often crypto "investment" pitches;
- someone else turned on, or changed, two-factor authentication;
- friends ask why "you" wanted money or a code from them.
Only seeing an alert about an unfamiliar login, and still able to get in? That's a different situation: see suspicious login attempts.
The recovery order at a glance
| Step | What you do | Why it comes at this point |
|---|---|---|
| 1 | Look through your previous inbox for the message from Instagram's security team | It can undo an email change in a single tap |
| 2 | Open instagram.com/hacked | It's Instagram's own route when the email isn't there or doesn't work |
| 3 | Prove it's you | With your contact details gone, Instagram needs another kind of proof |
| 4 | Lock the account down | Otherwise the same person walks straight back in |
| 5 | Warn your followers | Taken-over accounts are used to scam the people who trust them |
1 · The security email
When someone swaps the email on an account, Instagram usually writes to the address that was there before. Genuine messages are sent from security@mail.instagram.com and contain a link that secures the account or reverses the change. Use it as soon as you find it. The full walkthrough is in email changed by a hacker.
2 · instagram.com/hacked
- Open instagram.com/hacked on a device and a network you've already used with this account.
- Pick the description that fits: hacked, forgotten password, or someone pretending to be you.
- If Instagram offers to send a code to an email or number the attacker now controls, choose the option saying you no longer have access to them.
- Go through each screen exactly as asked. When a route dead-ends, pause and retry calmly instead of launching request after request.
3 · Proving it's you
If Instagram can't reach you through the old contact details, it may ask for evidence that you're the owner. On accounts that show your face, this is usually a video selfie: you turn your head in several directions so Instagram can confirm a real person is there and compare you with the account's photos. Instagram says the recording is stored securely and nobody on Instagram can see it.
- Record it yourself, on your own phone, somewhere well lit.
- No one can do this step on your behalf. A stranger in your DMs offering to "send it to Meta for you" is running a scam.
- More on how the check works: video selfie verification.
4 · Closing every door
- Password: long, unique and used nowhere else.
- Two-factor authentication: an authentication app beats SMS. Keep the backup codes offline.
- Devices: sign out any device or location that isn't yours (here's how).
- Contact details: confirm that only your own email and number are listed.
- Accounts Center: remove connected accounts and apps you don't recognise.
- Your email: secure it as well. An attacker inside your inbox can reset Instagram all over again.
5 · A word to your followers
Post a story explaining the account was taken over and that any request for money or codes didn't come from you. Then delete whatever the attacker published.
How people make it worse
- Paying someone to "hack it back". It doesn't work, and those offers usually end with your money and your remaining data gone. See recovery scams.
- Paying the attacker. A ransom very rarely brings the account back.
- Sharing a login code with anyone at all, including people who claim to work for Meta.
- Deleting Instagram's emails about the change. They may be your shortest way back.
Lost money, or someone passing themselves off as you? That belongs with the police or your country's fraud reporting service as well.
Common questions
Where do I start if my Instagram was hacked an hour ago?
With the inbox you used before. A message from security@mail.instagram.com about the change carries a link that locks the account back to you or undoes the edit. Nothing there? Head to instagram.com/hacked on a familiar device.
Can I recover a hacked account if both my email and phone were changed?
Often you can. In the instagram.com/hacked flow, say you no longer have access to them. Instagram may then ask you to prove who you are, usually with a video selfie when the account shows your face.
Is it worth paying someone who says they can hack my account back?
No. Those offers come from scammers, and paying the attacker a ransom rarely gets the account returned either.
What stops the same hacker getting back in?
A new unique password, two-factor authentication through an authentication app, backup codes stored offline, every unknown device signed out, and a secured email account.
Recovery flow stuck?
Let us know what the attacker altered and where the flow stopped. You'll get a free, honest view of your remaining options. Your password and codes stay with you.
Sources
- If you think your Instagram profile has been hacked (Instagram Help Center) help.instagram.com
- Hacked Instagram account (Instagram Help Center) help.instagram.com
- What to do if the email for your Instagram account was changed (Instagram Help Center) help.instagram.com
- Review recent emails sent from Instagram (Instagram Help Center) help.instagram.com
- Why you might be asked to upload a video selfie to confirm your identity on Instagram (Instagram Help Center) help.instagram.com
- What happens to your selfie after you've sent it to Meta (Instagram Help Center) help.instagram.com
- instagram.com/hacked (Instagram) instagram.com