Instagram hacked: how to recover your account
Quick answer
Go to instagram.com/hacked or tap 'Forgot password' and choose 'Need more help?' to start recovery. Instagram can verify you through the email or phone on the account, a selfie video or a security code sent to your original email. Once back in, change your password, remove unknown devices and apps, check Accounts Center and turn on two-factor authentication with an authenticator app.
Hacked Instagram accounts are usually taken through a phishing link, a fake 'copyright' or 'verification' message or a reused password. The attacker often changes the email and phone. Recovery is still possible in many cases.
Start recovery
- Check your email for a message from security@mail.instagram.com about a change. It often has a link to undo it.
- Go to instagram.com/hacked and follow the steps.
- If asked, record a selfie video to confirm it's you, when your account has photos of you.
Once you're back in
- Change your password to one you don't use anywhere else.
- Accounts Center, Password and security, Where you're logged in: log out unknown sessions.
- Remove unknown apps and websites with access.
- Turn on two-factor authentication with an authenticator app.
Common tricks to avoid
Messages claiming your account will be deleted for copyright, offers of a verified badge, or 'friends' asking you to send them a code are classic phishing. Instagram doesn't ask for your password or codes in DMs.
Your phone number and recovery
A number you keep makes recovery much easier. If your account uses a temporary number, add your own email and an authenticator app so you're not depending on a number that's recycled.
Frequently asked questions
Can I recover Instagram if the hacker changed my email?
Often, yes. Instagram may send a link to your original email, or verify you with a selfie video.
How long does recovery take?
From minutes with an email link to a few days for video review.
Should I pay someone to recover my account?
No. 'Recovery services' are often scams. Use Instagram's official tools.
Is SMS two-factor safe enough?
An authenticator app is safer because it isn't exposed to SIM swaps.
Services in this guide
Keep reading
Two-Factor Authentication Explained: SMS, Authenticator Apps, Passkeys and Security Keys
2FA explained: SMS codes, authenticator apps, passkeys and hardware security keys compared, with clear recommendations for your accounts.
Read the guide →Safety & privacySIM Swap Protection: What SIM Swapping Is and How to Stop It
What SIM swapping is, warning signs, and how to protect your accounts with a carrier PIN, port-out lock and 2FA that doesn't rely on SMS.
Read the guide →TroubleshootingInstagram SMS Code Not Arriving or Stuck in a Checkpoint Loop
Instagram code not arriving or stuck in a security checkpoint loop? Causes, safe fixes, and what to do when the SMS never comes.
Read the guide →Safety & privacyHow to Protect Your Phone Number From Spam, Data Brokers and SIM Swaps
Your phone number links to spam, data brokers, SIM-swap attacks and account takeover. Practical steps to protect it, and where a temporary number helps.
Read the guide →Safety & privacyWhat Is SMS Verification? How OTP Codes Work and Safer Alternatives
What SMS verification and one-time passcodes are, why sites use them, how codes are delivered, and how SMS 2FA compares to authenticator apps and passkeys.
Read the guide →Safety & privacyIs It Safe to Use a Virtual or Temporary Phone Number?
Are temporary and virtual numbers safe for verification? The real risks (recycling, recovery, public inboxes) and how to use one safely.
Read the guide →