Instagram account hacked: what to do and how to get it back

This guide summarises the official steps Instagram offers, in the order it makes sense to follow them. You don’t need to install anything or give your password to anyone.

Signs you have been hacked

• You get an email from Instagram about an email, phone or password change you didn’t make.
• The app logs you out and your password no longer works.
• Your followers receive messages or see posts that aren’t yours, often crypto scams or fake giveaways.
• Your username or profile photo has changed.

Step 1: find Instagram’s security email

When someone changes an account’s email, Instagram sends a notice to the previous address. Search your inbox, and your spam folder, for a message from security@mail.instagram.com. That email usually includes an option to undo the change and secure the account. If you find it, use it as soon as possible: it is the fastest route.

Step 2: use the official hacked account page

In a browser, go to instagram.com/hacked, or on the app’s login screen look for the login help option. There you describe your situation and Instagram suggests the methods available for your account: a link to the email or phone, a security code or identity verification.

Step 3: verify your identity

If the attacker changed both the email and the phone, Instagram may ask you to prove you are the account owner. On accounts with photos of you, the usual method is a video selfie in which you turn your head in different directions; Meta compares it with the profile photos. In other cases it may ask for other account details.

If you lost access to the email or phone

There isn’t always a hacker involved. Sometimes the account is intact, but you changed numbers, closed your old email or lost your authenticator app. For that case we have a dedicated guide: how to recover Instagram without email or phone.

Step 4: secure the account as soon as you’re back in

• Change your password to a new one you don’t use anywhere else.
• Check that the email and phone on the account are yours.
• Turn on two-factor authentication, ideally with an authenticator app.
• Log out of sessions you don’t recognise from Meta’s Accounts Center.
• Remove access for third-party apps you don’t use.
• Warn your followers if the attacker posted scams from your profile.

When to ask for help

If the link to undo the change no longer works, the video selfie is rejected or Instagram offers no option, it is best to have someone review your case before making more attempts, because each failed submission can temporarily block new requests. At RecuperarCuenta we analyse your situation and tell you which route makes most sense, without ever asking for your password.