Privacy and safety

Hacked Instagram account? How to get it back, step by step

Which recovery route to use depending on what the attacker changed, how Instagram's hacked-account page and identity checks work, and the clean-up steps that stop it happening again.

By Daniel MorPublished Sources re-checked

How this was made: Drafted with AI assistance from Instagram's and Meta's announcements, US FTC and UK NCSC guidance, and the reports listed below, all read on 2026-10-29.

On this page
  1. Step 1: find your route
  2. Step 2: check your email for a change notice
  3. Using instagram.com/hacked
  4. How Instagram may confirm it is you
  5. Step 3: lock it down once you are back in
  6. Why two-factor authentication matters so much
  7. Beware of "account recovery" offers
  8. How long does recovery take?
  9. If you cannot get the account back

If you can no longer get into your Instagram account, go to instagram.com/hacked in a browser and choose the option that matches what happened. If you are still logged in somewhere, or you got an email saying your email address was changed, there are faster routes, covered first below. Once you are back in, turn on two-factor authentication before anything else.

Recovery depends on what the attacker changed. Work out which case you are in, then follow that route.

Step 1: find your route

Your situationTry this first
You are still logged in on a phone, tablet or computerStay logged in. Change the password, then sign out of all other sessions (Step 3)
You got an email saying your account email was changedUse the "revert this change" link in that email, after checking the sender (Step 2)
Only the password was changed; your email and phone still workUse "Forgot password?" or "Get help logging in" on the login screen to get a login link
Your email and phone were both changedGo to instagram.com/hacked and choose that your account was hacked
You lost access to two-factor authenticationGo to instagram.com/hacked and choose that option
The account was disabledGo to instagram.com/hacked and choose that the account was disabled
Which recovery route to try first, by what the attacker changed. Compiled 2026-10-29 from the Instagram, Meta and Trend Micro sources cited below.

Step 2: check your email for a change notice

If your account's email address was changed, look in your old inbox. Trend Micro's recovery guide tells you to "check your inbox for an email from security@mail.instagram.com" and, if it says your address was changed, to "open it and click revert this change".

Two cautions:

  • Check the sender before you click. Phishing emails copy this exact message. The sender should be security@mail.instagram.com, and the link should lead to instagram.com. If in doubt, open the Instagram app yourself instead of clicking.
  • If the link does not work, move on. Go to instagram.com/hacked instead.

Using instagram.com/hacked

Instagram launched this page in December 2022 as "a new, comprehensive destination people can rely on to report and resolve account access issues." Its instructions: "If you're unable to log in to your account, enter Instagram.com/hacked on your mobile phone or desktop browser."

There you choose whether you think you were hacked, forgot your password, lost access to two-factor authentication, or had your account disabled, and then follow the steps for that case. If several accounts are linked to your details, you pick the one that needs help.

How Instagram may confirm it is you

Depending on your situation, Instagram may ask you to prove you own the account in one of these ways:

  • A login link or code sent to an email address or phone number you still control.
  • Two friends. Instagram said in 2022 that "you will be able to choose two of your Instagram friends to verify your identity and get back into your account."
  • A video selfie. In its December 2025 update, Meta said its recovery flow can include "taking an optional selfie video to further verify your identity." Meta says it compares the selfie with the profile pictures on the account and that "we immediately delete any facial data generated after this comparison regardless of whether there's a match or not."

Meta also says its systems now "recognize the device you usually use and familiar locations better than ever", so trying recovery from your usual phone, on your usual Wi-Fi, can help.

Step 3: lock it down once you are back in

The US Federal Trade Commission and the UK National Cyber Security Centre give almost the same checklist. Do all of it, in this order:

  1. Change the password. Make it unique to Instagram. The FTC suggests aiming "for 12 to 15 characters".
  2. Sign out of all devices. The FTC lists "Sign out of all devices" as its second step, so anyone else still logged in gets kicked out.
  3. Turn on two-factor authentication. If you can, use an authenticator app rather than text messages, which depend on your phone number staying in your control. Save the backup codes somewhere other than your phone.
  4. Check your recovery details. Make sure the email address and phone number on the account are yours.
  5. Secure your email too. The NCSC warns that "a common tactic used by cyber criminals is to set up a forwarding rule." Check your email's forwarding rules and change that password if it was shared.
  6. Review what was posted or sent. Delete posts, stories and messages you did not make, and check who the account started following.
  7. Remove apps you do not recognize from the account's connected apps and websites.
  8. Update your phone and apps. The NCSC: "Apply updates to your apps and your device's software as soon as they are available."
  9. Tell your followers. The NCSC says to "let them know that you were hacked," so they ignore anything the attacker sent in your name.
  10. Check your money. If a card or payment method was attached, look for "unauthorised purchases", as the NCSC puts it.

Why two-factor authentication matters so much

In June 2026, BleepingComputer reported that attackers hijacked 20,225 Instagram accounts by abusing a flaw in an AI-assisted support tool, which sent password reset links to email addresses that did not belong to the account. According to the report, the attacker could log in after a reset "if the account holder had not enabled two-factor authentication (2FA)." Two-factor authentication was the difference between a reset link and a lost account.

Beware of "account recovery" offers

After a hack, especially if you ask for help publicly, expect messages from people who say they can get your account back for a fee. Meta's own support is inside the apps; in December 2025 it described a support hub where you can "report an account issue". The FTC's rule for recovery offers is short: "Did someone contact you and ask for an upfront fee? That's a scammer." Never give a stranger your login details or a security code.

How long does recovery take?

Meta does not publish a standard time, and cases differ. Meta's December 2025 post did report that "new account hacks decreased by more than 30% globally on Facebook and Instagram" over the past year, and that the relative success rate of hacked account recovery rose by more than 30% in the US and Canada. If one route fails, try another from the table, preferably on your usual device.

If you cannot get the account back

  • Warn people through other channels: other social accounts, messaging apps, or friends who can repost.
  • Report the account. If it is now posing as you, follow our guide to reporting an account that is impersonating you.
  • Report fraud. If money was taken, contact your bank. The FTC points US victims of identity theft to IdentityTheft.gov for a recovery plan; in the UK, the NCSC directs people who lost money to report it as fraud.

Frequently asked questions

What is the first thing to do if my Instagram was hacked?

If you are still logged in anywhere, change your password and sign out of all other sessions immediately. If you are locked out, check your email for a change notice from security@mail.instagram.com, then use instagram.com/hacked.

Does Instagram keep my video selfie?

Meta says it deletes facial data generated by the comparison immediately, whether or not there is a match.

Someone offers to recover my account for money. Should I pay?

No. Recovery through Instagram is free, and the FTC treats anyone asking for an upfront fee to "recover" something as a scammer.

Sources

  1. Continuing to Keep Instagram Safe and Secure (Instagram, 15 December 2022) (Opens in a new window) (accessed Oct 29, 2026)
  2. Making it Easier to Access Account Support on Facebook and Instagram (Meta Newsroom, 4 December 2025, updated March 2026) (Opens in a new window) (accessed Oct 29, 2026)
  3. Testing New Ways to Combat Scams and Help Restore Access to Compromised Accounts (Meta Newsroom) (Opens in a new window) (accessed Oct 29, 2026)
  4. Instagram Account Hacked? 3 Steps to Recover (Trend Micro, updated 28 November 2023) (Opens in a new window) (accessed Oct 29, 2026)
  5. How To Recover Your Hacked Email or Social Media Account (US Federal Trade Commission) (Opens in a new window) (accessed Oct 29, 2026)
  6. Email or social media hacked? Here's what to do (US Federal Trade Commission, 29 October 2024) (Opens in a new window) (accessed Oct 29, 2026)
  7. Recovering a hacked account (UK National Cyber Security Centre) (Opens in a new window) (accessed Oct 29, 2026)
  8. Over 20,000 Instagram accounts stolen in Meta AI support hack (BleepingComputer, 8 June 2026) (Opens in a new window) (accessed Oct 29, 2026)
  9. Refund and Recovery Scams (US Federal Trade Commission) (Opens in a new window) (accessed Oct 29, 2026)

View a public account anonymously

Type a public username. No login, no account, nobody is notified.

Open the profile viewer

Related guides