How to Recover a Hacked Instagram Account (Official Steps)

To recover a hacked Instagram account, first look for an email from security@mail.instagram.com and tap Secure my account to undo the hacker’s email change. If that doesn’t work, go to instagram.com/hacked (or tap Forgot password? in the app) and request a login link or support, which may include a video selfie to prove it’s you.

Never pay a “recovery service”. Only Meta can restore your account, and people offering to do it for money are scammers.

Losing your account is stressful, especially if the hacker is messaging your friends or posting as you. The good news is that Instagram has several official recovery routes, and most people get back in by working through them in order. This guide covers each one, what to do once you’re back in, and how to spot the fake helpers who target hacked users. It’s part of our messaging guides.

Before you start: signs your Instagram was hacked

Your password no longer works, or you’ve been logged out everywhere.
You received an email saying your email address, phone number or password was changed, and you didn’t do it.
Posts, stories or messages you didn’t send appear on your account.
Friends tell you “you” sent them a strange link, a crypto offer or a request for money.
Two-factor authentication was turned on or changed without you.

If you can still log in, skip to the “Lock it down” section below and do it right now. If you’re locked out, follow the steps below in order.

Step 1: Check your email for a message from Instagram

When the email on an Instagram profile changes, Instagram sends a message to the original address that lets you reverse it. According to Instagram’s Help Center, it comes from security@mail.instagram.com and has a special link (Secure my account) to undo the change.

Open the email account that was on your Instagram before the hack.
Search for security@mail.instagram.com, and check your spam and promotions folders too.
Check the sender carefully. Scam emails copy Instagram’s look; the real sender address ends in @mail.instagram.com.
Open the message and tap Secure my account, then follow the steps to reset your password.

Secure your email account first if you think it was also accessed: change its password and check its recovery options. Whoever controls your email can take your Instagram again.

If the hacker also changed your password and you can’t reverse the email change, ask Instagram for a login link sent to the email address or phone number on the account.

On the Instagram login screen, tap Forgot password?
Enter your username, email address or phone number, then tap Send login link.
Complete the captcha check and tap Next.
Open the link in your email or text message and follow the on-screen steps to set a new password.

Step 3: Use instagram.com/hacked for a hacked Instagram account

If you no longer have access to the email or phone number on the account (because the hacker changed both), use Meta’s official page at instagram.com/hacked. Instagram recommends opening it in a mobile or desktop browser. You’ll pick what happened, such as “My account was hacked”, and follow the prompts.

Open instagram.com/hacked in your phone’s browser. Type the address yourself; don’t follow a link from a DM or email.
Choose the option that matches your situation.
Enter the username, email or phone number linked to the account.
When asked, enter a secure email address that only you can access. A fresh address works well if your old one was compromised. Instagram sends next steps there.
Follow the instructions in that email.

Identity verification and the video selfie

Instagram’s Help Center describes two kinds of identity check, depending on the account:

Account with photos of you: you’ll be asked for a short video selfie, turning your head in different directions. Instagram says the video is never shown on Instagram and is deleted within 30 days. If it can’t confirm you from the first video, you can submit another.
Account without photos of you: you’ll get an email asking for the email address or phone number you signed up with and the type of device you used at sign-up (for example, an Android phone or iPhone).

For the video selfie, use good light, take off sunglasses or hats, and move slowly. It’s checking that you’re a real person and that you match the photos on the account.

Step 4: Check the Meta Account Recovery and Support Hub

If your Instagram is linked to Facebook or other Meta accounts in Accounts Center, Meta’s Account Recovery and Support Hub collects the official recovery options for all of its apps in one place. Instagram’s Help Center links to it from its hacked-account page. The Help Center also offers a chat with Meta’s AI support assistant for account problems.

Lock it down once you’re back in

Getting back in is only half the job. Hackers often leave a way back, such as a logged-in device or a connected app. Work through this list straight away.

Change your password to a long one you don’t use anywhere else. Changing it logs out every other device.
Turn on two-factor authentication: profile → menu → Accounts Center → Password and security → Two-factor authentication. An authentication app or security key is stronger than text messages.
Remove unknown devices in Accounts Center → Password and security → Where you’re logged in.
Check your email and phone number in account settings are yours.
Remove linked accounts you don’t recognize in Accounts Center.
Revoke suspicious third-party apps, especially any “followers” or “viewer” tools you gave your login to.
Delete anything the hacker posted and check your DMs for messages sent in your name.
Secure your email account with a new password and two-step verification, or better, passkeys.

Your email account is the master key to everything else, so it’s worth protecting with passkeys. Our guide on how to set up passkeys for Google, Microsoft and Apple accounts walks through it.

Watch out for “recovery experts”

As soon as people post that they’ve been hacked, accounts with names like “Recovery Help” or “Meta Support Agent” appear in comments and DMs offering to get the account back for a fee. They’re scammers. They take your money and sometimes ask for your login details, which gives them the account too.

Meta does not charge to recover an account, and it won’t contact you through comments or DMs to offer recovery.

Don’t trust messages that threaten to ban or delete your account unless you act. Instagram lists these as classic phishing signs. You can forward suspicious emails to phish@instagram.com.

Recovery scams aren’t limited to Instagram. In July 2026, the FBI warned that criminals were even impersonating its own IC3 complaint center to target scam victims with fake promises of getting money back.

If it still doesn’t work

The hacker turned on two-factor authentication: you won’t get the codes. Go back to instagram.com/hacked and use the identity verification route rather than the login link.
You don’t know your username: try the email or phone number you signed up with, or ask a friend to look at your profile and send you the exact username.
The account was deleted by the hacker: Instagram’s Help Center says deletion requests can be cancelled for a limited time (typically 30 days, varying by region). Recover the account as soon as possible.
Warn your followers from another account or through friends that messages from your account aren’t from you.
Someone is blackmailing you or demanding money to return the account or not share images: don’t pay, save the messages, report the account to Instagram, and contact the police. In the US, report it to the FBI at ic3.gov; in India, use cybercrime.gov.in or call 1930.
You lost money because of messages sent from your account (or to it): contact your bank, then report to ReportFraud.ftc.gov in the US or 1930 in India.

How Instagram accounts get hacked (and how to stop it next time)

Most hacks come down to the login details being stolen or guessed, not some technical genius. The common routes are:

Phishing messages: fake “copyright violation”, “verification badge” or “your account will be deleted” DMs and emails that link to a look-alike login page.
A friend’s hacked account asking you to vote in a contest or send a code they “accidentally” sent to your phone.
Reused passwords leaked from another site.
Third-party apps that promise followers or let you see private profiles, and ask for your Instagram login. Read why private Instagram viewer sites are scams.
Malware on your phone, which is rarer. If you suspect it, see how to tell if your phone has been hacked.

Two-factor authentication blocks most of these, and a unique password stops the reuse problem. Treat any unexpected text with a login code as a warning sign too; our guide on stopping spam texts explains how to report them. More account safety guides are in our security hub.

FAQ

How long does it take to recover a hacked Instagram account?

It varies. Undoing an email change or using a login link can take minutes. Identity verification with a video selfie can take longer, since it has to be reviewed, and you’ll be contacted at the secure email you gave.

Can I contact Instagram by phone?

Instagram doesn’t offer phone support for hacked accounts. Use instagram.com/hacked, the in-app Forgot password? flow, or Meta’s Account Recovery and Support Hub. Anyone giving you an “Instagram support number” is likely a scammer.

How do I recover my Instagram without my email or phone number?

Go to instagram.com/hacked, choose what happened, and give a secure email only you can access. Instagram will guide you through identity verification, which may include a video selfie.

Will Instagram tell me who hacked my account?

No. Instagram doesn’t share who accessed your account. Focus on getting back in, removing unknown devices and turning on two-factor authentication.

Should I pay someone who says they can recover my account?

No. Only Meta can restore your account, and it doesn’t charge for recovery. Paid recovery offers in DMs and comments are scams.