Cybersecurity researchers estimate Instagram accounts for roughly 31% of all social media account takeovers reported in 2025 — more than any other platform — with an estimated 22 million Instagram accounts compromised that year. If you're reading this because your own account just got locked, your password stopped working, your profile photo or bio suddenly changed, or friends are messaging you asking why you're sending them strange links, you are far from alone. Instagram is the single most targeted social platform for account takeover, largely because it doubles as a business tool, a payment-linked storefront for many creators, and a single sign-on gateway into Facebook and Threads.
The good news is that Instagram has a real, working recovery path built into the app, and in the large majority of cases you can get your account back yourself, without paying anyone, within minutes to a few days. This guide walks through the exact official recovery flow step by step, what to do if the hacker changed your email or phone number, how identity verification works if it comes to that, how to lock the account down afterward so it doesn't happen again, and how to spot the scams that specifically target people in the middle of a hacked-account panic.
What makes Instagram takeovers particularly stressful compared to, say, a hacked streaming account is how much is riding on a single login: years of photos and Stories, a follower base you may have spent years building, direct messages with personal or business information, and — for creators, freelancers, and small businesses — a live storefront, ad account, and client-facing identity. That's exactly why hackers target Instagram so aggressively, and why acting quickly and correctly in the first hour matters more here than almost anywhere else online.
Do you still have some access, or are you fully locked out?
Before anything else, try to log in normally. If your password still works, skip straight to Step 7 (secure the account) below — you're in a race against the hacker, and every minute you keep access matters. If your password has been changed and you're bounced back to the login screen, or the account shows someone else's face and bio, continue with Step 1.
How to Tell Your Instagram Was Actually Hacked
Not every login problem is a hack. Before you panic, confirm you're dealing with account takeover rather than a forgotten password, an app glitch, or a temporary "action blocked" restriction (which is a different, less serious issue — Instagram sometimes temporarily limits actions like follows or comments if it thinks you're behaving like a bot; that's a warning, not a breach).
| Sign | Likely Cause |
|---|---|
| Password no longer works, no reset email requested by you | Account taken over — start recovery now |
| Profile photo, name, or bio changed without your input | Account taken over — start recovery now |
| Followers or contacts report receiving strange DMs "from you" | Account taken over — start recovery now |
| You received an email confirming a login email or phone change you didn't request | Account taken over — use the changed-email reversal (Step 4) |
| "Action blocked" message when liking/following/commenting | Not a hack — automated activity limit, usually lifts in 24-48 hours |
| Simply forgot your own password | Not a hack — normal password reset applies |
If your issue is actually the "action blocked" restriction rather than a takeover, see our separate guide on fixing the Instagram action-blocked error — the steps below are specifically for regaining control of an account someone else has locked you out of.
Worried the hack started on your device, not just your password?
If you suspect spyware, a keylogger, or a compromised browser handed over your login in the first place, our certified bilingual technician can remote in and check your device for malware while you handle the Instagram recovery steps below. From $119.99, same day.
9 Steps to Recover a Hacked Instagram Account
Follow these in order. Most people regain access at Step 2 or Step 3 within minutes. Only move further down the list if the previous step fails.
Act immediately — don't wait, don't refresh and hope
Every recovery path below has a time-sensitive component, and hackers who take over Instagram accounts often move fast to lock you out further — changing the linked email, then the phone number, then enabling their own two-factor authentication so you can't get back in even if you recover the password. The single biggest mistake people make is spending a day trying to remember old passwords or waiting to see if it "fixes itself." It won't. Start the official recovery flow the moment you notice something is wrong.
Use the official login-link recovery flow
On the Instagram login screen (app or instagram.com), tap "Forgot password?". On the next screen, look for and tap "Need more help?" — this is the important part, since it opens the broader recovery flow rather than the standard single-email password reset. Enter your username, or the email address, or the phone number that was ever associated with the account — even if you suspect the hacker has since changed some of that information. Then tap "Send login link." Instagram will attempt to route a one-time login link to whichever contact method it can still reach.
Open the login link to bypass the hacker's password entirely
Check the email inbox or phone messages for the account tied to your Instagram. The login link Instagram sends signs you directly into the app or website — you don't need to know the current (hacker-set) password at all. This is the fastest and most common way people get their account back, usually within a few minutes of requesting it. If nothing arrives within 10-15 minutes, check spam/junk folders before assuming it failed.
If the hacker changed your email, use the automatic reversal alert
When someone changes the login email on an Instagram account, Instagram automatically sends a notification to the original email address that was on file before the change — the one the hacker no longer controls. That email contains language like "This wasn't me", "Secure my account," or "Reverse this change." Clicking it reverses the hacker's email change and can restore your access without needing anything else. This recovery window is time-limited — typically around 72 hours from when the change happened, though the exact cutoff can vary — so check that original inbox as soon as you realize the account was compromised, even if you haven't used that email address in years.
If the phone number was also changed, don't panic — keep escalating
Some hackers change both the email and the phone number to fully cut off recovery. If both the login-link flow (Step 2) and the changed-email reversal (Step 4) fail because neither contact method reaches you anymore, this doesn't mean the account is gone for good. It means you need to move to Instagram's Support Hub for identity-based recovery rather than contact-based recovery, covered in Step 6.
Escalate to Meta's Account Recovery / Support Hub
If the in-app flows above fail repeatedly, go to help.instagram.com from a browser (not a link in a DM or email — type the address yourself) and look for the "My Account Is Compromised" or Hacked Account report form. This routes your case to Meta's account recovery review team rather than relying purely on automated contact-method verification. Be ready to provide any information that proves the account is yours: the username, roughly when you created it, past linked emails or phone numbers, and details about your recent posts or connected Facebook/Threads account.
Complete identity verification if requested (video selfie or photo ID)
In stubborn cases — especially when both the email and phone were changed — Instagram may ask you to record a short video selfie turning your head in different directions, or to upload a photo ID, to confirm you are the real account owner and not the person who took it over. This is a legitimate, standard part of Meta's official recovery process when it happens inside the Instagram app or on help.instagram.com. It can feel invasive, but it exists specifically because it's very hard for a hacker to fake. Be patient — identity-verification review can take anywhere from about a day to several days depending on volume.
Never use a third-party "recovery service" or pay anyone to speed it up
Once your hacked account becomes visible (strange posts, missing profile), you may get DMs, emails, or ads from people or "recovery agencies" offering to get your Instagram back for a fee, or accounts claiming to be Instagram support asking you to send a verification code. This is one of the most common secondary attack vectors against people who have just been hacked — they are counting on you being desperate. Instagram never asks for payment to recover an account, and you should never share a verification code, login link, or password with anyone, including someone claiming to work for Meta or Instagram support. The only legitimate recovery paths are inside the Instagram app or at help.instagram.com.
The moment you're back in: reset your password and enable two-factor authentication
As soon as you regain access, don't just breathe a sigh of relief — the hacker may try to get back in within hours if you don't lock the door behind you. Go to Settings > Accounts Center > Password and Security. Set a new, unique password of at least 12 characters that you have never used on any other site. Then turn on two-factor authentication — an authenticator app (Google Authenticator, Authy, or a passkey) is stronger than SMS-based codes, though SMS is far better than nothing. This single step is the biggest deterrent against being hacked a second time.
Step 10: audit everything the hacker touched
Getting the password reset isn't the finish line. Go to Settings > Login Activity and log out any device or location you don't recognize — hackers who lose the password fight sometimes keep an active session open and simply wait. Then check Settings > Apps and Websites and revoke any third-party app you don't recognize; a common tactic is connecting a rogue app that keeps access even after you change your password. Finally, scroll through your recent posts, Stories, saved messages, and bio for anything the hacker added, since compromised accounts are frequently used to run scams (see the next section) before the real owner notices.
What to expect: a realistic recovery timeline
One of the most common questions we get is simply "how long is this going to take?" The honest answer depends entirely on which step above ends up working for you:
| Situation | Typical timeframe |
|---|---|
| Login link reaches your current email or phone (Step 2-3) | A few minutes |
| Changed-email reversal ("This wasn't me" link, Step 4) | A few minutes once found — but only valid for roughly 72 hours after the change |
| Support Hub escalation, no identity verification required (Step 6) | Several hours to about 2 days |
| Identity verification with video selfie or photo ID (Step 7) | 1 to 5+ days depending on review volume |
| Both email and phone changed, no verification submitted yet | Can stall indefinitely — submit the Support Hub form as early as possible |
The pattern is consistent: the sooner you act and the further up this list you can resolve things, the faster you're back in control. This is also why Step 1 — acting immediately rather than waiting a day to see what happens — genuinely changes the outcome for a lot of people.
What Hackers Actually Do With a Stolen Instagram Account
Understanding what happens while you're locked out helps you know what to clean up once you're back in. Compromised Instagram accounts are rarely defaced for fun — they're monetized, usually within hours of the takeover, because an account that's still fresh (before the real owner or their followers notice something is wrong) is far more valuable to a hacker than one that's already been flagged and reported. The most common patterns we see:
- Follower and DM investment scams: the hacker uses your identity and existing trust with your followers to message them directly, often pushing a fake cryptocurrency investment, a "giveaway" requiring a small upfront payment, or a link to a cloned login page designed to steal more Instagram credentials from your friends and family.
- Impersonation for financial fraud: especially on business or creator accounts, hackers pose as "you" to solicit payments from clients, brand partners, or customers who believe they're dealing with the real account owner.
- Reselling the account: accounts with a large, established follower count or a coveted short username are sometimes stripped of your content, renamed, and sold on gray-market marketplaces — this is why acting fast matters, since a resold account is much harder to recover.
- Using it as a launchpad to hack your other accounts: if your Instagram is linked to Facebook or Threads (very common under one Meta login), or if your DMs contain personal details, the hacker may pivot to attack those connected accounts next.
Protect linked Facebook and Threads accounts too
Because Meta accounts are frequently linked — the same login can control Instagram, Facebook, and Threads — a hacker who gets into one may already have a foothold in the others, or may attempt to pivot once locked out of Instagram. As soon as you've secured Instagram, check your linked Facebook and Threads accounts for the same warning signs: unrecognized login activity, changed contact info, or messages sent that you didn't write. Apply the same fix — new unique password, 2FA, and a login-activity review — to each linked account individually, since securing Instagram alone doesn't automatically secure the others.
Business, Creator, and Shop Accounts: A Few Extra Steps
If the hacked account is a business profile, a creator account with monetization enabled, or one connected to an Instagram Shop, recovery isn't finished once you're logged back in — you need to check a few things that personal accounts don't have to worry about.
- Ad accounts and payment methods: open Meta Ads Manager and check for any active or newly created ad campaigns you didn't authorize, and remove any payment card the hacker may have added. Compromised business accounts are frequently used to run fraudulent ad spend on a linked card before the owner notices.
- Shop catalog and checkout links: if you sell through Instagram Shopping, review your product catalog and any checkout or payment links for tampering — a hacked shop account can be used to redirect customer payments elsewhere.
- Meta Verified and badge status: confirm your verification badge, business category, and contact details (public email, phone, address) weren't altered, since these are exactly what "verification badge" phishing scams are designed to hijack.
- Partnership and branded content approvals: check Settings for any brand partner who was added to your account without your knowledge — this can let a third party publish "sponsored" posts using your identity.
- Notify collaborators and clients: if DMs went out to clients or brand partners while the account was compromised, a short follow-up message clarifying the account is secured again goes a long way toward limiting reputational damage.
Common Phishing Messages That Lead to Instagram Hacks
Nearly every Instagram takeover we hear about at IT Cares traces back to one of a small handful of message templates. Recognizing the pattern — not just the specific wording, since hackers constantly reword these — is what actually protects you.
| What the message says | What it's really after |
|---|---|
| "Your account has been reported for copyright infringement. Appeal within 24 hours or it will be permanently disabled." | A fake login page that captures your real password when you "appeal" |
| "Congratulations, you're eligible for the blue verification badge — confirm your identity and enter the code we just sent you." | Tricks you into forwarding your real 2FA code, handing over full account access |
| "We noticed unusual login activity. Secure your account now." (from a lookalike domain, not instagram.com) | A cloned login form that harvests your credentials |
| "Your account will be permanently deleted in 24 hours" with a countdown timer | Manufactured urgency to make you click without checking the sender |
| A DM from a "friend" with a strange link and no message context | Sent from an already-hacked account in their contact list — clicking often continues the chain |
The common thread: legitimate Instagram and Meta communications never ask you to type your password into a page reached through a DM or emailed link, and never ask you to read a verification code out loud or send it to someone else. If you're ever unsure whether a message is real, close it and navigate to instagram.com or the app directly rather than tapping anything inside the message.
How Instagram Hacks Usually Start — and How to Stop the Next One
Most Instagram account takeovers don't start with some sophisticated technical exploit — they start with the account owner being tricked into handing over their password or a verification code. Knowing the common bait makes you much harder to catch a second time.
- Fake "copyright violation" DMs or emails: a message claiming your content violates copyright, with a link to "appeal" or "verify your account" that leads to a fake Instagram login page designed to steal your password the moment you type it in.
- Fake "verification badge" offers: messages offering the blue checkmark if you "verify your identity" through a link or by sending a code you just received by text — that code is very often the actual 2FA code for your real account, and sending it hands the hacker everything they need.
- "Your account will be deleted" urgency emails: designed to make you panic-click a link without checking the sender's actual domain.
- Reused passwords from other breaches: if you've ever reused an Instagram password on another site that later suffered a data breach, that password may already be circulating and gets tried against Instagram automatically ("credential stuffing").
- Malware and keyloggers on your device: spyware installed on your phone or computer (sometimes from a pirated app, a malicious browser extension, or a phishing download) can silently capture your Instagram password and session as you type it, without any obvious sign anything is wrong.
The defense against nearly all of these is the same short list: enable two-factor authentication (an authenticator app or passkey rather than SMS alone, where possible), use a unique password you don't reuse on any other site, treat unexpected copyright, verification, or "account will be deleted" messages as phishing by default, and never enter your Instagram password or forward a verification code anywhere outside the official app. If you suspect malware caused the original breach in the first place, a device-level scan is worth doing alongside the account recovery — see our guide on warning signs your computer is hacked.
A quick prevention checklist for after you're back in
- Two-factor authentication turned on (authenticator app or passkey preferred over SMS)
- New password, 12+ characters, unique to this account, stored in a password manager rather than memorized or reused
- Recovery email and phone number reviewed and confirmed correct in Settings > Accounts Center
- Login Activity checked, unrecognized devices logged out
- Apps and Websites checked, unknown third-party connections revoked
- Linked Facebook and Threads accounts checked and secured with the same steps
- Linked email account's own password and 2FA also reviewed, since a hacked inbox is one of the most common paths into Instagram
- Followers and close contacts given a heads-up if scam DMs went out from your account while it was compromised
What not to do while recovering a hacked account
Don't create a brand-new Instagram account to "replace" the hacked one before you've exhausted recovery options — a fresh account starts with zero followers and history, and it's often not necessary. Don't share your password, a login link, or a verification code with anyone who contacts you offering to help, no matter how official they sound. Don't repeatedly submit multiple recovery requests at once hoping one works faster — this can slow down Meta's review of your case. And don't ignore the linked-account cleanup once you're back in; leaving Facebook or Threads unsecured is how some victims get hacked a second time within days.
Cleared the hack but still not sure your devices are safe?
IT Cares can't log into or recover your Instagram password for you — that step has to go through Meta's own identity verification, since only you can prove the account is yours. What we can do is help make sure the hack doesn't happen again: scanning your phone and computer for spyware or keyloggers that may have captured your credentials, setting up two-factor authentication properly across your accounts, and general account security hardening. Remote sessions available same-day.
Frequently Asked Questions
Can I recover Instagram without email or phone access?
It's much harder, but not always impossible. Try the "Need more help?" flow first and enter your username — Instagram will attempt to reach any contact method still on file, even one you don't currently have easy access to. If that fails, escalate to Meta's Account Recovery form at help.instagram.com, which can ask for a video selfie or photo ID to verify your identity without relying on the compromised email or phone at all. It takes longer this way, sometimes several days, so start it as early as possible.
How long does Instagram account recovery take?
If you still have access to the linked email or phone, the login-link flow is usually instant to a few minutes. The changed-email reversal is also fast once you find and click the "This wasn't me" link, but that link is typically only valid for about 72 hours after the change, so don't delay. If you have to escalate to identity verification with a video selfie or ID, expect anywhere from 24 hours to several days depending on volume — file that request as soon as the faster paths fail rather than waiting to see if things resolve on their own.
What if the hacker changed my email and phone number?
The "This wasn't me" alert sent to your original email is still your best shot, since Instagram sends it automatically the moment the login email is changed, before the hacker can strip that original address from the account's records. If that window has already closed and both contact methods are gone, go straight to help.instagram.com's Account Recovery / Hacked Account form and be ready to complete identity verification with a video selfie or photo ID. Never pay a third party claiming they can recover it faster — that's a common secondary scam aimed specifically at people in this exact situation.
Is Instagram's video selfie verification safe?
Yes, when it happens inside the official Instagram app or at help.instagram.com. It's used only to match your face against photos already associated with your account, and Meta states the video isn't used for facial recognition matching against a wider database and is deleted after the check. It is never requested by DM, by an email link from a stranger, or on any site other than instagram.com or help.instagram.com. If someone messages you asking you to record a selfie and send it directly to them, or asks for a verification code alongside it, that's a scam impersonating the real process.
How do I stop my Instagram from being hacked again?
Turn on two-factor authentication (an authenticator app or passkey rather than SMS alone where possible), use a unique password you don't reuse anywhere else, and treat every DM or email about "copyright violation," a "verification badge," or your "account will be deleted" as phishing until proven otherwise — never tap the link or type your password anywhere except the official app. Check Settings > Login Activity and Apps and Websites periodically to catch unauthorized access early, and make sure your linked email account has its own two-factor authentication turned on too, since a hacked email is one of the most common back doors into Instagram.
Comments (3)
I fell for a fake "copyright violation" DM and lost access within minutes. The "Need more help?" trick got me back in less than 10 minutes once I actually found it — I had been stuck on the regular password reset screen for an hour first. Wish this guide had come up before I panicked and almost paid one of those "recovery service" accounts that messaged me.
The hacker changed my email almost immediately so the login link went nowhere. Nearly gave up until I checked an old Hotmail address I hadn't used in years and found the "this wasn't me" email sitting there from two days earlier. Clicked it just in time. Didn't realize how tight that window actually is — glad I checked when I did.
Both my email and phone number got swapped so I had to go through the full identity verification with the video selfie. Felt strange doing it but it worked — took about two days. Also want to warn people: I got three separate DMs from "recovery experts" offering to speed it up for $150 while I was waiting. All scams, all reported. Just be patient and use the official form.
Leave a Comment