How to Recover a Hacked Instagram Account in 2026: A Step-by-Step Guide
A step-by-step guide to recovering a hacked Instagram account and locking it down afterwards.
Losing control of your Instagram account feels personal. Your photos, messages, followers and sometimes your business are suddenly in someone else’s hands, and the attacker may already be messaging your contacts. The good news is that most hacked accounts can be recovered if you act quickly and stick to Instagram’s official recovery channels. This guide walks you through every step, from spotting the hack to locking the account down so it does not happen again.
Direct answer: To recover a hacked Instagram account, open the Instagram app and use the “Forgot password?” or “Get help logging in” option, then follow the official recovery flow to prove your identity, often with a login link sent to your email or phone, or a video selfie check. If the attacker changed your email and phone, use the “I can’t access this email or phone number” path and complete identity verification. Act fast, use a clean device, and never share a verification code with anyone.
Signs Your Instagram Account Has Been Compromised
Not every strange notification means a hack, but a combination of these signs is a strong warning. Posts, stories or reels you did not create may appear on your profile. Your bio, profile photo or linked email may have changed without your knowledge. You may receive a password reset email from Instagram that you did not request, or a security email saying your email address was changed.
Other red flags include direct messages sent to your followers that you did not write, often promoting fake giveaways or asking for money. You may also be logged out on all devices, or notice follower counts shifting because the attacker followed spam accounts. If friends tell you they received odd messages from you, treat it as a confirmed compromise.
First Steps: Act in the First Hour
Speed matters because an attacker will usually try to change the recovery email and phone number quickly. Once those are changed, recovery takes longer. Work through these steps in order, and do them from a device you trust, not a shared or public computer.
- Check your email inbox. Search for messages from Instagram about a password change, email change or new login. The email change message contains a “secure your account here” style link that lets you reverse the change if you act promptly. Do not click links in suspicious messages though; first check the sender address carefully. Learning how to spot a phishing email will help you tell a real Instagram message from a fake one.
- Try to log in and change your password. If you can still get in, go to Settings, Accounts Center, Password and security, and change your password immediately. Choose a long, unique password you do not use anywhere else.
- Revoke unknown sessions. In the same Password and security section, open “Where you’re logged in” and log out of every device you do not recognise. This kicks the attacker out of active sessions.
- Secure your email account first. Your email is the key to resetting Instagram, so change its password too, and turn on two-factor authentication there before anything else. If the attacker still controls your email, they can undo every Instagram fix you make.
- Scan your device for malware. Run a scan with a reputable security app, especially if you recently installed an app from outside an official store or clicked a suspicious link. A compromised phone can hand your new password straight back to the attacker.
The Official Instagram Recovery Flow
Instagram’s recovery process starts on the login screen. Tap “Forgot password?” on iPhone or “Get help logging in” on Android, then enter your username, email or phone number. Instagram will offer to send a login link or code to an address or number on file. If you still have access to either, that link gets you back in within minutes.
When You Can Still Access Your Email or Phone
Use the login link, then change your password and review your account details right away. Check that the email and phone number listed under Accounts Center are yours, and remove any unfamiliar ones. Then turn on two-factor authentication (see the hardening section below) before doing anything else.
When the Attacker Changed Your Email and Phone
This is the harder path, but it is still recoverable. On the login help screen, tap “I can’t access this email or phone number” or “Try another way”. Instagram will ask for information to verify you own the account, which may include confirming details about the account or completing a video selfie verification. The video selfie is compared against photos of you already on the account, and Instagram states it is used only for verification and deleted afterwards.
Be patient here. Video selfie reviews can take hours or a few days. Submit one clear, well-lit video, and do not submit repeated attempts while one is pending, as that can slow the process.
What to Do If Recovery Fails the First Time
If the automated flow rejects you, try again from a device and network you have used with the account before, such as your home Wi-Fi and your usual phone. Instagram weighs familiar devices and locations when judging whether you are the real owner. Try the “request support” or “need more help” options inside the recovery flow rather than looking for a support phone number, because Meta does not offer account recovery by phone, and anyone claiming to recover accounts for a fee is running a scam.
While you wait, warn your followers. Post from a backup account or ask a trusted friend to post that your account is compromised and that messages from it should be ignored. This limits the damage if the attacker is messaging your contacts with scams.
Reporting Impersonation and Scam Activity
If the attacker is impersonating you or posting scams, those posts can be reported even while you are locked out. Friends can report the account from its profile page by tapping the three dots, choosing Report, and selecting the impersonation option. Keep screenshots of scam posts and messages, including usernames and timestamps.
Also check whether your email address has appeared in a known data breach, since credential leaks are a common route into accounts. Our guide on how to check if your email was in a data breach explains how to do this safely. If your password was exposed, change it everywhere you reused it, starting with your email and banking apps.
Hardening Your Account After Recovery
Getting the account back is only half the job. Attackers often try again, and the same weak point will let them in a second time. Work through this checklist as soon as you regain access.
| Protection | What to do | Why it matters |
|---|---|---|
| Authenticator app 2FA | Turn on two-factor authentication with an authenticator app in Accounts Center, not SMS alone | Codes generated on your device cannot be intercepted the way SMS codes can |
| Backup codes | Save the backup codes Instagram provides somewhere safe and offline | They let you log in if you lose your phone |
| Password manager | Generate a unique, long password and store it in a password manager | Reused passwords are the most common way accounts fall |
| Login alerts | Turn on login activity alerts in Password and security | You hear about a new login within minutes, not days |
| Third party apps | Review “Apps and websites” and remove anything you do not use | Old app permissions are a quiet back door into your account |
An authenticator app such as Google Authenticator, Microsoft Authenticator or Authy is a meaningful upgrade over SMS codes, which can be stolen through SIM swapping. If you need help choosing one, see our roundup of the best 2FA apps. Where Instagram offers passkeys on your device, consider enabling them as well, since a passkey cannot be phished the way a password can.
Never Share Codes or Passwords, Even With “Support”
This warning deserves its own section because it is where many victims lose their account a second time. Instagram and Meta support will never ask you for your password, your two-factor code or a verification code sent to your phone or email. Anyone who contacts you claiming to be Instagram support and asking for a code is a scammer. The same applies to “recovery agents” who charge a fee: they cannot speed up Instagram’s process. Guidance from the US Cybersecurity and Infrastructure Security Agency (CISA) on phishing repeats the same rule: legitimate services do not ask you to hand over credentials or codes.
Frequently Asked Questions
How long does Instagram account recovery take?
If you still have access to your email or phone, recovery usually takes minutes through a login link. Identity verification with a video selfie takes longer, often several hours and sometimes a few days. Submitting one clean attempt and waiting is faster than sending repeated requests.
Can I recover my account if the hacker changed my email and phone?
Yes, in most cases. Use the “I can’t access this email or phone number” path in the login help flow and complete identity verification, which may include a video selfie or confirming details only the account owner would know. Original signup details and a familiar device strengthen your case.
Will Instagram support recover my account by email or phone?
No. Meta does not offer account recovery through a support phone line or by direct email, and there is no paid fast track. Any service promising recovery for a fee is a scam. The only safe route is the official in-app recovery flow and the help center forms.
Should I delete my hacked account and start over?
Only as a last resort. Recovery preserves your followers, posts and messages, and a new account leaves the hacked one in the attacker’s hands to scam your contacts. Try the full recovery flow first, and report the account as hacked while you wait.
How do I stop my Instagram account from being hacked again?
Use a unique password stored in a password manager, turn on authenticator app two-factor authentication, save your backup codes, revoke unknown sessions and third party apps, and keep your email account equally protected. Also pause before clicking login links in messages, since phishing is a leading route into accounts.
Conclusion
Recovering a hacked Instagram account comes down to three moves: act fast while your recovery details are still intact, use only Instagram’s official recovery flow and identity checks, and harden the account the moment you are back in. The video selfie step and the waiting period are frustrating, but they exist to stop an attacker from claiming your account with the same ease they stole it. Secure your email, switch to authenticator app two-factor authentication, and never hand a code to anyone, and your account will be far harder to take a second time.
