How to recover a hacked Instagram account, step by step
The order of operations to recover a hacked Instagram account in each of the three situations you can be in, then the settings that stop it happening again.
To recover a hacked Instagram account, open your email first and search for messages from Instagram about a changed email address, phone number or password. Those messages carry a link that reverts the change, and that link is the fastest route back in.
Which steps apply depends on which of three situations you're in. Work that out first, then follow the matching section.
One note: every menu path here is approximate. Instagram moves settings around constantly, and the app, the website and the Meta Accounts Centre each show slightly different screens, so I describe paths as "Settings, then Security" rather than giving exact labels.
Work out which situation you're in
You can still log in. The attacker has your password or a session on another device but hasn't locked you out yet. Speed matters most here, because every minute they keep access they can use to change the recovery details.
The email or phone on the account was changed. Your password doesn't work and reset codes go somewhere you can't see. This is the common case for a hacked Instagram account.
The account is deleted, disabled or suspended. Either the attacker deleted it, or Instagram disabled it because the attacker used it for spam and tripped a rule. The route back is an appeal.
Not sure which? Start the "forgot password" flow and see where the code is sent. Instagram shows a partially masked address. If you don't recognise it, you're in situation two.
Situation one: you can still log in
Do these in order, without pausing between them.
- Change the password. Settings, then Password and security. Pick something you've never used anywhere else, ideally generated by a password manager.
- Log out of all other sessions. Same area, look for "Where you're logged in". Log out every device you don't recognise. If you change the password and skip this, the attacker's existing session can stay valid. A password is checked at login, not continuously, as I keep saying in the passkeys vs passwords vs 2FA post.
- Check the email and phone number on the account. Remove any the attacker added. If they've already swapped yours, move to situation two.
- Turn on two-factor authentication with an authenticator app, not SMS.
- Read the security emails Instagram sent. They tell you what was changed and when.
Situation two: the email or phone was changed
Instagram emails the old address when the email on an account changes, and that email includes a link to revert it. Search your inbox and spam for anything from Instagram or Meta around the time you lost access. If the link works, click it: it restores the old email and usually lets you reset the password immediately.
If the link is gone, use the login help flow. On the login screen, tap "Forgot password?" or "Get help logging in", enter your username, and look for "Can't reset your password?" or "Need more help?". It asks for an email or phone you control now, which is where Instagram sends its replies.
For accounts with photos of you in them, the next step is the video selfie check. Instagram asks you to record a short video turning your head and compares it to the photos on the account. It's useless for a brand page or an account full of landscapes.
If the selfie route isn't offered, go through the official help centre. Search for "hacked" on help.instagram.com and follow the reporting form. Replies come by email and can take days. That's why the revert link matters so much.
Don't contact the attacker. It does nothing except give them a hook.
Situation three: the account was deleted or disabled
If the attacker deleted the account, try logging in anyway. Instagram keeps a deleted account recoverable for a window (the length is a policy that can change), and logging in during it typically offers to restore. If the password was also changed, do the situation two steps first.
If Instagram disabled the account, the login screen says so and points to an appeal form. Say the account was taken over, give the approximate date, and describe what the attacker did if you know. Appeals take time and aren't guaranteed. I'd still file one, because a disabled account also stops the attacker trading on your name.
If you're in India and money changed hands, or your followers were defrauded through your account, report it at cybercrime.gov.in or call the 1930 helpline. Readers elsewhere should use their national cybercrime reporting line. It creates a record that matters if a victim later comes to you.
Lock it down so it doesn't happen twice
Getting back in is half the job. The other half is closing the doors the attacker used.
Revoke every session you don't recognise. Password and security, then "Where you're logged in". Log out everything that isn't the device in your hand.
Remove unknown linked apps. There's a section for apps and websites granted access to your account. A third-party app the attacker connected keeps its own token after a password change, so it stays a route in. Remove anything you don't use.
Turn on 2FA, authenticator app first. SMS can be defeated by a SIM swap or by someone holding your phone. An authenticator app stops the password-only attacker completely and costs about two minutes to set up. Save the backup codes somewhere that is not your Instagram inbox.
Check the linked Facebook account. Instagram and Facebook share login through the Accounts Centre, so a compromised Facebook can be used to log into Instagram and the reverse. Run the same session, password and 2FA steps there. If you don't need the link, remove it.
Check your email account. The attacker got in somehow, and if they had your email they can do this again tomorrow. Repeat the sequence there, and run the address through our breach exposure check.
Tell your followers. A short story saying "my account was taken over, ignore anything sent from it" protects the people the attacker was really after.
Recovery services are a second scam
Post about being hacked and the replies fill with accounts offering to recover it for a fee. Some call themselves ethical hackers, some claim to know someone at Meta.
None of them can do anything you can't do yourself through the steps above. There is no back door into Instagram's recovery process that a stranger on Telegram has access to. What they do have is your money once you pay, and often your new password once you "verify" it with them. I'd treat anyone who DMs you offering recovery as the attacker, or a colleague of theirs. Block, don't reply.
Frequently asked questions
How long does Instagram take to recover a hacked account?
The revert link in the security email works instantly. The video selfie check usually resolves within a day or two. The help centre form and the disabled-account appeal have no official timeline and can take longer.
Can I recover my Instagram account without the email or phone number?
Yes, through the "Need more help?" path in the login help flow and the video selfie check, as long as the account has photos of you. Otherwise the help centre form is the remaining route and it's slower.
Should I use SMS or an authenticator app for Instagram 2FA?
Authenticator app. SMS codes can be intercepted through a SIM swap or read off a phone someone else is holding. An app-based code lives on your device and never crosses the phone network.
What should I do in the first hour, before I even start with Instagram?
Secure your email, because every other recovery runs through it. Komal's post on the first hour of a hacked account explains the ordering, and the hacked account triage tool turns it into a checklist you can work through while you wait for Instagram's reply.
If this just happened to you, close this tab, open your email, and search for "Instagram" sorted by newest. That message, if it's there, is the way back in.