If your Instagram account was hacked, speed and the right order of steps matter. This guide explains how to recognize a hack, what to do in the first minutes, how to recover access in each situation, how to secure the account afterwards, how accounts get hacked and the recovery scams to avoid.
Quick answer: if your Instagram account hacked, try Forgot password, check your email for Instagram’s change alert and undo link, then use the hacked-account flow at instagram.com/hacked with a login link, security code or video selfie. Once you are back in, secure your email, change your password, log out other devices and turn on two-factor authentication. Never pay a recovery service.
Key Takeaways
- Act fast: check your email for Instagram’s change alert and use the hacked-account flow.
- Recovery depends on whether you still control your email or phone; identity verification may be required.
- After recovery, secure your email first, then your password, devices, apps and two-factor authentication.
- Most hacks start with reused passwords, phishing or fake support.
- Avoid anyone who offers to recover or hack back for a fee.
Table of Contents
Signs Your Instagram Account Was Hacked
- You are logged out and your password no longer works.
- You receive emails or texts about a changed email, phone number or password you did not make.
- Posts, stories, follows or DMs you did not send.
- Unknown devices in your login activity.
- Your username, bio or profile photo changed.
- Friends tell you they received strange messages from you.
A hacked Instagram account is not always obvious. If you only see a login alert from a place you do not recognize, change your password and review your devices first. See how to check Instagram login devices.
Instagram Account Hacked: What to Do Right Now
Figure 1. The usual recovery path for a hacked Instagram account.
- Try to log in and use Forgot password with your username, email or phone. If you can reset it, do so, then follow the security steps below.
- Check your email (including spam) for a message from Instagram about a change to your email, phone or password. Instagram says these messages include a way to undo the change, so act quickly because links can expire.
- Use Instagram’s hacked-account flow. Go to instagram.com/hacked or Help Center → Privacy and Safety Center → Hacked accounts, and choose the option that matches your situation.
- Request a login link or security code sent to an email or phone number that still belongs to you.
- Verify your identity if asked. Instagram may ask for a video selfie or other proof.
- Wait for the official response. Do not contact people who offer to recover it for a fee.
Menu names change, so follow the options you see. If you changed your own password and forgot it, read how to change or reset your Instagram password.
Instagram Account Hacked: Recovery by Situation
| Your situation | What to try |
|---|---|
| You can still log in | Change your password, log out other devices and turn on two-factor authentication right away |
| The password was changed but you control the email | Use Forgot password to send a login link to that email |
| The email or phone was changed | Look in the old email for Instagram’s change alert and use the undo link; then use the hacked-account flow |
| You no longer have any access to the email or phone | Use the hacked-account flow and identity verification (such as a video selfie) |
| The account was disabled or deleted | See what to do if your account is banned or disabled |
| It is a business account | Also secure the Meta Business and ad accounts connected to it |
If the account was disabled, read what to do if your Instagram account is banned.
After You Get Back In: Secure the Account
- Secure your email first. Change its password and turn on two-factor authentication there. The hacker may have started from your email.
- Change your Instagram password to a long, unique one stored in a password manager. See how to see your Instagram password for where passwords are saved.
- Log out of all other devices. In Accounts Center, open Password and security and look for where you are logged in (names vary).
- Turn on two-factor authentication, preferably with an authentication app instead of SMS.
- Remove unknown apps and websites that have access to your account.
- Check your email, phone number and linked accounts for changes.
- Review what the hacker did. Delete posts, undo follows, check DMs and tell followers not to click anything sent from your account.
Our guide to two-factor authentication on Instagram shows where the setting lives.
How Do Instagram Accounts Get Hacked?
| Method | How it works | How to avoid it |
|---|---|---|
| Reused or weak passwords | A leaked password from another site is tried on Instagram | Use a unique password for every account |
| Phishing DMs and emails | Fake copyright notices, giveaway winners or “verification badge” offers send you to a fake login page | Instagram will not ask for your password in a DM. Open the app directly |
| Third-party apps and sites | Tools that ask for your password or broad access | Never share your password; review connected apps |
| Fake support accounts | Someone pretending to be Instagram or a recovery expert | Use only Instagram’s official flows |
| Stolen email or phone access | The hacker resets Instagram through your email or SIM | Secure your email and set a SIM or carrier PIN |
| Malware or a shared device | A compromised device keeps a login | Keep devices updated and log out on shared ones |
Fake giveaways and copyright warnings often arrive in DMs or Requests. See Instagram message requests and the Instagram direct message guide for how to spot scam messages.
How to Prevent an Instagram Account Hacked Again
- Use a unique password for Instagram and your email.
- Turn on two-factor authentication with an authentication app.
- Never log in through links sent in messages.
- Check login activity every few months. See how to check Instagram login devices.
- Remove apps you no longer use.
- Do not give your password to any growth or scheduling service. Use tools that connect through official authorization.
- Keep your email and phone number up to date so recovery links reach you.
Instagram Account Hacked: Recovery Scams to Avoid
- Anyone who guarantees to get your account back for a fee.
- Accounts that offer to “hack back” the hacker.
- Messages claiming to be Instagram support and asking for your password or a code.
- Links asking you to “verify” your account on a non-Instagram website.
There are no legitimate apps that hack someone else’s account, and trying to access another person’s account is illegal in many countries. If you suspect impersonation, see how to report a fake Instagram account.
Sources
- Instagram Help Center (search for Hacked accounts)
Frequently Asked Questions
What should I do first if my Instagram account hacked?
Try the login link or Forgot password, check your email for Instagram’s change alert, and use the hacked-account flow on instagram.com/hacked.
How do I know if my Instagram account was hacked?
You may be logged out, receive change alerts, see posts or messages you did not send or find unknown devices in your login activity.
Can I recover a hacked Instagram account if the email was changed?
Often yes. Check the old email for Instagram’s change alert with an undo link, and use the hacked-account flow with identity verification if needed.
How long does Instagram take to respond?
Instagram does not publish a fixed time. Third-party guides report replies from a day to several days, and complex cases can take longer.
Should I pay for an Instagram recovery service?
No. Use only Instagram’s official flow. Paid services and people who contact you offering recovery are common scams.
How can I stop my Instagram from being hacked again?
Use a unique password, turn on two-factor authentication, secure your email, review connected apps and never log in through links in messages.
Want Help Managing Your Instagram Safely?
AiGrow offers account management services. This is our own product, so evaluate it like any other provider and never share your Instagram password with any service.
See Instagram Management