How do I recover a hacked Instagram account?

Message, meaning, route and timeline at a glance

Signs that someone has taken over your Instagram account

Instagram does not always warn you. The signs people report most often are these:

• Security emails you did not expect. A message saying your email address, phone number or password was changed, or a login code you never asked for.
• Activity you did not do. Posts, Stories, direct messages, follows or a changed profile photo or username.
• The password stops working and the “Forgot password?” code goes to an address you do not recognise.
• Friends receive odd messages from you, often a link or a request for money or a code.
• Unknown devices or places in the login activity of your account settings.

If you are not sure, treat it as a takeover. Changing a password costs nothing; waiting can cost the account.

The first ten minutes

1. Check the email linked to the account first. Look in the inbox and the spam folder for messages from Instagram about a change of email or password. Instagram’s Help Center says such a message includes a link to undo the change; use it before anything else, and do not forward it to anyone.
2. Secure that email account. Change its password and turn on two-factor authentication there. If the attacker controls your email, they can keep resetting Instagram.
3. If you can still log in, change the Instagram password, log out of all other devices in the login activity page and review the connected apps.
4. If you cannot log in, go to instagram.com/hacked and follow the questions it shows. Use the device and network you normally use, because location and device are part of what Instagram can compare.
5. Warn your contacts through another channel so they do not click links or send money.
6. Write down the dates: when you last had access, when you noticed the change and the time of each security email.

The official recovery routes

Instagram has a page dedicated to hacked accounts, which is where all the routes start. Which one you see depends on what you can still do.

• You still have the email or phone on the account: choose “Forgot password?” on the login screen and request a code or link. This is the fastest route and works for most takeovers where the login details were not replaced.
• The login details were changed: use instagram.com/hacked, say that someone else has access and follow the steps. Instagram may ask for a new email or phone number so it can contact you, and it may ask you to confirm who you are.
• Video selfie: Instagram’s Help Center says that in some cases it asks you to record a short video of your face from several angles to confirm you are the person in your photos. It says it does not keep the video for other purposes, but read the current wording in the Help Center before you start. It is not offered to everyone.
• The account is linked to a Facebook profile: you may be able to log in through Facebook. Our guide to linking Instagram to Facebook to recover an account explains when that helps.

Instagram publishes no review time for these requests. Users report anything from a few hours to several days, and cases that need identity checks take longer. Submit each request once; repeating it does not shorten the wait.

If they changed your email, phone number or username

This is the hardest case, and the one where timing matters most. If you find a message from Instagram about the change of email, the undo link in that message is your best option, because it comes from Instagram and refers directly to the previous address. Instagram’s Help Center describes that link; it does not say how long it stays active, so do not leave it for later.

If the undo link no longer works, go to the hacked-account flow and enter the old email address or phone number you used to have. The flow can then offer to send a code to a new contact you provide and, where it considers it necessary, ask for a video selfie. Do not create a second account to “ask” the hacker for the first one back. Never pay or negotiate with the person who has the account.

A message you can use in the hacked-account form

Keep it short and factual. Do not include your password, and do not send more than one request for the same account.

Secure the account once you are back in

1. Change the password to one you have never used elsewhere, and change the password of the linked email as well.
2. Turn on two-factor authentication. Instagram supports an authentication app, text message codes and, on some accounts, security keys. An authentication app is generally harder to intercept than SMS.
3. Log out of every other device and check that the email and phone number on the account are yours.
4. Review the connected apps and remove any you do not recognise.
5. Delete posts, messages or links the intruder sent, and tell your followers that the account was compromised.
6. Check Account Status in the settings to see whether Instagram removed any content or restricted the account while it was controlled by someone else.

Recovery scams to avoid

• Anyone who asks for your password. Instagram never asks for it, and a helper who needs it can keep the account.
• Apps and websites that “unlock” or “hack back” accounts. No app has a hidden route into Instagram’s systems.
• Direct messages from “Instagram support” or a “verified” account offering to restore the account for a fee or a code.
• Payment in gift cards or cryptocurrency to people you do not know. Recovery runs through the Help Center forms, which are free.

If you are tempted by a service, read our guide on which Instagram appeal route applies to you first, so you know what can be done free of charge.

Is there a service that can recover a hacked account for me?

Some companies offer to handle the process for a fee. What they can do is prepare the evidence, choose the right Help Center route and follow the case; they cannot change the decision, which belongs to Instagram. Be wary of anyone who asks for your password, promises a result or demands payment before explaining what they will do. For most takeovers, the free official route is the right starting point.

When a hacked account cannot be recovered

• You can no longer prove ownership. If the email, phone and device that identified you are gone and Instagram cannot match your face or details, it may not restore access.
• The account was deleted by the intruder or by Instagram after the takeover and the period in which Instagram can restore it has passed. Instagram does not state one period for every case.
• The account was permanently disabled for what was posted while it was compromised, and the appeal was rejected. In that case read our guide to the disabled-account appeal.

If recovery fails, secure your email, warn your contacts, report impersonation if the intruder is using your name and, if you rely on the account, build a new profile that follows the rules and add two-factor authentication from day one.

Frequently asked questions

Official sources

• Instagram Help Center: Hacked Instagram account
• Instagram Help Center: Secure your account
• Instagram Help Center: Two-factor authentication
• Instagram Help Center: Check your Account Status