Hacked Instagram account recovery: a step-by-step guide

Signs your account was hacked

• Your password suddenly stops working.
• You receive an email from Instagram saying your email address, phone number or password was changed when you did not do it.
• Posts, stories or messages appear that you did not send.
• Your username or profile details have changed.
• Friends tell you that you are sending them suspicious links or crypto offers.

If you can still log in, change your password immediately, then go to Accounts Center > Password and security to review where you are logged in and remove sessions you do not recognise.

Step 1: Check for Instagram’s security email

When an account’s email address is changed, Instagram sends a message to the previous address. That email typically contains a link to reverse the change and secure the account. Search your inbox (and spam) for recent messages from Instagram. If you find one that mentions a change you did not make, use the link it provides.

Only trust emails from Instagram or Meta domains. You can check recent official emails from inside the app under the security settings once you are back in.

Step 2: Use instagram.com/hacked

Instagram’s dedicated recovery flow lives at instagram.com/hacked. It is the official starting point for compromised accounts and works from a browser or from the “Forgot password?” / “Need more help?” options on the login screen.

1. Open instagram.com/hacked and choose the option that matches your situation – for example, that your account was hacked or that you can no longer access the email or phone on it.
2. Enter the username, email or phone number associated with the account.
3. Request a security code to an email or phone you still control.
4. Follow the prompts. If Instagram cannot send a code to something you control, it may offer identity verification instead.

Step 3: Verify your identity

For accounts with photos of you, Instagram may ask for a video selfie, turning your head in different directions. Instagram uses it to confirm that you are a real person and that you match the account. For accounts without photos of the owner, it may ask other questions about the account, such as the email or phone used to sign up and the type of device used.

Use the device and network you normally use for Instagram where possible, follow the prompts exactly, and complete the process once. Verification requests are reviewed by Instagram; there is no published turnaround time.

Step 4: Secure the email and phone first

Hackers often take over the email account first. If your email was compromised, recover it through your email provider’s own recovery process before going further – otherwise the attacker can simply reset Instagram again. Change that email password, turn on two-factor authentication there, and check its forwarding rules for anything you did not set up.

Step 5: Lock the account down

• Change your Instagram password to something unique that you do not use anywhere else.
• Turn on two-factor authentication, preferably with an authentication app.
• Review logged-in devices and remove anything unfamiliar.
• Remove third-party apps you do not use from the account’s connected apps.
• Check that the email, phone, username and bio are yours, and delete any posts or messages the attacker sent.
• Tell your followers if they received scam messages from you.

Avoid recovery scams

Recovery scams are very common. Be wary of anyone who contacts you first, claims to work for Meta, or asks for your password, login codes or upfront payment in crypto or gift cards. Instagram does not sell account recovery through DMs. Unbanz never asks for passwords or codes; a case check starts with the username and screenshots of what you see.

What to gather before you start

Recovery is easier if you have the facts ready before you open the recovery flow:

• The username (and any old usernames) of the account.
• The email addresses and phone numbers you have ever used on it.
• Roughly when you created the account and what device you used.
• Screenshots of any security emails from Instagram about changed details.
• Photos of you that appear on the account, if any – these matter for video selfie checks.

Work from a device and network you have used with Instagram before. Logging in from a familiar phone and home Wi-Fi gives Instagram’s systems a more consistent signal than a brand-new device in a new location.

If the account was disabled after the hack

Attackers sometimes use a stolen account to post spam or scams, which can get it disabled. In that case the account is both compromised and enforced against. Start with instagram.com/hacked, mention that someone else had access, and see our guide to a disabled Instagram account. If you are stuck, our Instagram recovery service can take on your case: we review it and quote before we start.