Instagram says there was a new login: what to do if it wasn’t you

What to do first

Don’t tap the link in the alert. Open the Instagram app or website directly. Then check whether you can still log in. If you can, work through the steps below in order. If your password no longer works, go straight to the hacked-account guide instead.

Step 1: Confirm the alert is real

Fake alerts are common. In the app you can review the recent emails Instagram has sent to you, found in the Meta Account or Accounts Center security area under Recent emails. Security emails from the last 14 days appear there. If the message you received isn’t listed, treat it as phishing and ignore its links.

Step 2: Review where you’re logged in

In Accounts Center, open Password and security and then Where you’re logged in. You will see devices, locations and times. A familiar phone in the right city is fine. Log out of anything you don’t recognise. Location is approximate and can show a nearby city or your mobile carrier’s hub, so look at the device type and the time too.

Step 3: Change your password and turn on two-factor authentication

Pick a password you use nowhere else. Then switch on two-factor authentication, ideally with an authentication app, and save the backup codes. Instagram’s own hacked-account page lists these steps as the first things to do if you can still log in.

Step 4: Check what could be attached to the account

• Confirm the email and phone number in your settings are yours.
• Check Accounts Center for linked accounts you don’t recognise.
• Revoke third-party apps you no longer use.
• If it’s a business account, check linked Pages and ad accounts for changes.

Signs the account is already compromised

Sometimes the alert arrives after the damage. Look for a handful of signals: posts or Stories you didn’t make, DMs sent to people you don’t talk to, a changed bio or link, new accounts followed in bulk, or emails from Instagram about a changed email address or phone number. Any one of these means you should treat the account as taken over, even if you can still log in. Change the password, log out all sessions, and tell followers through another channel so they don’t click links sent from your account.

If you run the account with a team, ask each person to check their own devices and email. A single infected laptop or a reused password on one team member’s other account is a common way in.

Step 5: Secure the email behind the account

An Instagram password reset goes to your email, so a hijacked mailbox is a hijacked Instagram. Change that password too, turn on two-factor authentication on the email itself, and check the mailbox for forwarding rules or filters you didn’t create. Attackers sometimes add a rule that hides messages from Instagram so you never see the warnings.

What not to do

• Don’t reply to the “security team” DM or email asking you to “verify” with your password or a code.
• Don’t log in through a link in a message to “cancel” a login. Open the app yourself.
• Don’t keep using the same password on other sites. Change those too if you reused it.
• Don’t ignore it because nothing seems to have changed. Some takeovers wait before acting.

If the password stops working

If you’re logged out and the details have changed, use instagram.com/hacked and the steps in our hacked Instagram recovery guide. Check your old email for a message from Instagram about the change, because it usually includes a link to undo it.