Short answer
Open Instagram → Accounts Center → Password and security → Recent emails. It lists the security and other emails Instagram really sent you in the last 14 days. If the message you received isn’t there, don’t trust it. Other red flags: threats that your account will be deleted within hours, “copyright” or “guideline” notices asking you to log in through a link, and anyone asking for your password or codes. Instagram never contacts you about account security by direct message. Forward fakes to phish@instagram.com and delete them.
The usual disguises
- “Copyright infringement”: a post was reported and you must “appeal” within 24 or 48 hours.
- “Community guidelines violation”: your account will be disabled unless you verify.
- Blue badge or Meta Verified offers you never applied for.
- “Meta Support” pages on Facebook or Instagram that DM you a form.
All of them lead to a login page that copies Instagram’s look and steals what you type.
The one-minute check
- Open the Instagram app — not the link in the email.
- Go to Accounts Center → Password and security → Recent emails.
- Look under Security and Other for the message. If it’s not there, it didn’t come from Instagram.
- Check the sender too: Instagram lists official sending addresses such as @mail.instagram.com and @facebookmail.com — but lookalike domains exist, so the recent-emails list is the real test.
Unrequested password-reset emails
A password-reset email you didn’t ask for doesn’t necessarily mean you were hacked — someone may have typed your email or username by mistake. Don’t click it if you are unsure; open the app yourself. If you are worried, change your password and turn on two-factor authentication.
If you already clicked and logged in
- Change your Instagram password immediately from the app and log out of other sessions.
- Change the password of your email account too.
- Check Recent emails for real security alerts — a genuine “email changed” message includes a link to revert the change.
- Turn on two-factor authentication with an authenticator app.
- If you are already locked out, follow hacked Instagram.
Report and move on
Forward phishing emails to phish@instagram.com and report fake “support” profiles in the app. When a phishing attack has already cost you the account, our hacked account recovery service works the official recovery route with you — we never ask for passwords or codes.
Frequently asked questions
Does Instagram send copyright notices by email?
If a real report affected your account, it shows up in the app. Check Account Status and Recent emails there instead of trusting a link.
Will Instagram DM me about my account?
Instagram says it never contacts you about account security through direct messages.
Which addresses does Instagram send from?
Instagram lists several, including @mail.instagram.com and @facebookmail.com. Because lookalikes exist, confirm through the Recent emails list.
I typed my password into a fake page. Is it too late?
No — change it immediately from the app, change your email password and turn on 2FA. Speed matters more than anything else.
Sources: Instagram Help — how to know if an email from Instagram is authentic, Instagram Help — protect yourself from phishing, Instagram Help — password reset email you didn’t request