Hacked Instagram account: how to get it back fast

Takeovers follow a predictable script: change the email, change the phone number, switch on the attacker’s own two-factor authentication, then lock you out. Speed decides most cases.

1. Search your inbox (and spam) for an Instagram email about a changed email or phone. Messages from security@mail.instagram.com include a link to revert the change and secure the account — it is designed to work even after the attacker’s edits.
2. If you are still logged in on any device, change the password there immediately and log out of all other sessions.
3. Secure the email account behind your Instagram first — it is often the original point of entry.
4. Take screenshots of everything: the changed profile, scam messages sent from the account, any ransom demand.

Go to instagram.com/hacked (or tap “Forgot password?” / “Get help logging in” in the app) and select that your account was hacked. Then:

• Enter the username and any email or phone number that has ever been linked to the account — older details often still match the record.
• Choose the video selfie option if the account contains photos of you. The selfie compares your face with the account’s images, which an attacker cannot fake.
• For brand or business accounts without face photos, prepare ownership evidence: original media files, business documents, the email used at signup, invoices for any ads.

Hijacked accounts are commonly used to push crypto and “investment” scams to the owner’s followers, or to impersonate the owner asking for money. Warn your audience through another account, a story from a friend, or your other platforms. Ask people who know you to report the account as hacked or impersonating — reports add weight to the case. If your account is being impersonated by a separate profile rather than taken over, the route is different: see how to remove a fake account.

The self-service flow fails more often than people expect: the selfie is rejected, the account has no photos of the owner, the attacker re-verifies with their own details, or the email address was changed to one you never controlled. These cases need a properly documented manual escalation through Meta’s support routes — ownership proof, a clear timeline and the right channel. That is the work our hacked account recovery service does every day, across Instagram, Facebook, TikTok, X and Google accounts.

• Turn on two-factor authentication with an authenticator app rather than SMS, and store the backup codes offline.
• Review active sessions and log out of every device you do not recognise.
• Remove unknown third-party apps and websites connected to the account.
• Check that the email and phone on file are yours, and change the password of the email account itself.
• Learn to check the official “recent emails” list in Instagram’s security settings, so you can tell genuine Instagram emails from phishing.