If your Instagram account is hacked, act fast: Instagram's own recovery flow at instagram.com/hacked is the only safe way back in.
Losing control of your Instagram account feels personal, because years of photos, messages, and followers can disappear in a single afternoon when a hacker takes over.
The good news is that Instagram has a dedicated recovery process for hacked accounts, and acting quickly gives you the best chance of getting your profile back intact.
This guide walks you through every step in order, from spotting the warning signs and securing your email to using the in-app recovery flow and proving your identity with a video selfie.
You will also learn how to lock the account down afterward, so the same attacker cannot walk straight back in through an old session or a connected app.
What You Will Learn
Spot the warning signs early.
You will learn the red flags that show someone else is using your account, from password changes you did not make to strange posts, messages, and login alerts that arrive out of nowhere.
Recognising these signs quickly matters, because the sooner you act, the fewer changes a hacker has time to make to your email, phone number, and profile.
Take the right first steps.
You will learn what to do in the first hour after a hack, including checking your email for Instagram security messages, securing your inbox, and warning your followers before the attacker can scam them.
These early moves protect your contacts and keep at least one recovery route open while you work through the official process.
Use the in-app recovery flow.
You will learn how to recover your account from the Instagram login screen, including the "Trouble logging in" and hacked-account options that request a login link or a security code.
This is the fastest route for most people, and it works best when you still have access to the email address or phone number linked to the account.
Prove your identity with a video selfie.
You will learn how Instagram's video selfie check works, what makes a recording pass or fail, and what to do when the hacker has already changed your contact details.
This identity check is the backup route when normal password resets no longer reach you, and a little preparation makes it far more likely to succeed.
Recover an account with a changed email.
You will learn how to reverse an email change from Instagram's security message, and what to do when that message never arrives or the hacker changed everything at once.
Even in that worst case, recovery is still possible through the identity verification route, so do not give up after the first failed reset.
Lock the account down afterward.
You will learn how to secure a recovered account with two-factor authentication, a fresh password, a review of logged-in devices, and a clean-up of third-party apps.
These steps close the doors the hacker used the first time, and they turn a stressful recovery into lasting protection for your account.
Signs Your Instagram Account Was Hacked
Hackers rarely announce themselves, so the first sign is often something small, like a login alert for a city you have never visited or a password reset email you did not request.
Other common signs include posts, Stories, comments, or direct messages that you did not create, a changed bio, username, or profile photo, and followers telling you they received strange links from your account.
Any one of these signs is enough reason to act immediately, because waiting only gives the attacker more time to change your recovery details.
Another clear warning is losing access itself, which happens when your usual password suddenly stops working or Instagram says your email address or phone number is no longer linked to the account.
You may also notice new devices in your login activity, follows or unfollows you did not make, or your account promoting cryptocurrency giveaways, fake giveaways, or suspicious investment schemes.
Hackers often use stolen accounts to scam the owner's followers, so treat unexpected messages from your account as an emergency even before you lose access.
Immediate First Steps: What to Do Right Away
Start by checking the email inbox linked to your Instagram account, including the spam folder, for messages from Instagram about a password change, an email change, or a new login.
Instagram sends a security email when your contact details change, and that message can include a link to reverse the change or secure your account, so it is the single most valuable thing to look for first.
Only tap links in emails that arrived at your registered address and genuinely come from Instagram, because phishing emails that imitate Instagram are common after a hack.
Secure your email account first, because your inbox is the key to every other recovery step.
Change your email password to a strong, unique password, turn on two-factor authentication for your email, and check for forwarding rules or unfamiliar recovery addresses the hacker may have added.
If the attacker still controls your inbox, they can intercept Instagram reset links faster than you can use them, so lock the inbox down before anything else.
Warn your followers through another channel, such as a story on a second account, a message to close friends, or a post on another social network.
Tell them your Instagram account was hacked, that any investment links or urgent money requests from it are fake, and that they should not click links or send codes to anyone claiming to be you.
This quick warning protects your friends from scams and stops the hacker from using your reputation to reach more victims.
Do not pay anyone who promises to recover your account, and do not share your password or any login code with anyone.
Real recovery through Instagram is free, Instagram does not contact users through direct messages to offer recovery help, and anyone promising instant or guaranteed recovery for a fee is almost certainly running a scam.
If you already paid or shared a code, change your passwords immediately and contact your payment provider about the transaction.
Recovering Through the Instagram App's Hacked-Account Flow
For most people, the fastest recovery route starts on the Instagram login screen, where you can tap "Forgot password?" on iPhone or "Get help logging in" on Android and then enter your username, email address, or phone number.
Instagram will then offer to send a login link or security code to the contact details still linked to your account, and following that link lets you set a new password.
If that option works, use it right away, because every minute of delay is another minute the hacker can use to change your contact details.
If the standard reset does not work, look for the "Need more help?" option on the login screen and choose the path that matches your situation, such as "My account was hacked" or "I can't access this email or phone".
You can also open instagram.com/hacked in a browser, enter your username, email, or phone number, and follow the prompts Instagram shows for your case.
Menu names can vary slightly between app versions, so follow the wording on your own screen rather than memorising exact button labels, and only trust links that start with instagram.com or help.instagram.com.
When Instagram cannot verify you through your contact details, it may ask you to prove your identity with a short video selfie recorded inside the Instagram app.
You will be asked to face your phone camera and follow on-screen prompts, such as turning your head in different directions, while Instagram compares the live video with photos already on your account.
Record the video in bright, even lighting with your full face in frame, remove sunglasses, hats, and beauty filters, and use the same device you used for Instagram before, because poor lighting, blur, filters, and a lack of face photos on the account are common reasons for rejection.
After you submit the video selfie, wait for Instagram's reply instead of submitting the same request again and again, because repeated requests can slow the review and create duplicate cases.
Recovery can take minutes when your email or phone number still works, while the video selfie route can take longer and may need manual confirmation that stretches to a few days.
Submit one request, keep an eye on the email address you provided, and avoid creating a new account with the same name while you wait, since that can complicate the review.
Recovering With Your Email or Phone Number
If your email address or phone number is still linked to the account, recovery is usually straightforward, because Instagram can send a login link to your email or a security code by text message.
Open the login screen, enter your username, email, or phone number, and choose the contact method you can still access, then follow the link or enter the code promptly before it expires.
Once you are back in, change your password immediately to something long and unique that you have never used anywhere else.
If the reset email never arrives, check your spam and junk folders, search your inbox for messages from Instagram, and confirm you are checking the exact address you registered with rather than a newer one.
A mistyped username is another common cause of failure, so double-check the spelling, including dots, underscores, and numbers that are easy to mix up.
If you have a linked Facebook account, logging in through Facebook may also restore access, since Instagram can verify you through the connected account when the two profiles are linked.
What to Do If the Hacker Changed Your Email
An email change is the hacker's most damaging move, because it cuts off the normal password reset route, but it does not end your chances of recovery.
First, search your inbox for the message Instagram sends when an email address is changed, which is sent to your original address and often includes an option to revert the change and secure your account.
If you find that message, use its link immediately, then change your password and review your account settings before the hacker can change the details a second time.
If that message never arrived, was deleted, or its link no longer works, go to instagram.com/hacked, select "My account was hacked", and follow the flow for an account whose contact details were changed.
Instagram will ask for details that prove you owned the account, such as the original email address or phone number, and it may then route you to the video selfie identity check described above.
Provide the most accurate information you can, including the original contact details and the device you usually used, because strong proof at this stage is what separates a quick recovery from a long review.
Stay patient and organised while this route runs its course, and keep a simple record of what you submitted, which email address you used for contact, and when you submitted it.
Do not hand this information to third-party "recovery services", do not share screenshots of verification codes, and do not try to buy your account back from the hacker, since paying an attacker rewards the crime and rarely returns lasting control.
Instagram does not offer phone support for personal accounts, so any phone number advertised as Instagram support is a scam, and the official in-app and website flows are the only genuine channels.
Securing Your Account After Recovery
Getting back in is only half the job, because a recovered account is still vulnerable until you close every door the hacker used or left open.
Work through the steps below in order, starting with the password and two-factor authentication, then checking devices and connected apps before you return to normal posting.
Each step takes only a few minutes, and together they make a second takeover far harder than the first one was.
Change your password to a strong, unique password that you have never used on any other website or app.
Choose a long password with a mix of upper and lower case letters, numbers, and symbols, store it in a password manager rather than a notes app, and change the password of your linked email account too if it shared the old one.
Never reuse the password the hacker already knows, even with a small change, because attackers routinely try simple variations of stolen passwords.
Turn on two-factor authentication through Accounts Center, under Password and security, and choose an authentication app as your method where possible.
An authentication app such as Google Authenticator or Microsoft Authenticator generates time-based codes on your own device, which is stronger than text-message codes that can be intercepted if your phone number is hijacked.
Instagram also offers text message and WhatsApp codes, so pick at least one method and save the backup codes somewhere safe and offline in case you lose your phone.
Review your login activity and remove every device and session you do not recognise, including old phones, browsers, and locations you never visited.
In the app, this list appears as login activity or as "Where you're logged in" in Accounts Center, and removing an unknown session forces that device to sign in again with your new password and code.
Pay special attention to sessions from unfamiliar cities or devices, and repeat the check a few days later to catch anything that reappears.
Revoke access for third-party apps and websites you do not recognise or no longer use, because connected apps are a common way for attackers to keep a foothold.
Open your settings, find the apps and websites section, and remove anything suspicious, outdated, or granted broad permissions, keeping only tools you actively use and trust.
Also check your linked accounts and remove any unfamiliar Facebook page, email address, or phone number the hacker may have added to the profile.
Clean up what the hacker changed by checking your posts, Stories, bio, website link, and direct messages for spam, scam links, or content you did not create.
Delete any fraudulent posts or messages, restore your bio and profile photo, and apologise briefly to followers who may have received scam messages from the account.
A short honest post about the hack also warns anyone who missed your earlier alert and shows your audience that the account is back under your control.
How to Prevent Future Hacks
Most Instagram hacks start with a leaked password or a phishing link, so prevention comes down to making both of those attacks much harder to pull off.
Use a unique password for Instagram, keep two-factor authentication turned on, and never enter your login details on a page reached from a direct message, email, or comment link without checking the address first.
Real Instagram pages live on instagram.com, and a login page on any other domain asking for your credentials is a phishing trap.
Be sceptical of messages promising verification badges, follower growth, copyright strikes, or account warnings, because these are the classic lures used to steal Instagram logins.
Instagram does not ask for your password by email or direct message, and urgent threats that demand you log in immediately are designed to stop you thinking clearly.
Keep your phone's operating system and the Instagram app updated, avoid logging in on shared or public devices, and review your login activity and connected apps every few months so a quiet intrusion cannot sit unnoticed.
Frequently Asked Questions
How long does it take to recover a hacked Instagram account?
It depends on which route you need, because a reset to an email address or phone number you still control can work within minutes, while identity verification takes longer.
If Instagram asks for a video selfie and cannot confirm your identity automatically, a manual review may take a few days, and the process is usually faster when you still have access to your original device, email, or phone number.
Submit one request and wait for the reply rather than flooding the system with duplicates.
Can I recover my account if the hacker changed my email and phone number?
Yes, recovery is still possible even when both contact details were changed, because Instagram can verify you through the identity check instead of through your old contact information.
Go to instagram.com/hacked, choose the hacked-account path, provide your original email address or phone number if you remember it, and complete the video selfie check when Instagram offers it.
A linked Facebook account can also help, since logging in through Facebook may let Instagram confirm that you are the same person.
Does Instagram have a phone number I can call for hacked accounts?
No, Instagram does not offer phone support for personal accounts, so there is no official number to call about a hacked profile.
Any phone number you find in an advertisement, video, or comment claiming to be Instagram support is a scam, and calling it risks further theft of your money or personal details.
Recovery happens only through the official Instagram app, instagram.com/hacked, and the Instagram Help Center, and the whole process is free.
What should I do if my video selfie keeps getting rejected?
Try again with better conditions, because most rejections come from poor lighting, blur, filters, or a face that looks very different from your profile photos.
Record in bright, even light facing a window, hold the phone steady with your full face in frame, remove hats, sunglasses, and beauty filters, and match the look of your recent profile photos as closely as you can.
If the account has no photos of you, such as a brand or theme page, the video check may fail by design, in which case follow the alternative identity options Instagram shows, such as confirming your original contact details.
Should I delete my hacked account and start over?
Do not delete the account while recovery is still possible, because deletion would destroy the photos, followers, and history you are trying to save, and it may not even stop the hacker from using your name elsewhere.
Recovery through Instagram is free and worth attempting first, even when the first reset fails, since the video selfie route exists precisely for accounts whose contact details were changed.
Only consider a fresh start after Instagram has told you recovery is not possible, and warn your followers about the old account if you do move on.
If your account has been hacked, start with your email inbox, then use the official recovery flow at instagram.com/hacked, and prove your identity with a video selfie if the normal reset no longer reaches you.
Once you are back in, change your password, turn on two-factor authentication with an authentication app, remove unknown devices and third-party apps, and warn your followers about any scam messages sent while you were locked out.
Quick action, one official request, and a few minutes of clean-up afterward are usually all it takes to turn a hacked account back into a safe one.