Instagram Hacked: How to Get Your Account Back and Warn the People Who Follow You

How to tell your Instagram was hacked

Your Instagram was probably hacked if you cannot log in with your usual password, if you got an email saying your email address or password changed when you did not change it, or if your profile is posting, commenting or sending messages you did not write. Any one of these is enough reason to act now.

The FTC lists the same warning signs in its guide on recovering a hacked email or social media account, and adds one that often arrives first: friends telling you they got strange messages from you, sometimes with links or requests for money. Instagram’s own page on unauthorized content says that comments or posts you did not make usually mean your password is compromised, and that you may see a “Try again later” error when Instagram detects activity that does not look like yours.

The people who take over accounts do it every day, at scale, with messages built to look like they come from Instagram itself.

What to do first

Go to instagram.com/hacked in a browser on your phone or computer. That is the address Instagram’s Help Center gives for anyone who lost access or thinks someone else is in the account, and it walks you through the options that fit your situation.

The order below follows Instagram’s page for hacked accounts, with two steps added that its page leaves out: securing your email and warning the people who follow you.

1. Open instagram.com/hacked right away and follow the path that matches what happened: you can still log in, your password was changed, your email was changed, or you cannot reach the email or phone on the account.
2. Search your inbox for a message from [email protected]. If the hacker changed your email, that message has a link to reverse the change, explained in the next section.
3. Secure the email account itself. Instagram’s security page says that anyone who can read your email can probably get into your Instagram too, so change the email password, from a device you trust, before or right after you recover Instagram.
4. If you cannot get in, request a login link. On the login screen, tap Forgot password, enter your username, email or phone number, and use the link Instagram sends.
5. Warn your followers from another channel, such as a text to close friends or a post from a second account, so nobody answers a message that looks like it came from you.
6. Write down what changed and when: the time you lost access, the emails you received, and any messages friends forwarded. You will need these details if you report it.

Instagram hacked and email changed: how to get it back

When the email on an Instagram account changes, Instagram sends a message to the old address with a link that reverses the change. According to its page on email changes, that message comes from [email protected], and the old address is the one that can deny the change.

So the first place to look is the inbox you used to have on the account, not the new one. If the message is there, use its link, labeled secure my account, and then set a new password. Instagram notes that if the hacker also changed other information, such as the password, and you still cannot get the email back, the next option is a login link or a security code.

If you cannot reach the email or phone on the account

If you no longer have the email or phone number on the account, Instagram may ask you to prove your identity instead. The hacked account page describes two routes, and which one you get depends on the account.

• Account with photos of you: Instagram may ask for a video selfie of you turning your head in different directions. It says the video is used only to confirm you are a real person and the owner, is never visible on Instagram, and is deleted within 30 days. If the first video does not work, you can send a new one.
• Account without photos of you: you should receive an automatic email from Meta’s support team asking for the email or phone number you signed up with and the type of device you used at the time, such as an iPhone or an Android phone.

When Instagram asks for a secure email address during this process, give one that only you can open. That is where the next steps arrive.

There is a limit worth knowing before you spend hours on it. Instagram’s page on lost access to email or phone says that if you cannot get into the email you registered with and never linked your Instagram to Facebook, it cannot give you access to the account. In that case, the useful move is to recover the email account first, through your email provider’s own recovery page, and then return to Instagram. Instagram says plainly that it cannot help you get back into the email.

Warn the people who follow you

Warning your followers is part of recovering the account, because the person who took it is most likely using your name to scam the people who trust you. The FTC tells people to notify their contacts after a hack and to tell them to ignore links and pleas for help or money that seem to come from you.

The FTC describes one version it keeps seeing in its alert on investment scams on social media: a friend’s account suddenly fills with posts about easy money, a follower comments, and the “friend” asks for a few hundred dollars in cryptocurrency or through a payment app, then blocks them. It was a scammer who had taken over the account to reach its followers.

Here is how that can look from a follower’s side. The scene is invented, and the scam it shows is real. Maya’s account posts a story at 11 p.m.: a screenshot of a large balance and the words “I can’t believe this worked, DM me and I’ll show you.” Her cousin replies. Within minutes “Maya” asks him for 300 dollars to start, and a second message asks him to forward a six-digit code that was just texted to him “by mistake.” The code is the login code for his own account, and the FTC’s alert on verification codes is direct about it: anyone who asks you for your verification code is a scammer.

A warning works best when it is short and says what to ignore. For example:

• “My Instagram was hacked on Tuesday night. Anything asking for money, a code or an investment is not me.”
• “If you sent money or a code to my account, tell your bank or payment app today and change your own password.”
• “Please report posts from my account that talk about money until I post again from here.”

Send it by text to the people most likely to be targeted first, such as family and close friends, and post it from another account if you have one. The pattern of borrowing a trusted name to ask for money is covered in more depth in how impostor scams work.

After you get back in: what to check

Getting back in is only half of the fix, because the hacker may still have a session open or a way to reset the password again. Do the following right after you recover the account.

• Change the password to one you have never used anywhere else. Instagram notes that changing it logs out every device, which removes the hacker’s session too. A password manager makes a unique password for every account practical.
• Check where you are logged in. Instagram’s page on recent login activity shows the path: Settings, Password and security, Where you’re logged in. Log out of any device you do not recognize.
• Turn on two-factor authentication. Instagram’s security page calls it the single most effective step to protect the account from hackers. Instagram lets you choose between text message codes and an authentication app, and the guide to two-factor methods compares how strong each one is.
• Confirm your email and phone number in account settings, and remove any linked accounts you do not recognize in Accounts Center.
• Revoke suspicious third-party apps. Instagram warns that an app you gave your login to can get complete access to the account.
• Delete what the hacker posted and check your sent messages, so you know which followers were contacted.
• Check your email account for forwarding rules you did not set up. The FTC points out that hackers create them to keep receiving your messages after you change the password.

If other accounts also changed on their own, or your phone behaves strangely, run through the checks for a compromised phone. The FTC’s first step in account recovery is to update and run your security software, since stolen passwords can come from a harmful program on the device.

How Instagram accounts get taken over

Most Instagram accounts are taken through a password or a login code that someone was tricked into giving away, not through a break-in at Instagram. The FBI’s Internet Crime Complaint Center lists the usual methods on its page on account takeover fraud: weak or reused passwords, fake emails and websites that copy a real login page, passwords leaked in data breaches, and harmful software on a device.

On Instagram, three versions come up again and again in the platform’s own help pages:

• Messages that threaten your account. Instagram’s phishing page describes messages claiming the account will be banned or deleted unless you log in through a link. The link leads to a copy of the login page.
• Apps that promise likes or followers. Instagram says these apps and websites are likely attempts to misuse the account, and that sharing your login with them gives them complete access.
• A password used somewhere else. When Instagram detects that your password may have been exposed by outside sources, it asks you to change it. A password that leaked from another site works on Instagram if it is the same one.

The FBI adds a caution about two-factor authentication that is worth keeping in mind: it will not protect you if you type your password and code into a fake login page. Open Instagram from the app or by typing the address yourself, not from a link in a message.

Paid recovery services and fake Instagram support

Anyone who contacts you offering to recover your Instagram for a fee is almost certainly running a second scam. The FTC’s page on refund and recovery scams describes the pattern: people who were just scammed are targeted again by someone promising to fix it, who asks for money up front. If you pay, you lose more money.

These offers usually arrive by direct message or in the comments under posts about hacked accounts, sometimes from profiles that look official. Remember what Instagram says about its own contact: it does not send direct messages about your account inside the app. Account recovery happens through instagram.com/hacked and the emails Instagram sends to the address you give it, and the Help Center also offers a chat with Meta’s AI support assistant.

If you lost money, or a follower did, report it to the FTC at ReportFraud.ftc.gov. If personal information such as your Social Security number was exposed, IdentityTheft.gov builds a recovery plan for you. The full sequence, including the bank and what recovery of money realistically looks like, is in how to report a scam and try to get your money back. No report guarantees the money comes back, and the sooner the bank or payment app hears about it, the better the chances.

Hacked Instagram FAQ