How to Recover a Hacked Instagram Account (2026 Guide)

This guide is for recovering an Instagram account that belongs to you. If you’ve been locked out, seen your email changed, or watched your account post spam you didn’t write, Instagram has an official recovery flow that can verify your identity and hand the account back, even when an attacker swapped your email. Speed matters, so the sooner you act, the better your odds.

Accessing an account you don’t own is illegal, so everything here covers your own account through official channels only.

#How Do You Know Your Instagram Was Hacked?

The clearest sign is being locked out with a password you know is correct. Beyond that, watch for an email from Instagram saying your email address or password was changed, when you made no such change.

Other tells are subtler. Friends mention DMs you never sent, usually crypto or giveaway spam, or your bio and profile photo change on their own while followers quietly disappear.

If any of these match, treat it as urgent. The revert links in Instagram’s emails are time-limited.

#The First Hour: Acting Fast After a Hack

Start in your email inbox, not the app. When an attacker changes your login details, Instagram emails the original address to flag it, and that message is your fastest route back.

According to Instagram’s hacked account help, if you get an email that your address was changed, you may be able to undo it with the revert this change option inside that message. Act before it expires, because these links are time-limited.

While you’re here, check whether your device itself is compromised, since a hacked phone can hand over codes as fast as you set them. Our guide to telling if your phone is hacked covers the warning signs. If you simply forgot the password and weren’t breached, our note on a forgotten Instagram password is the gentler path.

#How Does Instagram’s Official Recovery Flow Work?

When the revert link is gone, the in-app recovery flow takes over. On the login screen, tap Get help logging in below the Log In button, enter your username, email, or phone number, and tap Next.

Instagram’s help center states that you then tap Need more help? and follow the on-screen steps to request a login link or a security code. Enter a secure email address only you can access, since that’s where the recovery instructions land.

When we tried this path, the flow asked for the email or phone number used at sign-up and the device type, such as iPhone or Android. In our testing, providing the original sign-up email moved the request along faster than guessing at recent details. If the app keeps throwing a security checkpoint at you, our note on the challenge required Instagram error explains what that screen wants.

#What to Do When the Hacker Changed Your Email

This is the hardest case, and it’s exactly what the video-selfie verification exists for. With both your password and email changed, the reset emails go to the attacker, so you need another way to prove you’re the owner.

Go to the dedicated portal at instagram.com/hacked and choose the compromised-account option. Instagram may then ask for a short video selfie it matches against photos already on the account.

Provide the original email or phone number, the device you signed up on, and any other detail it requests. The verification isn’t instant, so submit accurate information once and watch the secure email you supplied for next steps rather than spamming new requests.

#Locking It Down So It Can’t Happen Again

Recovery is only half the job. The reason most accounts get hacked twice is that nothing changes after the first time, so harden the account the moment you’re back in.

Set a new, unique password first. The FTC’s hacked-account guidance found that a strong password runs 12 to 15 characters, and it says to sign out of every device so anyone still logged in elsewhere is kicked out. You can read the full FTC recovery advice for the rest of the checklist.

Then turn on two-factor authentication, and choose the app-based kind. The FTC’s two-factor authentication guide notes that SMS codes are the least secure option and recommends an authenticator app or security key instead.

Our pick of the best 2FA authenticator app walks through the setup, and the same hardening applies to your other logins, as our guide to securing your Google account explains.

One more thing: ignore anyone in your DMs or search results offering paid recovery. As Tom’s Guide reports in its Instagram phishing coverage, attackers change your password and email, then charge you to get the account back with no guarantee, just like ransomware. Instagram never charges to recover an account.

#Reporting Impersonators and Damage Control

Sometimes the attacker spins up a fake account using your name and photos to scam your followers. Report it. Instagram’s impersonation reporting tools let you flag a copycat account even from a second account if yours is still locked.

Warn your contacts too. A quick story or message from a friend’s account telling people not to click links you supposedly sent can stop the scam from spreading while you recover. If a hacker also tampered with your message history, our note on recovering deleted Instagram messages covers what’s salvageable. And if your notifications went silent during the chaos, our fix for Instagram notifications not working gets the alerts flowing again.

#Bottom Line

Move fast and stay inside Instagram’s official channels. Check your email for the revert this change link first, and if it’s gone, use the account-was-hacked flow at instagram.com/hacked, where a video selfie can verify you even after the attacker swapped your email. Never pay a third-party recovery service, because those are scams. Once you’re back in, the real fix is hardening, so set a unique password and turn on app-based two-factor authentication immediately.

#Frequently Asked Questions