Instagram Account Hacked and Password Changed? How to Recover It

If your Instagram account was hacked and the password or email was changed, the fastest route back is Instagram’s own recovery process, and every step in this guide comes from Instagram’s Help Center pages, read on 21 October 2026. Instagram says that if someone gains access to your account or you cannot log in, you should visit its hacked-account help page and start from there.

Do not pay anyone and do not hand your password to anyone. The steps below are free, and the last sections explain the scams that target people who have just lost an account. Our Instagram guides cover more account basics.

First: can you still log in?

Your next step depends on one thing. Instagram’s help page splits recovery into two cases: you can still log in, or you cannot. Some of its recovery steps may not be available for every type of account, and Instagram recommends trying all of them.

Signs the password may be compromised, according to Instagram’s page on unauthorized content: your profile is leaving comments or sharing things you did not post. It also says that if inauthentic activity is detected on an account, you may see a “Try again later” error message.

If you can still log in

Instagram lists these actions for someone who can still get into the account. Do them in this order, and do them today.

1. Change your password or send yourself a password reset email. Instagram says to pick a strong, unique one: at least six numbers, letters and special characters, avoiding repetition and anything personal such as your name or birthday. Whenever you change the password, devices logged in to the account are signed out automatically and need to sign in again.
2. Turn on two-factor authentication. Instagram calls it the single most effective step to protect your account from hackers. See the numbered steps further down.
3. Check your phone number and email address in account settings are correct and belong to you.
4. Check Accounts Center and remove any linked accounts you do not recognize.
5. Revoke access for suspicious third-party apps. Instagram warns that an app given your login details, either as an access token or as your username and password, can gain complete access to the account. Our Instagram automation guide explains why tools like that carry risk.

Our guide to linking Facebook and Instagram explains how accounts are connected, which helps when you are checking what is linked.

If you cannot log in

Work through these in order. They are the recovery options on Instagram’s hacked-account page.

Step 1. Check your email for a message from Instagram

• What to look for: an email from security@mail.instagram.com saying your email address was changed.
• What to do: select the “secure my account” option in that message to try to undo the change.
• Limit: if other details, such as your password, were also changed and you cannot change the email back, move to step 2.

Step 2. Request a login link

1. On the login screen, tap Forgot password?
2. Enter the username, email address or phone number linked to the account, then click Send login link.
3. Complete the captcha to confirm you are a real person, then click Next.
4. Click the login link in the email or text message and follow the instructions.

Instagram notes that if you no longer have access to the username, email or phone number, you should use its help page and follow the on-screen instructions instead. If you have forgotten the username itself, Instagram has a separate help page for that.

Step 3. Request a security code or support

• When: if the login link does not recover the account. Instagram says you may be able to request support on a mobile device.
• Email address to enter: a secure address that only you can access. After you submit, Instagram says you should receive an email with next steps.

The Help Center does not list any step that involves paying, and none asks for your password to be sent to a third party.

If the hacker changed your email

Instagram’s page on an email change on your account explains how the system is designed. When the email on a profile is changed, Instagram sends two emails: one to the original address so the change can be denied, and one to the new address so it can be allowed.

If you did not request the change, deny it from the original email. The message comes from security@mail.instagram.com and contains a link to reverse the change and help secure the account. Instagram says it only starts this process when the email is changed from the profile page.

If you cannot reach your original email, treat that mailbox as a problem too. Instagram’s security tips say anyone who can read your email can probably also access your Instagram account, so secure your email accounts and make sure no two use the same password.

Check spam and deleted folders for the notice. Whether an old reversal link still works after a long time is not stated on the page, so do not assume it does.

Verifying your identity

If Instagram asks you to prove the account is yours, the help page describes two cases, read on 21 October 2026:

• Account without photos of you: you should get an automatic reply from the Support Team at Meta asking for the email address or phone number you signed up with, and the type of device you used (for example iPhone, Android or iPad).
• Account with photos of you: you are asked to take a video selfie, turning your head in different directions, so Instagram can check you are a real person and confirm your identity.

Instagram says the video is never visible on Instagram and is deleted within 30 days. If it cannot confirm your identity from the video, you can submit a new one.

Professional accounts: a hacker still acting after you log in

Instagram has a separate page for a professional account where you can log in but a hacker is still taking actions. Its steps, in summary:

1. On a desktop computer, go to Meta Business Suite and log in with your Instagram information.
2. Click Business Settings, then under Users click People.
3. If unauthorized business manager names are listed, you can remove them by converting the account back to a personal account.

Instagram warns that switching to personal means losing access to Meta business tools, Meta Business Suite and Ads Manager, and in-app insights. Insights data is preserved for 90 days, and you can switch back to a professional account afterwards. If you manage the account with other tools, our Instagram manager tools roundup lists some.

After you get back in

• Change your password again if you reused it anywhere. Instagram recommends a unique password never used for other accounts, and a password manager.
• Review posts, comments and messages sent while the account was not yours, and delete anything you did not create.
• Check the email and phone number on the account, and Accounts Center for unknown linked accounts.
• Tell your followers if the hacked account sent them messages or links. Instagram warns that scammers use compromised accounts to deceive or defraud your friends.

Turn on two-factor authentication

Per Instagram’s two-factor authentication page, read on 21 October 2026:

1. Click More in the bottom left, then click Settings.
2. Click See more in Accounts Center, then Password and security.
3. Click Two-factor authentication, then select an account.
4. Choose a security method and follow the on-screen instructions.

The methods are an authentication app (recommended), text message, or WhatsApp. Instagram says the app method can only be turned on in the Instagram app for Android and iPhone. Do not tap “Trust this device” on a public or shared device.

Recovery scams and password-sharing services

People who have lost an account are targeted. Instagram’s scam page lists as warning signs people claiming to be from Instagram security who ask for account information such as your username or password, or who offer account verification services. It also tells you never to answer messages asking for your password, and says Instagram will never send you direct messages about your account in the app. Our guide to Instagram DMs covers how messaging works.

Practical rules based on those pages:

• Do not send your password, login code or ID to anyone offering to “recover” the account in a message.
• If an email or message claims to be from Instagram, do not click its links or attachments. Check in your Instagram settings whether Instagram sent it. Instagram says you can view official emails it sent within the last 14 days in settings.
• Instagram’s phishing page lists sender domains such as facebookmail.com and meta.com. You can report strange emails to phish@instagram.com.

One cause deserves a plain mention. Instagram’s page on unauthorized content says you should not use apps that offer likes and followers in exchange for your login details, and that such websites and apps are likely attempts to use your account in an inappropriate way. Any service that asks for your Instagram password gives it your login. For background on how automation tools work and the risks they carry, see the automation guide linked earlier. It is neutral on any one tool; the point is that handing over a password is the risk.

Preventing it happening again

Instagram’s security tips boil down to a few habits:

• Use two-factor authentication.
• Use a strong, unique password and never share it with someone you do not know and trust.
• Be careful when you authorize a third-party app, and never share login details with one you do not trust.
• Log out on shared computers and do not tick “Remember me” on public ones.
• Secure your email account, because it is the way back into everything else.

The scam page adds: turn on login alerts, review previous sessions to check you recognize the devices, and use the Security Checkup tool.

Account security also affects what you can do with the account afterwards. If you plan to apply for a badge, read our guide to getting verified on Instagram.

FAQ

How do I recover a hacked Instagram account if my email was changed?

Check the original inbox for an email from security@mail.instagram.com and use its link to reverse the change. If that fails, request a login link, then a security code or support. See the steps above.

Can I recover my account without email or phone access?

Instagram says you can request support on a mobile device and submit a secure email address that only you can access. It has a separate help page for lost access to email or phone.

Will Instagram ask for a video selfie?

For an account with photos of you, yes. Instagram says the video is not visible on Instagram and is deleted within 30 days.

How long does recovery take?

The help pages we read give no timeframe, so we cannot say. Instagram says you should receive an email with next steps after you submit a request.

Is it safe to pay a service to get my account back?

The recovery steps on Instagram’s pages do not involve payment or sending your password. Instagram’s scam page warns about people who offer account services while asking for account information.

Why did I get a password reset email I did not ask for?

Instagram’s help page says a reset email does not necessarily mean the account was hacked: someone may have mistyped their own email or username and entered yours. Only people who know your password or click the login link can get in. Emails from Instagram only come from @mail.instagram.com, so if it came from elsewhere, treat it as possible phishing and do not click anything. If you are worried, reset your password and turn on two-factor authentication.

Rules and menus change often. If something here is out of date, tell us on the contact page, as described in our editorial policy.

Further reading

• Instagram Help Center: If you think your Instagram profile has been hacked
• Instagram Help Center: What to do if the email for your Instagram account was changed
• Instagram Help Center: What to do if your profile posts unauthorized content
• Instagram Help Center: Avoid getting scammed on Instagram