Instagram Account Hacked: What to Do Right Now

Signs your account may be hacked

• Instagram emails you about a changed email address, phone number or password that you did not request.
• Your password no longer works, or the login page says there is no account with your email.
• Posts, Stories, DMs or follows you did not make.
• Your username, bio or profile photo changed.
• Login alerts from places or devices you do not know.
• A message saying your account was disabled or locked soon after odd activity. Read the suspended account guide in that case.

Not every odd event means a hack. A bug, a shared device or a connected third-party app can cause some of these, and a sudden drop in reach is usually something else. See the Instagram shadowban guide for that.

What to do, in order

1. Check your email first. Search every inbox you may have used for messages from Instagram. If someone changed your email or password, Instagram usually sends a notice to the old address with an option to secure the account or undo the change. Use that link, and only if it opens an official instagram.com page.
2. Try to log in. If your old password still works, change it straight away to a long, unique one. If it does not, tap "Forgot password" on the login screen and ask for a reset to your email or phone.
3. Use the official hacked-account route. If you cannot get in, open the Instagram Help Center page for a hacked account and follow the options for your situation. Instagram describes ways to confirm that you own the account, which can include a code sent to your contact details or a video selfie. The available options vary by account and region.
4. Once you are in, lock it down. Change the password, turn on two-factor authentication (an authenticator app is safer than text messages), and review Accounts Center or Settings for the email and phone number on the account.
5. Sign out of other devices. Open the login activity list, log out of sessions you do not recognise and remove them from your saved logins.
6. Remove third-party access. Revoke apps and websites you no longer use or do not trust, since a bad connected app is a common way in.
7. Clean up. Delete posts you did not make, tell your followers not to click odd DMs, and change the password on any other account that shares the old password, starting with the email account.

Instagram's own pages on a hacked account have the current steps and may differ slightly from the above.

Secure the email account too

Most Instagram takeovers come through the email address on the account. If the email is not protected with a strong password and two-factor authentication, the attacker can simply reset Instagram again. Fix the email account first or at the same time.

Do not fall for recovery scams

• Anyone who messages you offering to "recover" a hacked account for a fee is a scammer. Instagram does not charge for this and there is no paid backdoor.
• Do not send your password, a login code, or an ID photo to anyone who contacted you first, including accounts that look like Instagram or Meta support.
• Be careful with "copyright violation" or "verification badge" DMs that link to a login page. Check the address in your browser before typing anything.

If the hacker got into your business or ad accounts

Check any connected Facebook Page, Meta Business account and payment method. Remove people you do not know, and review recent ad spend. If money was taken, contact your bank or card provider as well as Meta.

After you get it back

• Keep two-factor on and save the backup codes somewhere offline.
• Use a password manager, so each account has a unique password.
• Do not log in via links in DMs or emails. Open the app or type the address yourself.
• Expect some reach to be uneven for a while if the account posted spam. Normal posting usually settles things.

This guide is general information based on platform help pages and user reports, not an official statement from the platform. Rules and timings change, so check the platform's own notice and Help Center. Never pay anyone who promises to unban an account, and never share passwords, codes or ID with them.

Frequently asked questions

How do I know if my Instagram was hacked or just glitching?

Strong signs are emails about a changed email, phone or password that you did not request, or a login from an unknown device. A single odd post or a drop in views on its own is more often a bug, a connected app or a reach change.

Can Instagram recover a hacked account?

Often yes, if you can show the account is yours using the official options, but there is no guarantee. Results depend on what contact details are still attached and what Instagram can verify.

Should I pay someone to get my account back?

No. Offers to recover a hacked account for money are scams, and some are run by the hackers themselves. Only Instagram can restore access, and it does not charge.

The hacker changed my email. What now?

Look for an Instagram message at your old address with a secure-account link. If there is none or it has expired, use the official hacked-account route and follow the identity options it offers.

Does turning on two-factor stop hacking?

It blocks the most common attacks by password alone, but it does not stop phishing where you hand over the code yourself. An authenticator app is safer than SMS.