If a hacker has taken over your Instagram, move fast and go straight to Meta's official recovery page at instagram.com/hacked. From there you can request a login link, reverse a fraudulent email change, and — if needed — prove your identity with a video selfie. The faster you act, the better your odds, because the first thing most attackers do is change your email and phone so Instagram's reset links no longer reach you. This guide walks through every step in the order that actually works, plus how to lock the account down so it never happens again.

Signs Your Instagram Account Is Hacked

Before you start a recovery, confirm that you are actually hacked and not just locked out by a forgotten password. The two situations have different fixes.

Common signs of a genuine account takeover:

You get an email from Instagram saying your email address, password, or phone number was changed — and you did not make the change.
You can no longer log in with your usual password, and password resets are not arriving.
Friends report DMs or stories from your account that you did not post (often crypto scams, "is this you?" phishing links, or giveaways).
Your profile photo, username, or bio has been changed.
Two-factor authentication suddenly turns on with a device you do not recognize, or turns off entirely.
Posts you never made appear, or your existing posts are deleted.

If you received the "your email was changed" notification, look closely at it. Instagram includes a "secure my account" or "revert this change" link directly in that message — and that link is often the single fastest route back in. Do not delete that email.

Symptom-to-action quick reference

What you're seeing	First action to take
"Your email was changed" notification	Tap "revert this change" in that exact email
Password no longer works, resets arrive	Reset password via the app/login screen
Password resets never arrive	Go to instagram.com/hacked, request a login link
Email and phone both changed	instagram.com/hacked → video selfie verification
Account exists but you're fully locked out	Report via "Get more help" → identity verification
Account deleted or disabled by attacker	Submit a support request through the Help Center
Suspicious logins but you still have access	Change password now, then review active sessions

The Official Meta Recovery Flow

Meta consolidated account recovery under a single hub. Always start at the source rather than searching for third-party "recovery services" — those are frequently scams that will take your money and your remaining access.

Step 1: Go to instagram.com/hacked

Open instagram.com/hacked in a browser (or tap "Get help logging in" / "Forgot password" on the login screen, then choose "My account was hacked"). Instagram will ask which problem applies — account access, impersonation, or a different issue. Choose the account-access path.

Step 2: Request a login link or security code

Enter the username, email, or phone number associated with the account. Instagram sends a login link or a six-digit code to whatever contact methods are still on file. If the hacker has not yet changed your email and phone, this is the easy path: tap the link, set a new password, and you are back in.

Step 3: Reverse a fraudulent email change

This is the step most people miss. When an attacker changes your email, Instagram sends a notice to your original email saying "if you didn't make this change, secure your account here." That link lets you reverse the email change even after it has happened, locking the hacker out of the contact method they just stole. Check spam and all linked inboxes. This window does not last forever, so act the moment you find that message.

Step 4: Video selfie verification

If your email and phone are both gone and no codes reach you, Instagram falls back to identity verification. For accounts with photos of you, it asks you to record a short video selfie — turning your head in different directions so the system can confirm you are a real person and match you to images on the account. The video is never posted; it is used only for verification and is deleted after review. Approval typically lands within a couple of days. For accounts without personal photos, Instagram may instead ask for the email or phone you originally signed up with.

Step 5: Use "Get more help" if automated recovery fails

If the automated flow dead-ends, look for "Get more help" or "Need more help?" links and submit a support request describing the takeover. Be patient and avoid submitting dozens of duplicate requests — that can slow your case down rather than speed it up.

After You're Back In: Lock It Down

Regaining access is only half the job. If you do not close the door the attacker walked through, you can be re-hacked within hours.

Do these in order, immediately:

Change your password to something long and unique, not reused from any other site. A password manager helps here.
Check active sessions. Go to Settings → Accounts Center → Password and security → Where you're logged in. Log out every device you do not recognize.
Revert any changes the attacker made to your email, phone, username, bio, and profile photo.
Review connected apps. Settings → Apps and websites — remove anything unfamiliar that had access to your account.
Turn on two-factor authentication (covered below).
Warn your followers if scam messages went out from your account, so nobody else falls for the phishing link.

Set up two-factor authentication properly

Two-factor authentication (2FA) is the single biggest thing standing between you and a repeat hack. Go to Settings → Accounts Center → Password and security → Two-factor authentication.

You get three options, ranked from strongest to weakest:

2FA method	Security level	Notes
Authentication app (TOTP)	Strongest	Codes generated offline; immune to SIM swaps
Security key (hardware)	Strongest	Physical key; great if you own one
SMS text message	Weakest	Vulnerable to SIM-swap attacks, but better than nothing

Use an authenticator app rather than SMS if you can. SMS 2FA can be defeated by a SIM-swap attack, where someone convinces your carrier to move your number to their device. Whichever method you pick, save your backup codes somewhere offline — they are your lifeline if you lose your phone.

Ready to view Instagram stories anonymously?

No account needed. No trace left. Works on all public profiles.

Try ViewIGStory

How Hackers Get In (So You Can Avoid the Next One)

Almost every Instagram takeover starts with one of a small handful of techniques. Knowing them makes you much harder to phish.

Phishing links. A DM or email that looks like it is from Instagram ("copyright violation," "verify your account," "you've been reported") sends you to a fake login page that harvests your password. Instagram never asks for your password by DM. When in doubt, navigate to instagram.com yourself rather than tapping any link.
Password reuse. If your Instagram password is the same as one leaked in another site's breach, attackers will try it automatically. Unique passwords everywhere.
Fake "verification" or "growth" services. Apps that promise a blue badge, free followers, or analytics in exchange for your login are harvesting credentials. This is also why you should be careful about which third-party tools you connect to your account.

That last point is worth dwelling on. Not every third-party Instagram tool is dangerous, but the ones that demand your username and password are the risky category. The safest tools never ask you to log in at all. We cover this distinction in depth in are Instagram story viewers safe — the short version is that any service requesting your credentials should be treated as a threat, while view-only tools that read public data without a login carry no account risk.

Once you are back in control, it is also worth auditing your broader privacy footprint. Review your Instagram story privacy settings to control who can see what you post, and make sure nothing the hacker touched is still exposing more than you intend.

Frequently Asked Questions

How long does it take to recover a hacked Instagram account?

It varies widely. If you can use the "revert this change" link from the email-change notification, recovery can take minutes. If you need video selfie verification, expect a review window of roughly one to two business days. Cases that require manual support review can take longer, especially if the account had little identifying information.

Can Instagram recover my account if the hacker changed both my email and phone?

Yes. This is exactly what video selfie verification is for. As long as the account has photos of you, Instagram can confirm your identity without any access to your old email or phone number. For accounts without personal photos, recovery is harder but still possible through the support request flow.

Should I pay a third-party service to recover my account?

No. Legitimate Instagram recovery only happens through Meta's own tools at instagram.com/hacked. Services that charge a fee to "recover" your account are almost always scams that will take your money and frequently make things worse. Never share your login details with them.

Will I lose my posts, followers, or messages after recovery?

Usually not. Recovering the account restores it as it was, including followers and old posts — unless the attacker deleted content while they had access. Anything they deleted may be unrecoverable, which is one more reason to act fast. DMs and stories the hacker sent should be deleted by you once you are back in.

How do I know if a message claiming my account is at risk is real?

Check the source carefully. Real Instagram security notices appear inside the app under Settings → Accounts Center → Password and security → Emails from Instagram, which lists every genuine email the platform sent you. If a "warning" is not in that list, it is a phishing attempt, no matter how official it looks.

Can I prevent SIM-swap attacks on my 2FA?

Largely, yes — by using an authenticator app or hardware security key instead of SMS for two-factor authentication. SIM swaps only defeat text-message-based codes. You can also ask your mobile carrier to add a port-out PIN or account lock to make swapping your number harder.

Final Thoughts

A hacked Instagram account feels like an emergency, and the right response is speed plus the official channel. Go to instagram.com/hacked, hunt down the email-change reversal link, and lean on video selfie verification if your contact methods are gone. Once you are back in, change your password, kill unknown sessions, and turn on app-based two-factor authentication so it does not happen again.

The best recovery is the one you never need. Lock down your account now, stay skeptical of any link or service asking for your password, and keep your privacy settings tight. If you ever want to view public Instagram stories without logging in or exposing your own credentials, ViewIGStory does it server-side — no account, no login, no risk to your security.