How to Recover a Hacked Instagram Account: First Steps

You open Instagram and the password does not work. Or it still works, but your bio, your email and your posts have changed. Either way, someone else is likely in control of the account right now, and the first ten minutes decide how much damage they do before you get it back.

You can still act, even without being logged in. Instagram built a dedicated hacked-account flow for exactly this, and your email account matters just as much as Instagram itself. This guide walks through the first steps in order, what to avoid, and what happens next.

Last checked: 9 November 2026.

#Quick Answer

Check your email first for a security alert about a changed password or email address; Instagram sometimes lets you undo the change directly from that message. If you cannot log in at all, go to instagram.com/hacked on your phone or a browser and choose the option that matches your situation. Secure the email account linked to Instagram too, since the attacker can use it to lock you out again. Warn your contacts through a different channel, since a hacked account is often used to message followers asking for money. Nobody outside Meta, including AwareXone, can reinstate the account for you.

#The First 10 Minutes

1. Open the email inbox linked to the Instagram account and look for a recent security alert about a password or email change. Do this before trying anything else in the Instagram app.
2. If you can still log into Instagram, change the password immediately, then go to Settings and log out of all other sessions.
3. If you cannot log in, go to instagram.com/hacked in a browser or the app and select the option closest to your situation: a hacked account, a password problem, or a lost two-factor device.
4. Do not try several password guesses or repeatedly hammer the login screen; that can trigger Instagram's automated abuse protections and slow down your own recovery.
5. Check whether Instagram is showing you a disable or suspension notice rather than a normal hacked-account flow. If so, that is a different process; see our guide to a disabled Instagram account.

#The Next Hour

1. Secure the email account itself: change its password, check for forwarding rules you did not set, and sign out of sessions you do not recognise.
2. Check your phone for an unexpected no service message, which can mean a SIM swap rather than a simple password compromise, and call your carrier if so.
3. Complete any identity check Instagram's recovery flow asks for, which can include a short video selfie, only inside the official instagram.com/hacked flow, never through a link sent to you by someone else.
4. Record what you know about the account: the username, the email and phone it was created with, roughly when you created it, and the device you normally use.
5. Screenshot anything the attacker changed or posted, with visible dates and times, in case you need it for an appeal later.

#Warn Your Contacts

Hacked accounts are often used to message followers asking for a loan, a code, or a click on a link. Warn people through a channel the attacker does not control, such as a text message or a different app, rather than relying on the compromised Instagram account itself.

• Tell close contacts directly that the account was taken over and not to trust requests for money or codes from it.
• If the account runs a business, consider a short, calm post on another platform you still control.
• Keep a record of any messages the attacker sent, since they may be useful evidence later.

#What Not to Do

• Do not pay anyone who contacts you offering a fast recovery for a fee. Meta's help page on phone support says plainly that Meta has no general public customer service phone number, and that numbers claiming to be Meta support are potentially scams.
• Do not share your password, a login code, a backup code, or a video selfie with anyone outside the official Instagram app or website, including someone claiming to work for a recovery company.
• Do not create a replacement account while recovery is in progress. Meta's Account Integrity policy allows it to restrict accounts created to evade enforcement or owned by the same person as a disabled account, so a new account can complicate the original case.
• Do not ignore an identity check request inside the official flow out of caution; it is one of Instagram's standard steps, not a sign something has gone wrong.

#If Nothing Works Through the Normal Flow

Instagram does not publish a fixed timeline for hacked-account cases, and some require more than one attempt through the flow. If the account was also disabled because of what the attacker did with it, you may need to go through both an identity check and a disable appeal; our guide to a disabled Instagram account in Malaysia covers that combination. If you are not sure the account can still be reached at all, our guide to losing access to your email, phone or 2FA covers the fallback routes.

#When Professional Help Makes Sense

Many people recover a hacked Instagram account on their own using the steps above, and this guide is written so you can do exactly that. A second opinion helps when the account supports your income, when a hack and a disable notice are tangled together, when the attacker changed the email and phone and recovery keeps failing, or when you are not sure which official route still applies. SocialSafe by AwareXone, our recovery service, reviews the account and what has already happened, then tells you plainly whether an official route is still open. Our Instagram account recovery service explains how that review works, and our Trust Center sets out what we will never ask you for.

#Frequently Asked Questions