Instagram account hacked: what to do in the first hour
The first steps after an Instagram account takeover: the security email link, instagram.com/hacked, video selfie verification, warning your followers and locking the account down so it does not happen again.
When an Instagram account is taken over, the first hour decides a lot. Attackers move fast: they change the email, phone and password, switch on their own two-step verification and start messaging your followers. Here is what to do, in order.
1. Look for the security email
When the email address on an account is changed, Instagram sends a message to the old address from security@mail.instagram.com with an option to reverse the change. If you find it, use it immediately. Check spam folders too.
2. Use the official recovery flow
Go to instagram.com/hacked on any browser and choose the option that matches your situation: you have access to the email or phone, the account was hacked, or the account was disabled. The flow may send a login code to your original contact details or ask you to verify your identity.
3. Verify your identity
If the account has photos of you, Instagram may ask for a video selfie turning your head in different directions. Business accounts without personal photos may be asked for other proof. Do it in good light, without filters.
4. Warn your followers
Ask friends, colleagues or a second account to post that the account was hacked. Attackers often ask followers for money, codes or crypto. A quick warning protects them and your reputation.
5. Lock the account down once you are back in
- change the password to one you have never used before, stored in a password manager
- turn on two-step verification with an authenticator app or a passkey, not only SMS
- check the email and phone number in Accounts Center
- log out every session you do not recognise
- remove third-party apps and websites you no longer use
- download your backup codes and keep them offline
How takeovers usually start
Most cases we see begin with a fake message: a copyright warning, a verification offer, a collaboration request or a “you have been reported” notice that leads to a login page. Instagram will never ask for your password in a direct message.
When to get help
If the recovery flow keeps failing, if the account is a business asset, or if the attacker is using it to defraud people, move quickly. We secure the linked email and devices, build the evidence file, file through the right channels and help you harden every account so it does not happen again.
Frequently asked questions
The hacker changed my email. Can I still recover the account?
Often yes. Instagram sends a message to the previous email address with a link to reverse the change. Use that link quickly, then follow the steps at instagram.com/hacked.
What is the video selfie check?
For accounts with photos of the owner, Instagram may ask for a short video selfie to compare with the photos on the account. It is used only for verification.
Should I pay someone who says they can unlock my account?
No. People who contact you offering to recover an account for a fee are almost always scammers, sometimes the same people who took it.