Short answer: first look in your inbox for an email from security@mail.instagram.com about the change and use its link to secure your account. If there is none, go to instagram.com/hacked and follow the steps. Instagram may ask for a login code, the email or phone you signed up with, or a video selfie. Once you are back in, change your password and turn on two-factor authentication.
Act fast, in this order
The sooner you start, the more options you have. Hackers often change the email, then the phone number, then turn on two-factor authentication with their own device.
- Check your email, including spam, for a message from security@mail.instagram.com saying your email or password was changed. It contains a link to undo the change and secure your account. Use it.
- Go to instagram.com/hacked on your phone or computer, and choose the option that matches what happened.
- Enter the username, email or phone number linked to the account so Instagram can find it.
- Ask for a login link or code sent to your email or phone, if you still have access to one of them.
- If nothing arrives, follow the "need more help" steps and give an email address that only you can access.
You can also find these steps on Instagram's help page for hacked accounts.
If the email and phone number were both changed
This is a very common situation, and it does not always mean the account is lost.
- The security email still counts. Instagram sends it to the old address, so the link inside works even after the hacker changed it.
- Accounts with photos of you can be confirmed with a video selfie where you turn your head in different directions. Meta says the video is never shown on Instagram and is deleted within 30 days. If it fails, you can try again.
- Accounts without photos of you may need the email or phone number used at signup and the type of device you signed up with.
- Request support from a mobile device if the computer version doesn't show the option.
Once you are back in
Lock the account down before you do anything else:
- Change your password to a new one you don't use anywhere else.
- Turn on two-factor authentication, ideally with an authentication app rather than SMS.
- Check the email and phone number in your settings and remove anything that isn't yours.
- Log out of unknown devices in the login activity list.
- Remove apps and websites you don't recognise that have access to your account.
- Secure your email account too, because whoever controls your email can take Instagram again.
Our guide to keeping your Instagram account safe goes further.
Watch out for recovery scams
People who just lost an account are the main target of fake "Instagram support" accounts and recovery offers. Remember:
- Instagram does not DM you about your account.
- Real emails from Meta only come from domains such as instagram.com, facebookmail.com, facebook.com, fb.com, meta.com or metamail.com.
- Never send your codes to someone who contacts you first, and never pay anyone who claims to work for Instagram.
When to ask for help
If the official steps have not worked, or the account is a business or creator page you can't afford to lose, QJIH can look at your case. We are an independent agency based in Paris, not Meta, and we have recovered 2,000 accounts and pages since 2019. We tell you honestly what can be done, and agree the price and terms before anything starts.