How to Recover a Hacked Instagram Account 2026
Quick Answer: To recover a hacked Instagram account, go to instagram.com/hacked from your phone or browser and follow the guided recovery flow. If your email and phone number haven’t been changed, reset your password immediately. If the hacker changed your contact info, use Instagram’s “Need more help?” option to verify your identity through a video selfie. The most important thing: act within the first hour — the longer you wait, the harder recovery becomes.
Time needed: 10 minutes to 72 hours (depending on hack severity) Difficulty: Beginner What you’ll need: Access to your original email or phone, a device with a camera (for video selfie verification), and your Instagram username
What to Do RIGHT NOW (Before Reading the Full Guide)
If you suspect your Instagram account has been hacked, stop everything and do these three things immediately — before reading the rest of this guide:
- Change your email password first. Most Instagram hacks start with a compromised email. Go to your email provider (Gmail, Outlook, Yahoo) and reset that password right now. This prevents the hacker from intercepting your Instagram recovery codes.
- Check your email for a message from security@mail.instagram.com. If the hacker changed your Instagram email or password, Instagram sends a notification to your original address. Look for a “Revert this change” or “Secure your account” link — and tap it immediately.
- Go to instagram.com/hacked. This is Instagram’s official recovery hub. Select “I think my account has been hacked” and follow the prompts. Do not Google “Instagram support number” — Instagram does not offer phone support, and any number you find online is a scam.
Why You Need to Act Fast When Your Instagram Is Hacked
Instagram is the second most targeted social media platform for hackers, with an estimated 22 million hacking incidents recorded in 2025 alone. In January 2026, a massive data leak exposed 17.5 million Instagram accounts on the dark web, making account takeovers even more common this year.
Here’s what happens if you don’t act quickly: hackers typically work in stages. First, they change your password. Then they swap your email address. Next, they remove your phone number and enable their own two-factor authentication. Once all three are done, recovering your account becomes significantly harder and can take days or even weeks through Instagram’s manual review process.
This guide is for anyone who has lost access to their Instagram account — whether the hacker changed your password, swapped your email, or locked you out completely. We cover every recovery method that actually works in 2026, including Instagram’s video selfie verification and the official hacked account support form.
How Your Instagram Account Gets Hacked (and Why It Matters for Recovery)
Understanding how you were hacked isn’t just educational — it directly affects how fast Instagram processes your recovery request. When you can describe the attack method to Instagram’s support system, your claim gets verified faster.
Phishing Messages and Fake Login Pages
This is the most common method in 2026. You receive a DM, email, or text message that looks like it’s from Instagram — claiming your account will be deleted, you’ve been selected for verification, or there’s a copyright violation. The link leads to a fake login page that captures your username and password. The page looks identical to Instagram’s real login screen, but the URL is slightly different (e.g., instagram-verify.com instead of instagram.com).
How to spot it: Instagram will never ask you to log in through a link sent via DM. Official Instagram emails only come from addresses ending in @mail.instagram.com or @instagram.com. You can verify this by going to Settings → Security → Emails from Instagram, which shows every legitimate email Instagram has sent you.
Password Reuse and Data Breaches
If you use the same password on Instagram as on another site that gets breached, hackers can access your account through credential stuffing attacks. A Google study found that 65% of people reuse passwords across multiple accounts. Tools like Have I Been Pwned let you check whether your email has appeared in known data breaches.
Third-Party App Exploits
Apps that promise free followers, analytics dashboards, or “who viewed your profile” features often require your Instagram login credentials. Once you grant access, these apps can take over your account. Some malicious apps use legitimate Instagram API access to scrape data and later exploit it.
SIM Swapping
In this more advanced attack, hackers contact your mobile carrier and convince them to transfer your phone number to a new SIM card. Once they control your number, they can intercept SMS-based two-factor authentication codes and reset your Instagram password. This is why cybersecurity experts now recommend using an authenticator app instead of SMS for 2FA.
How to Recover a Hacked Instagram Account: Step-by-Step Guide
There are four recovery methods, depending on how much access you still have. Start with Method 1 and work your way down if it doesn’t apply to your situation.
Method 1: Reset Your Password (If Your Email or Phone Hasn’t Been Changed)
Best for: You can’t log in, but your email address or phone number is still linked to the account.
In most hacks, attackers change your password first but don’t immediately remove your original email or phone number. If that’s your situation, this is the fastest path to recovery.
Step 1: Open Instagram and Tap “Forgot Password?”
Open the Instagram app on your phone (not a browser — the app has better recovery options). On the login screen, tap “Forgot password?” on iPhone or “Get help logging in” on Android.
What you should see: A screen asking you to enter your username, email, or phone number.
Step 2: Enter Your Username, Email, or Phone Number
Type in any contact information that was linked to your account before the hack. If you’re unsure of your exact username, try your email address instead.
What you should see: Instagram confirms it will send a login link or security code to your email or phone.
Common issue: If the screen says “No users found,” the hacker may have changed your username. Try your email address or phone number instead.
Step 3: Tap “Send Login Link”
Instagram sends a secure login link to whichever contact method is still available on the account. This bypasses the hacker’s new password entirely.
What you should see: A confirmation message saying a link was sent to your email or phone.
Step 4: Open Your Email or SMS and Tap the Login Link
Go to your inbox (or text messages) and find the message from Instagram. Tap the login link. This gives you temporary access to your account without needing the current password.
What you should see: You’re logged into your Instagram account.
Common issue: If you don’t receive the email within 5 minutes, check your spam/junk folder. Also look for emails from no-reply@mail.instagram.com or security@mail.instagram.com.
Step 5: Immediately Change Your Password
The moment you’re back in, go to Settings → Accounts Center → Password and Security → Change Password. Create a strong, unique password that you don’t use anywhere else. Use at least 12 characters, mixing uppercase letters, numbers, and symbols.
What you should see: A confirmation that your password has been updated.
Method 2: Use Instagram’s Official Hacked Account Flow (If Your Email and Phone Were Changed)
Best for: The hacker changed your email and phone number, and login links no longer reach you.
This is Instagram’s official recovery path for compromised accounts. It bypasses the stolen contact details and walks you through identity verification.
Step 1: Go to instagram.com/hacked
Open your mobile browser or the Instagram app. Navigate to instagram.com/hacked — this is Instagram’s dedicated recovery hub that launched in late 2022 and remains the official entry point for all account access issues.
What you should see: A screen with several options including “I think my account has been hacked,” “I forgot my password,” and others.
Step 2: Select “I Think My Account Has Been Hacked”
Tap this option. Instagram will ask you a series of questions to determine the best recovery path for your specific situation.
What you should see: A prompt asking for your username, email, or phone number.
Step 3: Enter Your Original Account Information
Type your username (or the email/phone that was originally on the account). Even if the hacker changed these, Instagram keeps historical records of what was previously linked.
What you should see: Instagram confirms your account was found and presents recovery options.
Common issue: If Instagram keeps redirecting you to the Help Center instead of the recovery flow, try the following: uninstall and reinstall the Instagram app to clear the cache, then attempt the process again. The “My account was hacked” options often don’t appear correctly on desktop — use the mobile app.
Step 4: Tap “Need More Help?” or “Can’t Access This Email or Phone Number?”
This is the critical step that most guides skip. When Instagram asks you to choose a recovery method (email or phone), look for the link at the bottom that says “Need more help?” or “Can’t access this email or phone number?”. Tap it.
What you should see: A form asking you to provide a secure email address that only you can access.
Common issue: This option sometimes doesn’t appear on the first try. If it’s missing, close the app, wait 10 minutes, and try again from the login screen.
Step 5: Provide a New Secure Email Address
Enter an email address that the hacker does not have access to. Ideally, use a completely new email address that isn’t linked to any Instagram or Facebook account. Instagram will send recovery instructions to this address.
What you should see: A confirmation that Instagram received your request and will contact you at the new email address.
Step 6: Complete the Video Selfie Verification
Instagram will likely ask you to record a video selfie to confirm your identity. This is their primary verification method when contact information has been changed.
Here’s how to do it correctly:
- Hold your phone at eye level
- Follow the on-screen instructions (you’ll be asked to slowly turn your head left, right, up, and down)
- Use natural lighting — avoid harsh overhead lights or dim rooms
- Remove glasses, hats, or anything covering your face
- Keep a neutral expression
Instagram’s AI system compares your video against photos on your account. Processing typically takes anywhere from a few hours to 48 hours, though many users report faster results.
What you should see: A message confirming your video selfie was submitted and is under review.
Common issue: If the video selfie keeps failing or you see “We couldn’t confirm it’s you,” try these fixes: use natural lighting (not artificial), clean your phone’s front camera, try from a different device, and avoid submitting multiple attempts rapidly — this triggers a cooldown period that can last 24–72 hours. If you’re using a VPN, turn it off, as it can interfere with the verification process.
Method 3: Recover Through the Instagram Support Form
Best for: The video selfie failed, or your account doesn’t have photos of your face (business accounts, pet accounts, brand pages).
Step 1: Open the Instagram App and Navigate to Help
If you can access the login screen, tap “Forgot password?” → enter your username → tap “Need more help?” → select “I can’t access this email or phone number.”
Alternatively, if you have another Instagram account you can log into, go to Settings → Help → Report a Problem and describe your situation.
What you should see: A form where you can describe your issue in detail.
Step 2: Fill Out the Support Form With as Much Detail as Possible
Instagram’s support form asks for your previous username, any email addresses you’ve used, and a description of what happened. Be specific — write something like: “My email was changed from [old email] to an unknown address on [date]. My phone number was also removed. I did not authorize these changes.”
What you should see: A submission confirmation.
Step 3: Respond to Instagram’s Identity Verification Email
Instagram will email you at the secure address you provided. They may ask you to:
- Take a photo of yourself holding a handwritten note with a code they provide, your full name, and your username
- Provide the type of device you originally signed up on (iPhone, Android, iPad)
- Confirm the email address or phone number you used when you created the account
What you should see: An email from Instagram with specific instructions.
Common issue: These manual reviews can take anywhere from 24 hours to several weeks. Do not submit multiple requests — this can slow down the process. Submit one clean, thorough request and wait.
Method 4: Recover Through Meta Verified or Facebook-Linked Support
Best for: Business accounts, creator accounts, or anyone with a Facebook account linked to their Instagram.
If your Instagram and Facebook accounts are connected, you can access Meta’s support team through Facebook.
Step 1: Log Into Facebook on Desktop
Go to Facebook and navigate to Settings → Accounts Center → Enhanced Support.
What you should see: The Accounts Center dashboard showing your linked accounts.
Step 2: Select Your Linked Instagram Account
Find your Instagram account in the Accounts Center. If it still shows as linked (even if hacked), you can initiate support from here.
What you should see: Options to manage your linked Instagram account.
Step 3: Choose “I’ve Been Hacked” and Follow the Prompts
Meta’s support flow for linked accounts gives you access to chat support in some cases — particularly if you have a business page or run ads through Meta.
What you should see: A support form or, in some cases, a live chat option with a Meta representative.
Common issue: Multiple users report that Meta support agents say they can only help with business accounts, not personal ones. If you hear this, politely insist that your Instagram is linked to your Facebook business page, or ask to have your case escalated to the internal team.
Step 4: Complete Identity Verification
You’ll be asked to verify your identity — typically through a government ID, business documentation, or a combination of both.
What you should see: A confirmation that your case has been submitted for review.
What to Do After You Recover Your Account
Getting back into your account is only half the battle. Hackers often leave backdoors — active sessions, linked apps, or secondary contact methods — that let them regain access within hours. Follow these steps immediately after recovery.
Step 1: Remove All Unknown Devices From Your Account
Go to Settings → Accounts Center → Password and Security → Where You’re Logged In. You’ll see every device currently signed into your Instagram. Remove any device you don’t recognize — pay close attention to unfamiliar locations, browsers, or device names.
What you should see: Only your current device listed after removing unknown sessions.
Step 2: Enable Two-Factor Authentication With an Authenticator App
Go to Settings → Accounts Center → Password and Security → Two-Factor Authentication. Choose Authentication App (such as Google Authenticator or Microsoft Authenticator) instead of SMS. SMS-based 2FA can be bypassed through SIM swapping attacks. An authenticator app generates codes locally on your device, making it significantly harder for hackers to intercept.
What you should see: A QR code to scan with your authenticator app, followed by a confirmation that 2FA is active.
Step 3: Revoke Access to Suspicious Third-Party Apps
Go to Settings → Security → Apps and Websites. Review every app that has access to your Instagram account. Remove anything you don’t recognize, no longer use, or didn’t authorize. Malicious third-party apps are one of the most common ways hackers maintain access even after a password reset.
What you should see: A clean list with only apps you trust and actively use.
Step 4: Update Your Email Password and Enable 2FA on Your Email
Since many Instagram hacks begin with a compromised email account, your recovery isn’t complete until your email is secured. Change your email password to something unique and enable two-factor authentication on your email provider as well.
Step 5: Save Your Backup Codes
After enabling 2FA, Instagram provides a set of backup recovery codes. Screenshot these or write them down and store them in a safe place. If you ever lose access to your authenticator app, these codes will let you log in.
Step 6: Check and Update Your Contact Information
Go to Settings → Accounts Center → Personal Details. Make sure your email address and phone number are correct and up to date. Add a secondary email address if possible — this gives you an extra recovery option if your primary email is ever compromised again.
Troubleshooting: What If It’s Not Working?
Video Selfie Keeps Getting Rejected
Symptom: You submit the video selfie and get a message saying “We couldn’t confirm it’s you” or the verification just loops without progressing.
Cause: Instagram’s AI compares your video against photos on your profile. Poor lighting, accessories covering your face, or a lack of photos of you on the account can cause failures. Rapid repeated attempts also trigger a cooldown period.
Fix: Wait at least 24 hours before trying again. Record the selfie in natural daylight near a window. Remove glasses, hats, and face coverings. Make sure your front camera lens is clean. Use the same device you previously logged into Instagram on — this can help Instagram recognize you. If your account doesn’t have photos of your face (pet accounts, business pages), the video selfie won’t work — use Method 3 (support form) instead.
Instagram Keeps Sending Recovery Emails to the Hacker’s Address
Symptom: When you try to reset your password, Instagram sends the link to an email you don’t control.
Cause: The hacker replaced your email address on the account.
Fix: Do not use the standard “Forgot password?” flow. Instead, go directly to instagram.com/hacked and select “My account was hacked.” Then look for the “Need more help?” option, which allows you to provide a new, secure email address for recovery. Important: the “My account was hacked” options work better on the mobile app than on desktop.
The “Need More Help?” Option Isn’t Showing Up
Symptom: You follow the recovery flow but never see the option for additional help or identity verification.
Cause: This is often a caching issue or a browser-related glitch.
Fix: Uninstall and reinstall the Instagram app to clear its cache. Try the recovery process on the mobile app instead of a browser. If you’re using a VPN, turn it off. Some users have had success using the recovery flow in a browser’s incognito/private mode as well.
Account Was Hacked and Then Disabled
Symptom: Your account no longer appears in search, and you see “No account found” when trying to recover.
Cause: The hacker may have violated Instagram’s community guidelines (posting spam, scam content, or illegal material), causing Instagram’s automated systems to disable the account.
Fix: Go to Instagram’s appeal form for disabled accounts. Fill it out using your original email address and username. Explain that your account was compromised and the violations were not your doing. This triggers a different review process than the standard hacked account flow — be patient, as manual reviews can take one to four weeks.
You Recovered the Account, But the Hacker Got Back In
Symptom: You successfully changed your password and regained access, but within hours or days, you’re locked out again.
Cause: The hacker still has active sessions on other devices, or they linked their own email/phone as a backup contact. Another possibility: they connected a third-party app that re-authenticates them.
Fix: Immediately after recovery, complete all six steps in the post-recovery security section above — especially removing all unknown devices, revoking third-party app access, and enabling authenticator-based 2FA. Also change your password one more time after clearing all sessions. This invalidates every existing login token.
Pro Tips for Instagram Account Recovery
Tip 1: Use the mobile app, not a browser. Instagram’s recovery flow is significantly more complete on the mobile app. The “My account was hacked” pathway and the video selfie option often don’t appear on desktop. If you’re having trouble, always switch to the app.
Tip 2: Don’t spam recovery requests. Submitting multiple recovery forms, video selfies, or password reset requests in a short period doesn’t speed things up — it actually slows recovery down. Instagram’s system applies cooldown periods (24–72 hours) when it detects repeated attempts. Submit one clean, thorough request and wait.
Tip 3: Save proof of ownership before you need it. Right now, while you still have access to your account, go to Settings → Accounts Center → Your Information and Permissions → Download Your Information. This creates a backup that includes your email, phone number, account creation date, and login history — all of which can help prove ownership during a future recovery. Also screenshot your follower count, bio, and any verified badges.
Tip 4: Never trust “Instagram recovery services.” If someone contacts you via DM, email, or even a comment claiming they can recover your account for a fee, it’s a scam. Instagram’s official recovery tools are free. There is no paid shortcut, and no third-party service has special access to Instagram’s systems. The FTC has issued warnings about phishing scams disguised as account recovery services.
Tip 5: Check if your data was leaked. After the January 2026 Instagram breach, cybersecurity firm Malwarebytes launched a free Digital Footprint Portal where you can enter your email to see if your credentials were exposed. You can also use Have I Been Pwned to check across multiple breach databases.
How to Prevent Your Instagram From Being Hacked Again
Prevention is significantly easier than recovery. Here’s what to do to lock down your account permanently:
- Use a unique, strong password. At least 12 characters with a mix of letters, numbers, and symbols. Never reuse passwords across platforms. Use a password manager like 1Password or Bitwarden to generate and store unique passwords.
- Enable two-factor authentication with an authenticator app. SMS-based 2FA is better than nothing, but it’s vulnerable to SIM swapping. An authenticator app (Google Authenticator, Microsoft Authenticator, or Authy) is significantly more secure.
- Never click login links from DMs or emails. If you receive a message claiming your account will be deleted, don’t click the link. Instead, open Instagram directly through the app or by typing instagram.com in your browser.
- Regularly audit linked third-party apps. Go to Settings → Security → Apps and Websites every few months and remove any apps you no longer use or recognize.
- Keep your email secure. Your email is the master key to all your online accounts. Use a strong, unique password for your email and enable 2FA on it as well.
- Turn on login request notifications. Go to Settings → Security → Login Activity. Instagram can notify you whenever someone logs in from an unfamiliar device or location.
Recommended Tools for Instagram Security
- Google Authenticator: Free two-factor authentication app that generates time-based codes on your device. Essential for securing your Instagram account against SIM swap attacks.
- Have I Been Pwned: Free service that lets you check if your email or phone number has been exposed in any known data breach — including the January 2026 Instagram leak.
- 1Password or Bitwarden: Password managers that generate and store unique, complex passwords for every account. This eliminates the risk of password reuse, which is one of the top ways Instagram accounts get compromised.
- Malwarebytes Digital Footprint Portal: Free tool to check your overall digital exposure after data breaches.
For more on protecting your online accounts, check out our guides on the best password managers and best authenticator apps.
Frequently Asked Questions
How long does it take to recover a hacked Instagram account?
It depends on the severity of the hack. If the hacker only changed your password but left your email and phone number intact, recovery takes less than 10 minutes through a simple password reset. If the hacker changed your email and phone number, Instagram’s video selfie verification typically processes within 24 to 48 hours. In the worst cases — where identity verification requires manual review or the account was disabled — recovery can take anywhere from one to four weeks. The key factor is speed: the sooner you start the recovery process after the hack, the faster it resolves. Submitting multiple recovery requests does not accelerate the process and can actually trigger cooldown delays.
Can I recover my Instagram if the hacker changed my email and phone number?
Yes, you can still recover your account even if the hacker replaced both your email and phone number. Go to instagram.com/hacked on the mobile app and select “I think my account has been hacked.” Then tap “Need more help?” when prompted for a recovery method. This lets you provide a new secure email address and complete identity verification through a video selfie. Instagram’s system keeps historical records of previously linked contact information, so your original details still help verify your ownership even after they’ve been removed from the account.
Is Instagram account recovery free?
Yes, recovering your Instagram account is completely free. Instagram does not charge for any part of the recovery process, including video selfie verification, support forms, and identity checks. Any person or service asking you to pay for Instagram account recovery is running a scam. Instagram does not have a paid support tier for account recovery, and no third-party service has special access to Instagram’s internal systems. The only legitimate paid Meta service that includes enhanced support is Meta Verified, which offers priority assistance for subscribers — but even then, the account recovery tools themselves remain free.
Can I recover my hacked Instagram account on my computer?
You can start the recovery process on a computer by visiting instagram.com/hacked, but the full recovery flow works significantly better on the mobile app. Several critical options — including the “My account was hacked” pathway, the video selfie verification, and the “Need more help?” link — often do not appear correctly on the desktop version. If you’re having trouble with recovery on a computer, switch to the Instagram app on your phone. Uninstall and reinstall the app before starting the process to clear any cached data that might interfere.
What do I do if Instagram’s video selfie verification keeps failing?
First, wait at least 24 hours before trying again — rapid repeated submissions trigger a cooldown period that can block verification for 24 to 72 hours. When you retry, use natural daylight near a window (not artificial overhead lighting). Remove glasses, hats, or anything covering your face. Clean your front camera lens and hold the phone at eye level. Turn off any VPN you might be running, as it can interfere with the verification process. If your account doesn’t have photos of your face (business accounts, pet pages, brand profiles), the video selfie won’t work at all — you’ll need to use Instagram’s support form instead and verify your identity through other means like providing original signup details or business documentation.
Does Instagram have a phone number I can call for support?
No. As of 2026, Instagram does not offer a general support phone number for account recovery. Any phone number you find online claiming to be Instagram support is a scam. The only way to contact Instagram about a hacked account is through the official in-app recovery flow at instagram.com/hacked or through the help forms within the app. If you have a business account linked to Facebook, you may be able to access live chat support through Meta’s Accounts Center, but this is not guaranteed for personal accounts.
Can I recover a hacked Instagram account without an email or phone number?
Yes, but the process is more difficult. If you no longer have access to the email or phone number originally linked to your account, Instagram relies on video selfie verification to confirm your identity. During the recovery flow (via “Need more help?”), you’ll provide a new, secure email address where Instagram can send recovery instructions. The video selfie compares your face to photos on your profile. If your account doesn’t have photos of your face, you’ll need to provide additional information — such as the device type you used to sign up, the approximate date you created the account, and any previous usernames.
How do I know if my Instagram account has been hacked?
Several warning signs indicate your Instagram account may be compromised. The most obvious is being unable to log in with your usual password. Other signs include receiving an email from Instagram (from security@mail.instagram.com) notifying you of a password change or new email address you didn’t authorize. You might also notice unfamiliar posts, stories, or DMs sent from your account, a sudden change in your follower or following count, login notifications from devices or locations you don’t recognize, or changes to your profile photo, bio, or username. If you spot any of these signs, act immediately — go to Settings → Password and Security → Login Activity to review recent sessions and change your password before the hacker locks you out.
Is it safe to click on password reset emails from Instagram?
It depends on whether the email is legitimate. Official Instagram emails come only from addresses ending in @mail.instagram.com or @instagram.com. You can verify any email Instagram has sent you by going to Settings → Security → Emails from Instagram — this shows a log of every legitimate email from the platform. If the email matches what you see in this log, it’s safe to click. If it doesn’t appear there, it’s likely a phishing attempt — delete it immediately. In January 2026, after the 17.5 million account data leak, hackers used exposed email addresses to trigger mass password reset emails. If you receive one you didn’t request, don’t click the link — instead, open the Instagram app directly and change your password manually.
How often should I change my Instagram password?
You don’t need to change your Instagram password on a fixed schedule if you follow good security practices. The more important steps are using a unique password that you don’t reuse on any other platform, enabling two-factor authentication with an authenticator app (not SMS), and regularly checking Have I Been Pwned to see if your email has appeared in any data breaches. If a breach does expose your credentials, change your password immediately. You should also change it if you notice any suspicious login activity, if you’ve logged in from a shared or public device, or if you’ve previously granted access to a third-party app you no longer trust. A strong, unique password combined with app-based 2FA provides far better protection than frequent password rotations.