My Instagram Was Hacked: How to Get It Back (Even If the Email Changed)

Someone got into your Instagram and may have changed your email, phone number or password. Start at instagram.com/hacked, Instagram’s own recovery page, and follow its steps (Instagram). Don’t call a “support number” or pay anyone to get your account back: Meta says phone numbers claiming to be its customer support are potentially scams.

My Instagram was hacked: what to do first

1. Go to instagram.com/hacked in a web browser if someone got in or you can’t log in.
2. Check your inbox for an email from security@mail.instagram.com about an email change. Its link can reverse the change.
3. Still logged in? Change your password, log out devices you don’t recognize and turn on two-factor authentication.
4. Secure your email. Whoever can read your email can probably get into your Instagram too, Instagram warns.
5. Warn your friends, and ignore anyone who offers paid recovery.

Locked out? Skip to “Instagram hacked account recovery.”

Signs your Instagram was hacked

The FTC lists these warning signs:

• You can’t log in.
• You’re notified of a username or password change you didn’t make.
• You’re told someone logged in from a device you don’t recognize or a place you’re not at.
• Friends get messages you didn’t send, sometimes with links or fake pleas for money.

Instagram adds two: an email saying your email address changed, and comments or posts you didn’t make.

A password reset email you didn’t request doesn’t necessarily mean you were hacked: someone may have entered your email by mistake. If it’s not from Instagram, don’t click its links (Instagram).

Instagram hacked and the email changed: how to undo it

Didn’t change your email? Instagram sends a message to your original address from security@mail.instagram.com, with a special link to reverse the change and help secure your account (Instagram). You may be able to undo the change by selecting secure my account in that message; if the hacker also changed your password and you can’t switch the email back, request a login link or security code, as shown below (Instagram).

Is security@mail.instagram.com legit?

It’s the address Instagram names for this email (Instagram). Instagram says its account security emails come only from addresses ending in @mail.instagram.com, @support.instagram.com, @facebookmail.com, @support.facebook.com or @global.metamail.com. If you can still log in, Password and security > Recent emails shows the official emails it sent you in the last 14 days (Instagram).

If the hacker took your email or phone number too

Instagram can’t help you get back into your email account; ask your email provider (Instagram). See My email was hacked. Lost your phone number? See Someone swapped my SIM or ported my number.

Instagram hacked account recovery: if you can’t log in

Instagram recommends trying every step, since some may not be available for your type of account (Instagram).

1. Start at instagram.com/hacked. Enter your username, phone number or email so Instagram can find your account.
2. Request a login link. On the login screen, tap Forgot password?, enter your username, email or phone number, and choose where to get the link. Then tap it in your email or text message (Instagram).
3. Request a security code or support. In the Instagram app, tap Can’t reset your password? and ask for a security code. No code? Tap I can’t access this email or phone number and follow the steps, giving an email address only you can access. Instagram will email you next steps (Instagram).
4. Linked to Facebook? Try Reset using Facebook (Instagram).

How Instagram confirms it’s you

• No photos of you on the account: expect an automatic email from Meta’s support team asking for the email or phone number you signed up with and the device you used then, like an iPhone (Instagram).
• Photos of you on the account: you’ll be asked for a video selfie, turning your head in different directions. Instagram says the video is never visible on Instagram, is deleted within 30 days, and can be sent again if it doesn’t confirm your identity (Instagram).
• An ID: Instagram may ask for one to confirm the account is yours (Instagram). A driver’s license or passport works; otherwise, send two documents with your full name, at least one showing your photo and age. Physically cover details Instagram doesn’t need, like your ID number, before taking the photo (Instagram).

During a video selfie review, you can’t use your account. If you pass, you may get a password reset link by email (Instagram).

Instagram hacked and disabled

If Instagram disabled your account, you’ll see a message when you try to log in. Think it’s a mistake? You may be able to ask for a review by logging in and following the on-screen instructions (Instagram).

No disabled message, but still locked out? Someone may have gained access, so start at instagram.com/hacked. If the account was deleted, by you or by someone with your password, there’s no way to restore it.

Is there an Instagram support number?

Not a general one. Meta, including Instagram, has no general public phone number for customer service, and it says numbers claiming to be Meta support are potentially scams to avoid. Meta Verified subscribers do get email and chat support (Instagram).

Instagram says it never contacts you about account security by direct message (Instagram). To reach a login page, use a bookmark instead of search results or ads, the FBI’s IC3 advises.

Back in? Lock the hacker out

First, update your security software and run a scan, the FTC suggests. Most settings below are under Password and security: go to your profile, tap Menu, then Accounts Center (Instagram).

• Change your password under Change password (Instagram), to one you haven’t used for other accounts (Instagram). That logs you out of all other devices, so anyone else logged in loses access (Instagram).
• Log out devices you don’t recognize: Where you’re logged in > your account > Select devices to log out (Instagram).
• Check your email and phone number are correct (Instagram). Update them in Accounts Center under Profiles and personal details (Instagram).
• Turn on two-factor authentication. Tap Two-factor authentication and choose an authentication app (Instagram’s recommended method), text message or WhatsApp (Instagram). Instagram calls it the most effective single step against hackers (Instagram). Then tap Additional methods > Backup codes > Get new codes to cancel the old ones (Instagram).
• Remove apps you don’t recognize: Menu > Website permissions > Apps and websites > Remove (Instagram). Changing your password doesn’t cut off an app you approved, the FBI warns; you have to revoke its access in your security settings (FBI IC3, 2026).
• Check linked accounts and saved cards. Remove linked accounts you don’t recognize in Accounts Center (Instagram). Saved cards are under Meta Pay > Manage (Instagram).

Had two-factor on and still got hacked? Multi-factor authentication “will not protect you if you land on a fraudulent login page,” the FBI says, and criminals trick people into sharing password reset codes (FBI IC3, 2026).

Warn your friends: scams hackers run from stolen accounts

Scammers “might hack into your account to scam your friends,” the FTC says. People reported losing $2.1 billion to scams that started on social media in 2025 (FTC, April 2026).

Text or email your friends, or post something, telling them not to click links from you and to ignore pleas for help or money (FTC). Tell them to watch for:

• A sudden “investing pro”: posts about easy money, then messages asking for a few hundred dollars in cryptocurrency or through a payment app (FTC, May 2025).
• Crypto giveaways: hijacked accounts with large followings push cryptocurrency “giveaways” linking to sites that steal wallet information, the FBI warns.
• Emergencies and prizes: people claiming to be a friend or relative in an emergency, or a lottery prize you can collect for a small fee up front (Instagram).
• Code requests: “Anyone who asks you for your account verification code is a scammer,” the FTC says.

Even if a message looks like it’s from a friend, “their account may have been hacked,” so call them to check (FTC, 2023).

Can I get my money back?

It depends on how the money moved (FTC):

• Charges on your saved card: Report them right away to your card issuer or bank, using the number on the back of the card, and ask for a refund. Federal law protects you from unauthorized use of your credit or debit card.
• You or a friend paid the impostor: Report it right away to the bank, payment app or card issuer used, and ask them to reverse the payment. More help: Cash App, Venmo, PayPal.
• Cryptocurrency: Contact the exchange or ATM operator right away. Crypto payments don’t have the same legal protections as cards, so it can be hard to get that money back.

How to report a hacked Instagram account

• Instagram: Secure the account at instagram.com/hacked. Report scam posts or profiles with Options > Report; “Scam, fraud or spam” is one reason (Instagram). A new account pretending to be you? Report impersonation, with a photo of your government-issued ID (Instagram).
• FBI: Account takeover victims should report it at IC3.gov (FBI, 2024). Use the words “account takeover” in your description (FBI IC3).
• FTC: Lost money? Report it at ReportFraud.ftc.gov. The FTC uses reports to build cases against scammers and spot trends (FTC).
• Stolen personal information: Report it at IdentityTheft.gov to get a personalized recovery plan (FTC). See what a scammer can do with your information.
• Your state attorney general: People who struggled to get help from Meta have turned to their attorneys general; New York’s office saw a 1,000 percent increase in account takeover complaints from 2019 to 2023 (New York Attorney General, 2024).
• Threats or stolen photos: If someone threatens to share private information unless you pay, report it to Instagram and local law enforcement (Instagram). For explicit images taken from your accounts and posted online, the FBI asks victims to use ncii.ic3.gov (FBI IC3, 2026). See Someone is threatening to share my photos.

The report-a-scam tool lists more official channels, and the scam recovery checklist helps you track each step.

Watch for the follow-up scam

• Fake Instagram support: people claiming to be from Instagram security who ask for your username or password, or offer account verification services (Instagram).
• Paid “recovery” help: if someone contacts you offering to recover what you lost and asks for an upfront fee, “That’s a scammer,” the FTC says.
• Threats about your account: Instagram says not to trust messages that demand money, offer gifts or threaten to delete or ban your account (Instagram).
• Codes you didn’t ask for: be careful with them, and don’t share login information with anyone, even someone who claims to work for the platform (FBI IC3, 2026).
• Fake FBI contacts: “The IC3 will never directly contact you for information or money” (IC3).

Did a link start all this? See I clicked a phishing link.

What varies

• Menus. You may see Meta Account settings instead of Accounts Center (Instagram), and steps differ on iPhone, Android and computers.
• Recovery options. Some steps may not be available for your account (Instagram). If you’ve lost the email you signed up with and never linked Facebook, one Instagram help page says it can’t give you access (Instagram). Still try the support request above.
• New devices. After a login from a device it doesn’t recognize, Instagram limits some security settings on that device for a few days, so use a phone or computer you regularly use (Instagram).
• Professional accounts. If a hacker keeps acting on one after you log in, Instagram has separate steps in Meta Business Suite.
• Facebook. Hacked too? See My Facebook was hacked.