What to do when your Instagram account gets hacked

You tap the app and it logs you out. Your password no longer works. Maybe a friend texts you asking why you are selling crypto in your Stories.

You are not alone, and you are not stuck. In the Identity Theft Resource Center's 2025 consumer survey, 35.3 percent of identity-crime victims said a social media account had been taken over, up from 29.4 percent the year before.¹ Meta also says its recovery tools are working better: it reported the success rate of hacked-account recovery rose by more than 30 percent in the U.S. and Canada in 2025.²

The catch is order. Do the right things first, and most accounts come back through Instagram's own free tools.

Step 1: Check your email before anything else

When someone changes the email on your account, Instagram sends a message to your original address. It comes from security@mail.instagram.com.³

That email contains a link to reverse the change. Instagram's help center describes it as selecting "secure my account" in the message.⁴ If you catch it early, this is often the fastest way back in, because it undoes the attacker's change before they lock everything else.

• Search your inbox, spam, and promotions folders for "security@mail.instagram.com."
• Check that the sender address is exactly that. Scammers send look-alike emails.
• Meta says its real messages only come from its own domains, such as instagram.com, facebookmail.com, and meta.com.⁵

Step 2: Request a login link

If there is no email, or it did not work, go to the Instagram login screen and tap Forgot password? Enter your username, email, or phone number and tap Send login link. Instagram sends the link to the email or phone it has on file.⁴

If the attacker already changed both your email and phone, the link will go to them. That is when you move to Step 3.

Step 3: Verify your identity

If the login link fails, request support from a mobile device and give Instagram a secure email address that only you can access.⁴ From there, verification depends on your account:

• Accounts with photos of you: Instagram may ask for a short video selfie, turning your head in different directions. Instagram says the video is never shown on your account and is deleted within 30 days. If it fails, you can try again.⁴
• Accounts without photos of you: you may be asked for the email or phone number you signed up with, and the type of device you used when you created the account.⁴

Do this on a phone or tablet you have logged in with before, if you can. A familiar device helps Instagram match you to the account.

If a business Page or ad account is involved

For businesses, the Instagram account is often connected to a Facebook Page, a Meta business portfolio, and an ad account with your card on file. That raises the stakes.

• Hacked Facebook Page: Meta recommends submitting its Page recovery form, and says it aims to reply within a day. It recommends the form even if you have Meta Verified.⁷
• Can't log in to Facebook at all: start at facebook.com/hacked on a device you have used before.⁷
• Ad account: check for charges you did not approve and contact your bank if you see any. Review who has access in your business portfolio's settings.
• Do not open a new ad account to keep campaigns running while the old one is restricted. Meta can treat that as circumventing a restriction, which makes the original case harder.

Once you are back in: lock it down

Getting access back is half the job. Attackers often leave a way back in. Do these the same day.

1. Change your password to something long and unique. The FTC suggests 12 to 15 characters or a passphrase.⁸
2. Turn on two-factor authentication. In Settings, go to Accounts Center, then Password and security, then Two-factor authentication. An authentication app is the recommended method.⁹ Save your backup codes somewhere offline.
3. Log out unknown devices. In Accounts Center, open Password and security, then Where you're logged in, and log out anything you do not recognize.¹⁰
4. Check your email and phone on the account and fix anything the attacker changed.
5. Remove unknown linked accounts and apps from Accounts Center and your connected apps list.⁴
6. Audit business access. Meta recommends removing people who have not logged in within 90 days, removing users without two-factor, and keeping full control to a small group, ideally 10 or fewer, with two active admins.¹¹

Our free account security checklist walks through all ten settings in about 20 minutes.

The recovery scams to ignore

The moment you post "I got hacked," you will get DMs from "recovery experts." Ignore them.

The Better Business Bureau is blunt: account recovery through the platform is always free, and you should never pay someone to recover your social media account. In one case it reported, a victim paid $100 for "recovery" and was then asked for another $130 for "software."¹² Meta also warns never to trust messages demanding money or threatening to delete your account.⁵

Red flags to watch for:

• Anyone who asks for your password, two-factor code, or backup codes.
• Anyone who claims "insider access" at Meta or promises a guaranteed recovery.
• Payment requests in crypto or gift cards.
• Offers to "hack back" the account.

Legitimate help exists, especially for business accounts, restricted ad accounts, and cases where the official flow keeps looping. It looks different: a real company, no requests for your credentials, a written scope, and honesty that the platform makes the final call. That is how our account recovery team works, and why we always point people to the free official tools first.

The short version

Check your email for the security message and use it. If that fails, request a login link. If that fails, verify your identity with a secure email and, if asked, a video selfie. Once you are back, turn on app-based two-factor, clear unknown sessions, and audit who has access. Never pay a stranger in your DMs.

Sources

1. Identity Theft Resource Center, 2025 Consumer Impact Report.
2. Meta Newsroom, "Making it Easier to Access Account Support on Facebook and Instagram," December 2025, updated March 2026.
3. Instagram Help Center, "What to do if the email for your Instagram account was changed," 2026.
4. Instagram Help Center, "If you think your Instagram profile has been hacked," 2026.
5. Meta Help Center, "Avoid scams and phishing attempts," updated August 2026.
6. Instagram, instagram.com/hacked, observed September 2026.
7. Facebook Help Center, "Recover a hacked Facebook Page," 2026.
8. Federal Trade Commission, "Email or social media hacked? Here's what to do," October 2024.
9. Instagram Help Center, "Securing your Meta account with two-factor authentication," 2026.
10. Facebook Help Center, "Log out of Facebook on another device," 2026.
11. Meta Business Help Center, business portfolio security best practices, 2026.
12. Better Business Bureau, "Why you should never pay to recover your social media account," October 2023.