How to Report a Hacked Instagram Account and Recover It

Few moments feel as sickening as opening Instagram and realising you are locked out of your own account. Your password no longer works, the email address looks unfamiliar, and your followers are receiving strange messages or seeing posts you never made. Hacked accounts are often used to promote scams, so every hour the attacker stays in control puts your reputation and your followers at risk too.

The good news is that many accounts can be recovered, even when the password and contact details have been changed. Instagram has a dedicated recovery process for exactly this situation, but it works best when you act quickly, use the official route, and avoid the many fake recovery services that target worried account owners.

This guide takes you step by step through checking whether you were really hacked, reporting the account through Instagram’s official hacked-account page, proving your identity, and then locking the account down properly so it does not happen again.

Quick Answer

Go to instagram.com/hacked in your browser, choose My account was hacked, and follow the identity verification steps, which may include a video selfie. If you still receive Instagram’s security emails, use the secure your account link in the most recent one to reverse changes. Never pay a third party who promises recovery.

First, Confirm Your Account Was Really Hacked

Before starting recovery, rule out simpler explanations. Check that you are entering the correct username, try logging in with your email address and phone number as well, and confirm Instagram is not experiencing a wider outage. Then look for the classic signs of a genuine compromise.

Warning signs include a password that suddenly stops working, a notification that your email address or phone number was changed, login alerts from places you have never been, posts, stories, or direct messages you did not send, and new following activity you do not recognise. If friends tell you they received a suspicious investment or giveaway message from your account, treat that as confirmation and move straight to recovery.

If you can still log in, act immediately from inside the account. Change your password to a strong, unique one, check the accounts centre for unfamiliar email addresses and phone numbers, remove any you do not recognise, and turn on two-factor authentication. Acting while you still have access is far easier than a full recovery later. Our other step-by-step cyber security guides for everyday users cover password managers and two-factor setup in more detail.

How to Report and Recover a Hacked Instagram Account

Use only Instagram’s official process. Follow the official Instagram Help Centre guidance for hacked accounts alongside these steps, and be wary of any website that copies Instagram’s branding but asks for payment:

1. Open the hacked account page. In a browser, go to instagram.com/hacked and select the option that says your account was hacked. This page is designed for people who can no longer log in normally.
2. Enter your account details. Provide the username, email address, or phone number linked to the account. Try every version you have ever used, including an older email address, because recovery options differ for each one.
3. Check every inbox and spam folder. Look for emails from Instagram about email changes or logins. If you find one saying your email address was changed, open it promptly and use the option to secure or revert the change, as these links can expire.
4. Follow the secure account flow. Instagram may let you request a login link or security code sent to an address or number you still control. Enter codes only into the official app or website, never to someone messaging you.
5. Complete identity verification. If asked, record the video selfie exactly as instructed, turning your head as shown, in good light. For accounts with photos of you, this helps Instagram match your face to your account. Business accounts may instead be asked for business details.
6. Wait for Instagram’s response and follow it exactly. Verification can take from a few hours to several days. Check the email you provided regularly, including spam, and do not submit dozens of duplicate requests, which can slow things down.
7. Regain access and change everything. As soon as you are back in, set a brand-new password you have never used anywhere else, confirm your email and phone number are correct, and remove any contact details the attacker added.
8. Review and clean the account. Check your posts, stories, bio link, and sent messages. Delete scam content, warn your followers with a post or story that you were hacked, and check which third-party apps have access, removing anything unfamiliar.

If You Can Still Log In but Something Looks Wrong

Partial access is your best opportunity. Go to the Accounts Centre and review the personal details, logged-in devices, and recent login activity. Log out of all other sessions, change your password from a trusted device, and enable two-factor authentication using an authenticator app rather than text messages where possible. Check your bio and profile photo as well, because attackers sometimes change the bio link to a scam site while leaving the rest of the account untouched.

Also check whether the attacker added their own email address and then requested changes you approved by mistake. Any message asking you to confirm a change you did not make should be treated as hostile. Do not approve it, and do not share any code Instagram sends you with anyone, including someone claiming to be Instagram support in your direct messages. Instagram will not ask for your password or codes through a DM.

What to Do If Recovery Is Not Working

If the standard flow fails, try again from the device and location you used most often to log in, because Instagram’s systems weigh familiar devices heavily. Try each linked email address and phone number in turn, and try both the app and a browser. If a friend can still view your profile, ask them to note the exact current username, since attackers sometimes change it to make the account harder to find.

Report the account as compromised through the Help Centre options as well, and if the account is impersonating or scamming others, friends and followers can report the profile from their own accounts, which helps Instagram prioritise the case. Keep records of everything: screenshots, dates, and any emails. Above all, ignore social media adverts and strangers offering guaranteed recovery for a fee. These are almost always a second scam aimed at people already in distress, and paying them usually leads to losing money as well as the account.

Secure Your Account After You Get It Back

Recovery is only half the job. Most repeat hacks succeed because the original weakness was never fixed. Turn on two-factor authentication, use a password of at least fourteen characters stored in a password manager, and make sure your email account itself is protected with its own strong password and two-factor sign-in, because whoever controls your email can reset almost everything else. Review login activity monthly, remove unused third-party apps, and be sceptical of urgent messages about copyright strikes, verification badges, or prizes, which are the most common lures used to steal Instagram logins.

Common Mistakes to Avoid

• Paying a recovery service or a stranger who contacts you. Legitimate recovery happens only through Instagram’s official process and costs nothing.
• Sharing verification codes or your password. Anyone asking for a code sent to you is trying to take over the account, not help you.
• Using the same password again. If the old password leaked anywhere, reusing it lets the attacker walk straight back in.
• Posting that you are hacked without cleaning the account first. Remove scam posts, links, and messages so followers are not still being targeted from your profile.
• Forgetting your email account. Leaving the linked email unprotected means the whole recovery can be undone in minutes.

Conclusion

A hacked Instagram account is stressful, but the official recovery route at instagram.com/hacked gives most genuine owners a real path back. Act quickly, verify your identity patiently, use only official channels, and warn your followers once you regain control so they know to ignore anything sent while the attacker was in charge.

Then treat recovery as a fresh start. A unique password, two-factor authentication, and a secured email account make a second takeover far less likely, and those ten minutes of hardening protect every other account you own as well.

Frequently Asked Questions

How long does Instagram recovery usually take?

Times vary widely. Some video selfie verifications are answered within a day, while difficult cases take a week or more. There is no way to pay for faster treatment, and anyone promising instant recovery should not be trusted.

Can I recover my account if the hacker changed the email and phone number?

Often, yes. The instagram.com/hacked flow and video selfie verification are designed for exactly this case. Check your original inbox for the email-change notification too, because its secure-account link can reverse the change.

Will Instagram ever contact me by direct message?

No. Official messages about your account come by email from Instagram addresses or appear inside the app’s settings under emails from Instagram. Treat any DM claiming to be support as a scam.

What if the hacker is messaging my followers?

Warn people through any channel you still control, such as another social account or group chat, and ask followers to report the hacked profile. Once you recover access, post a clear story explaining that earlier messages were not from you.

Can a deleted account be recovered after a hack?

If the attacker deleted the account, you generally have a limited window, often around thirty days, to log in and reactivate it. Start the hacked-account process immediately, because after that window the account and its content may be permanently gone.