Instagram Account Hacked? How to Try to Get It Back, Step by Step

Meta says that if you got an email from [email protected] telling you your email address was changed, you may be able to undo the change by selecting secure my account in that message.

1. Open your email and find the message from [email protected] about your email address being changed.
2. Select secure my account in that message and follow the steps.
3. If other details were changed too (such as your password) and you can’t change your email back, request a login link (Fix 2) or a security code (Fix 3).

Meta says that when the email on an Instagram account is changed, it sends two emails: one to the new address to allow the change, and one to the original address to deny it. If you didn’t make the change, deny it from the original email, which comes from [email protected] with a link to reverse the change. Meta says it won’t change your email address without your permission. Our advice: a message asking you to reply with your password or a code isn’t Instagram’s recovery email.

Meta says a login link sent to your email address or phone number helps it confirm that you own the account.

No access to the username, email or phone on the account? On a computer, Instagram links to a separate page for this from its hacked-account help page. On iPhone or Android, enter the login details you most recently used, then tap Can’t reset your password? below Continue and follow the steps. Instagram Lite works the same way as Android.

Meta says that if the login link doesn’t work, you may be able to request support on a mobile device.

Meta says to enter a secure email address that only you can access. After you submit the request, you should get an email from Instagram with next steps. Instagram Lite works the same way as Android.

Meta says how it checks your identity depends on whether the account has photos of you.

1. Account without photos of you: you should get an auto-response email from the Support Team at Meta asking for the email address or phone number you signed up with, and the type of device you used when you signed up (for example iPhone, Android, iPad or other).
2. Account with photos of you: you’ll be asked to take a video selfie turning your head in different directions, so Meta can check you’re a real person and confirm who you are.
3. After you submit the video selfie, you’ll get an email from Instagram at the secure email address you gave.
4. If Meta couldn’t confirm your identity from the video, you can submit a new one and it will be reviewed again.

Meta says the video selfie is never visible on Instagram and is deleted within 30 days.

If you think someone hacked or tried to hack your account but you can still log in, Meta lists steps to help keep it secure.

1. Change your password, or send yourself a password reset email. Meta says to pick a strong, unique password with at least six numbers, letters and special characters (such as !$@%), and to avoid repetition. Changing your password logs out every device signed in to your account. Meta also says to avoid personal details (your name, birthday, address, family names) and generic passwords, never reuse a password from another account, and suggests a password manager.
2. Turn on two-factor authentication. Meta calls it the single most effective step to protect your account from hackers. It’s on by default for creator accounts, so check you didn’t turn it off.
3. Secure your email account too. Meta says anyone who can read your email can probably also get into your Instagram. Change the passwords for your email accounts and make sure no two are the same.
4. Check that the phone number and email address in your account settings are yours.
5. In Accounts Center, remove any linked accounts you don’t recognize.
6. Remove access for any suspicious third-party apps. Meta says an app you give your login details to can get complete access to your account, and warns against apps that offer likes and followers in exchange for your login.

Meta also says to log out of Instagram on any computer or phone you share, and not to tick Remember me on a public computer. Our advice: do these straight away after you get back in, too. Meta has separate help for professional accounts where a hacker is still taking actions after you’ve logged in.