Realizing your Instagram account has been hacked is a stomach-dropping experience. One minute you are scrolling through your feed, and the next, you are locked out, watching a stranger post from your profile or delete your precious photos. Instagram hacks are increasingly common, with cybercriminals targeting accounts to scam followers, run phishing campaigns, or sell the username. If you find yourself locked out, do not panic. In this step-by-step guide, we will show you exactly how to recover a hacked Instagram account and secure it against future attacks.
Recognizing the Signs of a Hack
Before you can recover your account, you need to confirm it has been hacked. Common signs include:
- Your password no longer works, and you cannot reset it.
- Your profile picture, username, or bio has been changed.
- Strange direct messages are being sent from your account.
- Your email or phone number has been unlinked from the account.
- You receive a "Account Disabled" notice because the hacker violated community guidelines.
If you notice any of these signs, immediate action is required. The longer a hacker has access, the more likely they are to permanently delete your data or delete your entire account.
Step 1: Request a Login Link
The first and easiest method to regain control is to attempt a password reset via your email or phone number. Open the Instagram app, tap "Forgot Password?", and enter your username, email, or phone number. Instagram will send a login link. If the hacker has not yet changed your email or phone number, you can use this link to reset your password and lock them out. However, sophisticated hackers usually change the associated email and phone number immediately to block this method. If you do not receive the email or SMS, move to Step 2.
Step 2: Request a Security Code
If the login link fails, you must escalate the issue to Instagram's automated security review system.
- On the login screen, tap "Need more help?" below the login button.
- Select the option stating you cannot access your email or phone number.
- Instagram will ask for a new email address that you currently have access to. Enter a secure, new email address.
- Instagram will ask whether you have a photo of yourself on your account. It is crucial to answer this honestly. If you select "Yes," Instagram will require you to submit a video selfie holding a piece of paper with a hand-written code they provide to you.
This video selfie is reviewed by Instagram's automated systems (and sometimes human moderators) to compare your face to the photos posted on the account. If you have never posted a photo of your face, select "No," and you will be asked to provide the email address or phone number you originally used to sign up for the account, as well as the type of device you usually use (e.g., iPhone 13, Samsung Galaxy S22). This helps verify device identity.
Step 3: Reclaiming Your Account
After submitting the video selfie or device information, you must wait. This process can take anywhere from a few hours to several days. Instagram will send an email to the new email address you provided. If approved, you will receive instructions to reset your password and log back in. Once logged in, immediately go to Settings > Security > Login Activity and force-logout of all unrecognized devices. Then, navigate to Settings > Accounts Center > Password to set a strong, unique password. It is also vital to check your profile to see what damage the hacker did. Did they delete your videos? Did they send scam DMs? You can use the Recently Deleted folder to restore posts removed within the last 30 days.
Step 4: Recovering Deleted Data
Hackers often delete your content out of spite or to make the account look like their own before selling it. If your Reels, photos, and videos were wiped, you can recover them using the methods outlined in our Ultimate Guide to Recover Delete Instagram Data. For permanently deleted content, your best option is to download your Instagram data archive to pull the original files from the backend servers before they are purged. If the hacker deleted direct messages containing sensitive info, follow our guide to retrieve deleted Instagram direct messages immediately.
How Hackers Gain Access (And How to Prevent It)
Understanding how you were hacked is crucial to preventing it from happening again. Hackers rarely "brute force" a password anymore. They use social engineering.
- Phishing Links: You may have clicked a link promising free followers, a verified blue checkmark, or a brand collaboration. These fake login pages steal your credentials. Never trust unverified links.
- Third-Party Apps: If you logged into a shady app that promises to show you who viewed your profile or recover deleted messages, you gave them your API token. They can use this token to post and delete on your behalf. Revoke access to suspicious apps in your settings.
- Data Breaches: If you use the same password for Instagram as you do for other websites, a breach on another site can give hackers the keys to your IG. Always use unique passwords.
Be incredibly wary of third-party software. As we detail in our analysis of Instagram photo recovery apps, legitimate apps never ask for your password. Giving your password to an unverified tool is essentially handing your account to the hacker.
Securing Your Account Post-Recovery
Once you have regained access, you must fortify your defenses. Navigate to Settings > Accounts Center > Security and login. Turn on Two-Factor Authentication (2FA). Choose to use an Authenticator App (like Google Authenticator or Authy) rather than SMS, as SMS codes can be intercepted via SIM-swapping. With 2FA enabled, even if a hacker gets your password, they cannot log in without the rotating code on your phone. Furthermore, enable "Login Alerts" so you receive a notification every time someone logs into your account from an unrecognized device. This gives you the power to immediately force-logout a hacker the moment they strike. Finally, ensure your associated email account is also secured with 2FA, as email compromise is the easiest way for hackers to reset all your passwords.
Conclusion
Recovering a hacked Instagram account is a stressful but navigable process. By utilizing the "Need more help?" feature and submitting the required video selfie or device information, you can prove your identity to Meta and reclaim your digital life. The key is acting fast before the hacker can permanently delete your account or alter your data beyond recovery. Once restored, immediately implement Two-Factor Authentication and practice good digital hygiene to ensure your account, your backed-up data, and your followers remain safe forever.