Hacked Instagram account: what to do in the first 30 minutes

The email arrives with the subject "Your Instagram password was changed". You didn't change it. When you try to log in, the app says the password is wrong. Or the opposite: you can still get in, but there are stories you never posted and messages sent to followers asking for money or "vote for my nephew". Either way the clock is ticking, because the longer an intruder holds the account, the harder the damage is to undo.

This guide is an incident-response checklist for a personal account: what to check first, what to do if you still have access, what to do if you lost it, and how to close the doors afterwards. The exact screens change from time to time, so use the Instagram Help Center as the final reference for menus.

How do you know Instagram was really hacked?

What are the signs your account was hacked?

The most common signs are security emails you didn't expect, a password, email or phone number changed without your action, and activity that isn't yours: posts, messages, follows or unfollows. Any one of them is enough reason to act as if it were a break-in.

• Change-notification email saying your email, phone or password was changed.
• Login codes arriving by SMS or email when you didn't try to log in.
• Sent messages you didn't write, usually with a link or a request for money.
• Unknown devices in the login activity list.
• Username, photo or bio changed, common when the account is about to be resold or used in a scam.

Beware of the fake email: scammers also send "your account was hacked" notices to steal your real password. Before clicking, check the sender and, when in doubt, open the app directly instead of using the link. The mechanism is the same one described in how to spot a phishing email.

Step by step if you can still log in

This is the best-case scenario, and the order matters:

1. Change the password now, to one you've never used on another site. If the old one was reused, change it on your other accounts too, because the intruder may try it there (the attack described in credential stuffing).
2. End open sessions: in the security settings, see where the account is logged in and sign out of everything you don't recognize.
3. Check the registered email and phone. If either isn't yours, remove it and add your own. That's where the intruder would try to recover the account later.
4. Turn on two-step authentication, preferably through an authenticator app rather than SMS. The walkthrough is in how to set up TOTP 2FA on Gmail, Instagram and WhatsApp.
5. Review connected apps and remove any you didn't install on purpose.
6. Warn your followers through another account or channel: if anyone received a strange link in your name, they shouldn't click it.

What if you lost access?

How do you recover a hacked Instagram account?

Use Instagram's own recovery options on the login screen, start from the alert email if it offers a way to undo the change, and follow the identity verification if the intruder swapped your details. There is no shortcut through third parties.

In practice:

1. Look for the security email. If the address was changed, the message Instagram sent to your old email may include an option to revert the change. Check the spam folder too. If you still control your email, protect the email first: change its password and turn on 2FA, because whoever controls the email controls every password reset.
2. Ask for login help on the home screen ("Forgot password?") using your username, email or phone, and request the recovery code.
3. If the intruder changed both email and phone, choose the option saying you need more help. Instagram may ask for account details and, in some cases, an identity check by video selfie. Response times vary and there is no confirmed official deadline, so be suspicious of anyone who promises a date.
4. Keep evidence: screenshots of the change emails, of the messages sent in your name and of the profile as it stands. They help with the request and with a police report, if there was a Pix scam.

An important warning: "account recoverers" show up in comments and DMs, charging a fee or asking for the code that arrived on your phone. That is a scam aimed at people who were already victims. A verification code is never handed to anyone, and official recovery is free.

How the intruder usually gets in

Knowing the entry point helps you close the right door. For personal accounts, the paths are few:

• Reused password. A password leaked from another service is tested automatically on Instagram. Check your email in how to tell if your email was leaked.
• Phishing: a fake copyright-violation notice, "verified badge" offer or "you won a prize", leading to a page that imitates the login.
• A request for the code by message. A "friend" whose account was already hijacked asks for the code you received "by mistake". It's the same script as cloned WhatsApp.
• Approval fatigue. With push-notification 2FA, the intruder fires requests until you approve one. Details in MFA fatigue.
• SIM theft, when 2FA is by SMS, described in SIM swap.

How to lock the account down afterwards

Getting the account back fixes today's problem. What prevents the next one is a lean setup:

• A unique, long password, kept in a password manager. If you don't use one yet, see how to use Bitwarden.
• 2FA through an authenticator app instead of SMS, and keep the backup codes away from your phone.
• Protect the Instagram email just as seriously: its own password and 2FA on.
• Distrust any link that asks for your Instagram login outside the app or the official site.
• Review the device list now and then. Two minutes a month catches a strange session early.

The bigger lesson

Almost every personal social-media break-in starts somewhere outside Instagram: a reused password, an unprotected email, a code handed to someone with a good story. The account is just the last link. Protecting the email, using a unique password and app-based 2FA takes less than half an hour and closes most of the paths.

If you want to go beyond the password, read about passkeys and passwordless authentication, which remove exactly what the scammer steals. And if this checklist helped, the share buttons at the bottom of the page will send it to someone who still has no 2FA.