Instagram Hacked? What to Do in the First Hour

If your Instagram has been hacked, start with the email address that is attached to it, then use Instagram's own recovery routes, then lock the account down and tell your friends. Do not pay anyone who offers to "get it back", and do not answer a direct message that says your account is at risk. This page puts the order of steps first, then explains how to tell, how to stop it happening again and where the official instructions are.

Who this is for: anyone who has lost control of an Instagram account, or suspects they have, and wants plain steps. The menu names in the app change from time to time; where that matters we say so and link the official help page so you can check the current wording.

Do this now: the first hour

1. Look at your email first. Instagram's help article says to check your email for a message from security@mail.instagram.com. If your email address was changed, that message may let you undo the change by selecting "secure my account". Open the message from your email app, not from a link in a text or a direct message.
2. Secure the email account itself. Whoever controls your email can reset almost everything else. Change that password, turn on two-factor authentication there and check for forwarding rules you did not create. The FTC lists forwarding rules and sent or deleted folders as places to look after an account has been taken.
3. If you can still log in, lock it down. Instagram's guidance for this case: change your password or send yourself a password reset email, turn on two-factor authentication, confirm the phone number and email address in your account settings, check Accounts Center and remove any linked accounts you do not recognise, and revoke access for suspicious third-party apps.
4. Sign out everywhere. The FTC advises signing out of all devices after you regain control. Instagram also lets you review recent logins in the app (Settings, then Security, then Login Activity): if you do not recognise one, log that device out and tell Instagram it was not you. The exact path can change, so check the official help article if the menu looks different.
5. If you cannot log in, ask for a login link. On the login screen choose "Forgot password?", enter your username, email or phone number, complete the captcha and follow the link sent by email or text. This is the route Instagram describes before anything else.
6. If the link does not work, request support from a mobile device. Instagram says to use a secure email address that only you can access. If you no longer have your username, email or phone number, go to instagram.com/hacked and follow the on-screen instructions. The FTC's own recovery page also points to that address.
7. Be ready for the video selfie. For accounts with photos, Instagram may ask for a video selfie of you turning your head in different directions. Instagram says the video "will never be visible on Instagram and will be deleted within 30 days", and that you can submit a new one if it cannot confirm your identity. Accounts without photos get a different check that asks for the email address or phone number you signed up with and the kind of device you used.
8. Tell your friends. The FTC advises sending a quick message or posting about it, telling people not to click links from you and to ignore pleas for help or money. A taken-over account is often used on the people who trust it.
9. Scan your own device. The FTC recommends updating your security software and running a scan, deleting anything suspicious and restarting, before you sign in again. If a password stealer was on your phone or computer, a new password typed there goes straight back to the attacker.
10. Change the same password anywhere else you used it. Start with email, then banking, then shopping and other social accounts. A reused password turns one takeover into several.

Keep a note of what you did and when, with screenshots of any messages from Instagram. If you have to ask for support more than once, the record saves time.

How to tell your Instagram was hacked

The FTC lists the common signs of a hacked account:

• You cannot log in.
• You get a notification about a username or password change that you did not make.
• You get a login notification from a device you do not recognise or a location you are not in.
• Friends or family report messages you did not send, sometimes with random links or pleas for help or money.

Other things worth checking once you are back in: posts, stories or messages you do not remember, accounts you now follow that you did not choose, and any linked accounts or third-party apps you did not connect. Instagram's help page says to remove linked accounts you do not recognise in Accounts Center and to revoke access for suspicious apps.

How the account usually gets taken. We have no figures for Instagram specifically, so we will not give any. The route Instagram itself warns about is the scam message: its safety post describes accounts sending direct messages to try to get sensitive information such as passwords, claiming your account is at risk or that your photos are being shared elsewhere. Reusing a password that leaked from another service, and typing a password into a fake login page, are the other ordinary routes, and both are covered by the prevention list below.

A real warning looks different. Instagram says it will never send you a DM. It says official messages about your account appear in the "Emails from Instagram" tab in your settings, which it describes as the only place in the app with direct and authentic communication from Instagram. If a message says your account will be deleted unless you click, report it and block the sender.

What not to do

• Do not reply to anyone who says they can recover the account for a fee. Use the routes in this page.
• Do not enter your password on a page you reached from a message. Open the app, or type the address yourself.
• Do not send a code that arrives by text or email to anyone, even a friend whose account might have been taken. A one-time code is the key to your account.
• Do not keep guessing passwords on the login screen. Use "Forgot password?" instead.

Prevent it next time: a checklist

• Turn on two-factor authentication. Instagram says it strongly recommends it, and lists a phone number or an authenticator app as options. With it on, you get alerts about login attempts from unrecognised devices or browsers and can approve or deny them. An authenticator app is generally a stronger choice than text messages because a text can be redirected if someone takes over your phone number.
• Give Instagram its own password that you use nowhere else. A password manager remembers it for you, and our password generator can make one.
• Protect the email account behind it with the same care: its own password and two-factor authentication.
• Consider a passkey where the app offers one. A passkey cannot be typed into a fake page. Try the idea in the Passkey Lab and read passkeys vs security keys.
• Keep your recovery details current. The phone number and email on the account should be ones you still own. If you lose access to both, recovery is much harder.
• Review login activity and connected apps every few months, and remove what you do not use.
• Treat every "your account is at risk" message as a scam until you have checked the Emails from Instagram tab yourself.
• Practise once. Working through the steps in order is much easier when you have done it before. The Instagram Hacked Recovery Lab walks a fictional person through the first hour. For the wider picture, see the identity compromise response checklist.

If it is a business or creator account

Instagram's help article points professional accounts that are still being used by someone else to separate guidance. Add one more step: tell anyone who has access to the account, such as an agency or a partner, and change the password they use. If customers might have received scam messages, say so on your other channels. If the attacker also took your personal information, not just the account, the FTC says to report it at IdentityTheft.gov for a personal recovery plan.

FAQ

What do I do first if my Instagram is hacked?

If you can still log in, change your password, turn on two-factor authentication, confirm the phone number and email on the account, check Accounts Center for linked accounts you do not recognise and revoke suspicious third-party apps (Instagram Help Center). If you cannot log in, check your email for a message from security@mail.instagram.com and use it to undo an email change, or request a login link from the login screen.

How do I recover a hacked Instagram account if the hacker changed my email and password?

Instagram says to look for its security email first. If you cannot undo the change that way, request a login link or security code, then request support from a mobile device, using a secure email address only you can access. If you no longer have your username, email or phone number, go to instagram.com/hacked and follow the on-screen instructions.

What is the Instagram video selfie?

For accounts with photos of you, Instagram may ask for a video selfie in which you turn your head in different directions. Instagram says the video will never be visible on Instagram and will be deleted within 30 days. If it cannot confirm your identity you can submit a new video.

How can I tell if my Instagram was hacked?

The FTC lists common signs: you cannot log in, you get a notice of a username or password change you did not make, you get a login alert from a device or place you do not recognise, or friends say they received messages you did not send. You can also review recent logins in the app under Settings, Security, Login Activity (the exact path can change).

Does Instagram ever message me to say my account is at risk?

Instagram says it will never send you a DM. It says genuine messages about your account appear in the Emails from Instagram tab in your settings, and that messages claiming your account is at risk or that your photos are being shared are common scams to report and block.

Should I tell my friends my Instagram was hacked?

Yes. The FTC advises sending a quick message or posting about it, telling people not to click links from you and to ignore pleas for help or money.

Sources

• Instagram Help Center: If you think your Instagram profile has been hacked (recovery routes, video selfie, secure my account, Accounts Center).
• Instagram: Keeping Instagram Safe and Secure (DMs from Instagram, Emails from Instagram tab, two-factor authentication, Login Activity).
• FTC: How To Recover Your Hacked Email or Social Media Account (signs, securing the account, telling contacts).
• FTC consumer alert: Email or social media hacked? Here's what to do.

Independent guidance. PlayCISO is not affiliated with Instagram or Meta. Menu names and recovery screens change; the official pages above are the authority.