How to Get Your Instagram Account Back After Being Hacked (2026 Guide)

Figuring out how to get your Instagram account back after being hacked is stressful, time-sensitive, and confusing -- especially when the hacker has already changed your email, phone number, and password. Instagram account theft has surged in recent years, with phishing links in DMs and fake "copyright violation" emails being the most common attack vectors. The good news is that Instagram has built dedicated recovery tools, and the vast majority of hacked accounts can be recovered if you act quickly and follow the right steps.

This guide covers every working recovery method as of 2026, from automated login links to identity verification selfies, so you can regain access regardless of how much the hacker has changed.

How to Tell If Your Instagram Account Has Been Hacked

Before jumping into recovery, confirm that your account was actually compromised rather than experiencing a temporary glitch. Here are the definitive signs:

• You received an email from [email protected] saying your email address was changed, and you did not initiate it.
• You cannot log in with your usual password, and password reset emails are not arriving at your inbox.
• Your profile has been altered. Your bio, profile photo, name, or username has been changed to something you do not recognize.
• Posts or messages were sent that you did not create. Hackers often use stolen accounts to send phishing DMs to your followers or promote cryptocurrency scams.
• You were logged out suddenly and cannot get back in.
• Your linked email and phone number were both changed, which means the hacker has locked you out of every normal recovery method.

If any of these apply, skip ahead to the recovery method that matches your situation. Speed matters -- the longer a hacker controls your account, the harder recovery becomes.

Step 1: Check Your Email for the Instagram Security Alert

Instagram sends an automated email whenever account details are changed. This email is your fastest recovery path.

1. Search your inbox (including spam and trash folders) for emails from [email protected]. Look for subject lines like "Your email address was changed" or "Your phone number was changed."
2. Click "Revert this change" or "Secure your account here" in the email. This link is time-sensitive -- it works best within 24 to 48 hours of the change.
3. Follow the prompts to reset your password and restore your original email address.

This is the simplest recovery method and works immediately if the hacker has not yet taken additional steps to block it. If you received the email but the revert link says it has expired, move to the next method.

Important: Only trust emails from [email protected]. Phishing emails mimicking Instagram security alerts are extremely common and are often how accounts get hacked in the first place. Check the sender address carefully -- legitimate Instagram emails never come from domains like instagram-security.com or meta-support.org.

Step 2: Use Instagram's Login Link Recovery

If reverting via email did not work, Instagram's built-in login link system is the next step.

On iPhone or Android:

1. Open the Instagram app and tap "Get help logging in" (Android) or "Forgot password?" (iPhone) on the login screen.
2. Enter the username, email address, or phone number originally linked to your account.
3. Tap "Send login link."
4. Check your email or phone for a link or six-digit code from Instagram.
5. Follow the link or enter the code to access your account.

If the hacker changed your email and phone:

This is where most people get stuck. If the hacker replaced both your recovery email and phone number, the standard login link will be sent to their email or phone, not yours. In this case, you need Instagram's advanced recovery flow described in the next section.

Tip: If your Instagram account was connected to Facebook before the hack, try logging in through Facebook. Go to the Facebook app, navigate to Settings > Accounts Center, and check if your Instagram account is still linked. If it is, you may be able to reset access through that connection.

Step 3: Request a Support Request via Instagram's Hacked Account Flow

Instagram has a dedicated recovery path specifically designed for hacked accounts where the hacker has changed all contact information. This is the method that works when nothing else does.

1. Go to the Instagram login screen on your phone.
2. Tap "Forgot password?" and enter your username.
3. Tap "Need more help?" at the bottom of the screen. On some versions, this may say "Can't reset your password?" or "Try another way."
4. Select "My account was hacked" from the options presented.
5. Choose the option that best describes your situation (email changed, cannot access email, etc.).
6. Instagram will ask you to provide an email address you can access -- this does not need to be the one originally linked to your account. It is simply where Instagram will send follow-up instructions.
7. Complete the follow-up steps Instagram sends to that email.

What Instagram May Ask For:

Depending on your account history and verification status, Instagram may request one or more of the following:

• A selfie video. Instagram asks you to record a short video of yourself turning your head in different directions. This is compared against photos you have posted on your profile to confirm your identity. Accounts without selfie photos may not see this option.
• The original email or phone number you used when you first created the account.
• The type of device (iPhone, Android, iPad) you used to create the account.
• Your full name as it appeared on the account.

Step 4: Identity Verification via Selfie Video

The selfie video verification method was introduced by Instagram in 2023 and has become the primary way hacked accounts are recovered when all other options fail. Here is how to maximize your chances of success.

How the video selfie works:

1. Instagram presents a circular frame on your screen.
2. You are asked to turn your head slowly in multiple directions (left, right, up, down).
3. The system compares your face against photos and videos posted on your account.
4. A combination of AI and human reviewers makes the decision.

Tips for a successful selfie verification:

• Ensure good lighting. Natural daylight works best. Avoid harsh overhead lights or backlit situations.
• Match your current appearance to your profile photos as closely as possible. If you have drastically changed your hairstyle, glasses, or facial hair since your last post, consider adjusting to match.
• Remove filters. Instagram compares against your real face, not filtered versions.
• Hold your phone steady and follow the directional prompts slowly.
• If rejected, try again. You are allowed multiple attempts. Each attempt is reviewed independently.

What if your account has no photos of your face?

This is a known limitation. Accounts that exclusively post landscape photography, memes, art, or brand content may not qualify for selfie verification because there are no facial reference images. In this case, Instagram falls back to other verification methods, including asking for the original registration email and device details.

Step 5: Recovering a Business or Creator Account

Business and creator accounts have an additional recovery avenue through Meta Business Suite that personal accounts do not.

1. Go to business.facebook.com and log in with the Facebook account linked to your Instagram.
2. Navigate to Help > Contact Support.
3. Select your hacked Instagram account from the asset list.
4. Describe the compromise and request account recovery.

This route often provides live chat or callback options that are not available through the standard Instagram app. Meta prioritizes business accounts because they are often tied to active advertising spend.

If your Instagram business account was managed through a Facebook Page, the Page admin can sometimes initiate recovery even if the Instagram login credentials are fully compromised.

How Long Does Instagram Account Recovery Take?

Recovery timelines vary significantly based on the method used and the complexity of the situation.

Recovery Method	Typical Timeline
Email revert link	Instant to a few hours
Login link (email/phone)	Instant to 24 hours
Hacked account support flow	1 to 5 business days
Selfie video verification	1 to 3 business days
Meta Business Suite escalation	2 to 7 business days

If you have not heard back within 7 days, resubmit your request. Instagram processes millions of support requests, and cases occasionally get lost in the queue. Submitting again does not hurt your chances and often moves your case to a new reviewer.

What to Do Immediately After Recovering Your Account

Recovering access is only half the battle. If you do not secure your account properly, the same hacker -- or another one -- can get back in. Take these steps within the first hour of regaining access:

1. Change your password

Choose a strong, unique password that you do not use on any other platform. A minimum of 12 characters mixing uppercase letters, lowercase letters, numbers, and symbols is recommended. A password manager like 1Password or Bitwarden makes this easier.

2. Enable two-factor authentication (2FA)

This is the single most important step. Go to Settings > Accounts Center > Password and security > Two-factor authentication and enable it.

• Best option: Use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator). App-based 2FA is significantly more secure than SMS-based.
• Acceptable fallback: SMS-based 2FA is better than nothing but is vulnerable to SIM-swapping attacks.
• Save your backup codes. Instagram provides recovery codes when you set up 2FA. Store these somewhere safe and offline -- they are your emergency access method if you lose your phone.

3. Review and revoke third-party app access

Go to Settings > Website permissions > Apps and websites and remove any app you do not recognize. Hackers often install third-party apps to maintain access even after you change your password.

4. Check your login activity

Navigate to Settings > Accounts Center > Password and security > Where you're logged in. Review every active session. If you see devices or locations you do not recognize, tap them and select "Log out."

5. Verify your contact information

Confirm that your email address and phone number are correct and belong to you. Remove any contact information the hacker may have added.

6. Alert your followers

Post a Story or feed post letting your followers know your account was compromised. Ask them to ignore any suspicious DMs that were sent during the hack and not to click any links.

How to Prevent Your Instagram Account From Being Hacked

Prevention is far easier than recovery. Most Instagram hacks succeed because of a few common and completely avoidable mistakes.

• Never click links in DMs claiming you violated copyright, won a prize, or need to "verify your account." These are phishing attacks. Instagram never contacts users through DMs for account issues.
• Verify email senders carefully. The only legitimate Instagram security email domain is mail.instagram.com. Anything else is fake.
• Do not reuse passwords. If your email password is the same as your Instagram password and your email gets breached, both accounts fall.
• Enable two-factor authentication using an authenticator app, not SMS.
• Be cautious with third-party apps that request your Instagram login credentials. Legitimate apps use Instagram's official API and never ask for your password directly.
• Keep your email account secure. Your email is the master key to your Instagram account. If your email gets compromised, every account linked to it is at risk. Enable 2FA on your email as well.

If you are a creator or business building your presence on Instagram, maintaining account security is just as important as growing your audience. Services like SocialzAI help creators build their following without ever requiring password access -- all you need is your public username, and no login credentials are shared.

Frequently Asked Questions

Can I recover my Instagram account if the hacker changed my email and phone number?

Yes. Use Instagram's dedicated hacked account flow by tapping "Forgot password?" on the login screen, then selecting "Need more help?" and "My account was hacked." Instagram will ask you to provide an accessible email address and may request a selfie video for identity verification. This process works even when all original contact information has been replaced.

How long does it take to get a hacked Instagram account back?

It depends on the recovery method. If you can use the email revert link, recovery is nearly instant. The selfie video verification process typically takes 1 to 3 business days. If you go through Meta Business Suite support, expect 2 to 7 business days. If you have not received a response after 7 days, submit a new request.

Will I lose my followers or posts after recovering my hacked account?

In most cases, no. Instagram preserves your followers, posts, and account data during the recovery process. However, if the hacker deleted posts or removed followers while they had control, those changes may not be reversible. This is why acting quickly is critical -- the less time the hacker has with your account, the less damage they can do.

What should I do if Instagram's selfie verification is not working for me?

If your account does not have photos of your face (for example, it is a brand account or a meme page), the selfie verification may not be available or may fail. In this case, try recovering through the Meta Business Suite if you have a business account, or provide Instagram with your original registration email, the device you created the account on, and other identifying details. Submitting multiple recovery requests through different methods simultaneously can also help.

Does two-factor authentication guarantee my account will not be hacked?

Two-factor authentication dramatically reduces the risk but is not a guarantee. Sophisticated attacks like SIM swapping (for SMS-based 2FA) or social engineering can sometimes bypass it. Using an authenticator app instead of SMS, keeping your backup codes in a secure location, and staying vigilant about phishing links provides the strongest practical protection.

Can someone hack my Instagram just by knowing my username?

No. Knowing a username alone is not enough to hack an account. However, hackers can use your public username to send targeted phishing messages, attempt password guessing if you use a weak password, or try credential stuffing if your username and password were exposed in a data breach on another platform. A strong unique password combined with two-factor authentication blocks all of these attack vectors.