Hacked Instagram Account? Official Recovery Steps

Last reviewed: 6 October 2026

Read this first: what we can and can’t do

Independent guide. Viral In City is an independent social media agency. We are not affiliated with, endorsed by or connected to Instagram or Meta. We cannot log in to, unlock or recover any Instagram account, and we will never ask for your password, login codes or backup codes. Everything below uses Instagram’s own free tools and official Help Center pages, which are linked so you can check each step at the source.

If your Instagram account has been hacked, only Instagram can give it back to you. There is no agency, “ethical hacker” or insider who can restore access for a fee, and anyone who claims otherwise is very likely running a second scam on people who have just lost an account. Viral In City does not offer recovery services, and nothing in this guide implies that we, or anyone outside Instagram, can get an account back.

What we can do is explain the official process clearly. Everything here comes from Instagram’s Help Center, mainly its page on what to do if you think your profile has been hacked and its instagram.com/hacked recovery page. Instagram notes that some recovery steps may not be available for every type of account, but recommends trying them all.

Work quickly. The sooner you act, the more likely it is that the original email and phone number are still on the account and that the “secure my account” link in Instagram’s email still works.

Step 1: Secure your email first, then look for Instagram’s security email

Instagram’s security guidance makes a point that is easy to miss: anyone who can read your email can probably also access your Instagram. So before anything else, change the password of the email account linked to Instagram, turn on that provider’s two-step verification and sign out of sessions you don’t recognise.

Then search that inbox. When the email on an Instagram account is changed, Instagram says it sends two emails: one to the new address to allow the change and one to the original address to reverse it.

1. Find the message from security@mail.instagram.com sent to your original address.
2. Select secure my account (or the link to reverse the change) in that email.
3. Follow the on-screen steps to set a new password.

Check the sender carefully. Instagram says its emails come from @mail.instagram.com; anything else claiming to be Instagram may be phishing. If more than the email was changed and you can’t reverse it, move to Step 2.

Step 3: Request a security code or support at instagram.com/hacked

If the login link doesn’t work, Instagram says you may be able to request support on a mobile device. Start at instagram.com/hacked in your phone’s browser, or use the steps in the app:

1. From the login link screen, tap Can’t reset your password? below Send login link.
2. Select your email address or phone number, then tap Send security code.
3. If you don’t receive a code, tap I can’t access this email or phone number and follow the on-screen instructions.

When Instagram asks for a contact address, give a secure email that only you can access. Ideally that is an address the hacker has never seen and that has its own two-step verification. Instagram sends the next steps to that address, so check it, including spam, after you submit.

The exact screens vary by app version and account type, and on some accounts they change over time. If a button described here is missing, follow whatever on-screen recovery option Instagram shows you.

If you can still log in

Sometimes the hacker gets in but you haven’t been locked out yet. Instagram’s list of actions for this situation is short and worth doing in order, immediately:

1. Change your password or send yourself a password reset email.
2. Turn on two-factor authentication (see the prevention section below).
3. Confirm your email and phone number in account settings are yours and correct.
4. Check Accounts Center and remove any linked accounts you don’t recognise.
5. Revoke access for any suspicious third-party apps.
6. Log out unknown devices. Instagram’s page on recent login activity shows how: Accounts Center, then Password and security, then Where you’re logged in, then select the devices to log out.

Instagram also has separate guidance for professional accounts where you can still log in but a hacker keeps taking actions, linked from the same hacked account page. If unauthorised posts went out, delete them once you have secured the account.

Prevent it from happening again

Instagram calls two-factor authentication the single most effective step to protect an account from hackers. Set it up as soon as you are back in:

1. Go to Settings > Accounts Center > Password and security > Two-factor authentication and choose the account.
2. Pick a method. Instagram’s 2FA page recommends an authentication app such as Duo Mobile or Google Authenticator; text message and WhatsApp are also available.
3. Save your backup codes offline (printed, or in a password manager). You can only see them while logged in.
4. Don’t tap Trust this device on public or shared devices.

Then close the other doors attackers use:

• Use a long, unique password and a password manager; Instagram’s guidance advises against reusing passwords or using personal details.
• Learn the phishing signs Instagram lists on its phishing page: messages that threaten to ban or delete your account, offer gifts or demand money. Don’t click their links.
• Never type your password into a page reached from a DM, comment or “copyright violation” message. Open the app yourself instead.
• Don’t give your login to third-party apps you don’t trust. Instagram warns they can gain complete access.
• Keep your email and phone number on the account current, and secure your email with its own two-step verification.
• Review where you’re logged in every few months.

Businesses should also stop sharing one password between staff and agencies. Our guide on giving social media access safely explains how to grant access without handing over the login, and our social media audit checklist includes an access and security review.

Once your account is secure and you are posting again, we can help with the content side. Our Instagram management plan includes 15 Reels and 15 posts a month, captions, hashtags and reporting, and we always work through proper access, never your password. We do not offer hacked account recovery. Start with a free social media audit or ask for a custom quote. If you prefer chat, message us on WhatsApp at +91 8827409728. Our free caption generator and bio generator can help you rebuild the profile.