Locked out of your own Instagram while a stranger posts and messages as you? Instagram's official recovery routes can get you back — if you use the right one, in the right order, before the thief finishes locking the doors behind them.

If your Instagram account was hacked, how to recover it depends on one thing: how much of it you still control. An email address the thief has not touched, a phone number that still receives codes, a Facebook account still linked to it, a phone where you are somehow still logged in — each of those is a door, and this guide walks you through them in order, from the fastest to the last resort. Move quickly but carefully: the first hour matters, because a thief who is given time will change every recovery detail, and the US Federal Trade Commission's advice for hacked accounts starts with exactly this situation — use the provider's own recovery process, then lock the account down hard once you are back inside.

One preparation before any route: secure your email account first. Your inbox is the master key to your digital life — password resets for Instagram and almost everything else land there. If the thief may have your email password too (especially if you reused it), change that password and turn on its two-factor protection before touching Instagram. Otherwise the thief can simply watch your recovery emails arrive and take the account back the same day.

Signs your Instagram account was hacked — and what the scammer does with it

Sometimes the takeover is obvious: your password no longer works even though you are sure it is correct. Just as often it starts quietly. Treat any of these as an emergency:

• Instagram emails you about a change you did not make — your email address, phone number or password was changed.
• You are logged out everywhere, and "forgot password" codes never reach you, because they now go to the thief.
• Posts, Stories or DMs appear that you never sent, or you are suddenly following strangers.
• Your username, bio or profile photo changed — thieves often rewrite the bio with a link and rename the account to erase it from your followers' searches.
• A login alert names a device or city you do not recognise.

What happens next follows a script. A stolen account is usually turned into a shop window for fraud within hours: Stories claiming "I just made 80,000 taka trading with this mentor, message them now," fake investment and crypto posts with screenshots of other people's "profits," and DMs to your followers — people who trust you — asking for money, cards or codes, or sending links that steal their accounts the same way yours was taken. Some thieves instead message the owner and demand payment to hand the account back. And if the account spams hard enough, Instagram may disable it for policy violations, which adds an appeal on top of the recovery. Every hour of delay is an hour your name spends scamming your own followers — which is why the routes below are ordered by speed.

Route 1: Recover a hacked Instagram account at instagram.com/hacked

If you still control the email address or phone number on the account, this is the fastest road back — often a matter of minutes.

1. Go to instagram.com/hacked in your browser (type the address yourself rather than tapping a link someone sent you) and choose the option that says your account was hacked. In the app, the same journey starts from Forgot password? (iPhone) or Get help logging in (Android) on the login screen.
2. Enter the details as they were before the hack — your username, and the original email address or phone number. Instagram can send a login link or a security code to the contact details it has for the account.
3. Open the link or enter the code, then immediately set a new, strong password you have never used anywhere else.
4. If no code arrives, check your spam folder, confirm you entered the original email or number, and wait a few minutes before requesting another — firing off request after request can trigger delays.
5. If the link route fails because the thief changed your contact details, look for Need more help? under the login-link button, or the option saying you can't access this email or phone number. That is the doorway to Route 3.

Two things improve your odds throughout: do this from a phone or computer you have logged in from before, on your usual network — Instagram treats a familiar device and location as a sign you are the owner — and use your original details everywhere, even if the thief has already replaced them on the account.

Route 2: Undo it from Instagram's own email — the "secure my account" link

When someone changes the email address on an Instagram account, Instagram writes to the old address to say so. That message — it comes from security@mail.instagram.com — is the single most valuable email you will ever receive from the platform, because it can contain a link to revert this change, sometimes phrased as secure my account. Selecting it undoes the email swap and starts the process of securing the account again.

Do this before everything else if the email is sitting in your inbox:

1. Search your inbox and spam folder now for a message from security@mail.instagram.com about an email change.
2. Check the sender carefully before tapping anything. Real notices come from that address; phishing copies are common, because thieves know victims go hunting for this exact email. If in doubt, do not tap the link — go to instagram.com/hacked yourself and start Route 1 manually.
3. Act immediately. The reversal works best while the change is fresh; the longer the thief's new address sits on the account, the more they can change behind it — including the password, which the email reversal alone may not fix. If the password was also changed, undo the email change first, then run Route 1 to reset the password.

This route is why speed in the first hour matters so much: it is the only one that can put you back in control in a single tap.

Route 3: Video selfie verification — when the thief changed everything

If the email and phone number are gone, Instagram's remaining question is: can you prove you are the person in this account? That proof is the support request and, for most personal accounts, a video selfie.

1. From the login screen, tap Get help logging in (or Forgot password?), enter your username, and choose Need more help? / the option that says you can't access the email or phone number.
2. Instagram will ask for a secure email address that only you can access. This matters: every next step arrives there, so use an inbox the thief cannot read — see the warning about your email at the top of this guide.
3. Submit the request and watch that inbox for Instagram's reply with the next steps.

What happens next depends on the account. If your account contains photos of you, Instagram may ask you to record a video selfie: a short video of you turning your head in different directions, following the on-screen prompts. Instagram says the video is used only to check that you are a real person and confirm your identity, is never visible on your profile, and is deleted within 30 days. If your account has no photos of you, there is no face to compare against, so Instagram instead asks for the details you signed up with — the email address or phone number used at registration, and the type of device you used at the time (iPhone, Android, and so on).

If your video selfie keeps getting rejected, work through this checklist before trying again: record in bright, even light with your face fully visible; remove sunglasses, caps and anything covering your face; hold the phone steady and turn your head slowly exactly as prompted; use the phone you normally use for Instagram; and then wait. Submitting the same request again and again in one afternoon does not move you up the queue — it can create duplicate cases that slow everything down. Submit your best attempt once, keep the confirmation, and check the secure email you gave for Instagram's answer.

Route 4: Get in through Accounts Center or your linked Facebook

Many Instagram accounts are linked to a Facebook profile in Meta's Accounts Center — and a link the thief forgot to cut can be your way back.

• On the Instagram login screen, try Log in with Facebook. If the accounts are still linked and your Facebook login is intact, this can take you straight back into Instagram without the changed password. The moment you land inside, change the Instagram password (Route "after you get it back" below) — do not stop at being logged in.
• If you are still logged in anywhere — an old phone, a tablet, a browser tab at home — treat that session as gold. Do not log out. Use it to change the password, correct the email and phone number, and sign out the thief's sessions.
• Secure the Facebook side too: if the thief reached Instagram through your Facebook, the Facebook account needs the same treatment — new password, two-factor on, unknown sessions removed — or they will simply walk back in through the same link.

If your account is scamming your followers right now

Recovery can take days; the damage to your followers is happening tonight. While the routes above run, do this in parallel:

• Warn people from channels you still control. Post on your Facebook profile, a second Instagram account if you have one, and WhatsApp or Messenger groups: "My Instagram account @yourname was hacked. Ignore any message, link or money request from it — it is not me. Do not send money or codes." Message close friends and family directly as well; a voice note carries more trust than text.
• Ask friends to report the profile. From the hacked profile, a friend taps the three dots → Report and follows the options for an account that is hacked or pretending to be someone else. Reports from several followers tell Instagram the account is actively harming people.
• Screenshot the evidence before it vanishes. The scam Stories, the DMs your followers received, the changed bio and username, any ransom demand — save screenshots with times visible. Followers' screenshots count too. You may need them for Instagram, for the police if money was taken, and to show followers afterwards what was and was not you.
• Do not negotiate with the thief, and do not pay a ransom. Payment almost never returns an account; it marks you as someone who pays.

Warning: the "recovery agent" scam — the second wave

Within hours of a public hack, a second set of criminals arrives wearing a rescuer's costume: Facebook pages and Telegram sellers advertising "Instagram account recovery service — 100% guaranteed," commenters under your friends' posts recommending a "brilliant hacker" who helped them, DMs offering to "talk to my contact inside Meta." In Bangladesh they typically ask for a few thousand taka up front by bKash or Nagad — and then for your password or a login code "to complete the process," which hands them whatever you have left.

Be blunt with yourself: Instagram does not charge to recover an account, nobody outside Meta can restore one, and no legitimate helper will ever ask for your password or a verification code. The only real doors are instagram.com/hacked, the app's own help options, and the support flow in Route 3. If you already paid an "agent" or shared a code with one, assume the code was used: change the passwords on your email and any account sharing it, and start the official route from the beginning.

After you get it back: lock the account down properly

Getting in is only half the job — the FTC's checklist for recovered accounts is about making the second takeover impossible. Work through it in one sitting:

1. Change the password to a long, unique one used nowhere else (Settings → Accounts Center → Password and security). If you reused the old password on other accounts, change those too.
2. Turn on two-factor authentication with an authenticator app rather than SMS (Accounts Center → Password and security → Two-factor authentication). App codes cannot be intercepted by a SIM swap the way text messages can. Save the backup codes somewhere safe.
3. Review where you are logged in (Accounts Center → Password and security → Where you're logged in) and log out every device and location you do not recognise.
4. Check Accounts Center for strangers' details — open Personal details and confirm the email addresses, phone numbers and linked accounts are all yours. A thief who added their own email keeps a key even after your password change.
5. Revoke third-party apps you do not recognise or no longer use (Settings → Website permissions → Apps and websites). Follower-tracker and "who viewed my profile" apps are a classic way in.
6. Clean up the mess: delete the scammer's posts, Stories and DMs, restore your username, bio and profile photo, and post a short note telling followers the account is yours again and which messages were fake.
7. Confirm which Instagram emails were real: in Password and security, Instagram lets you view recent official emails — useful for spotting the phishing copies still circulating in your inbox.

Creator and business accounts: a few extra complications

If the hacked account is a creator or business account linked to a Facebook Page, recovery has an extra layer. Check the Page as well: a thief who reached the business assets may have added themselves in the Page's access settings or the linked business portfolio, and an attached ad account is a direct route to your money, so review its admins and payment methods the same day. Losing Page admin access is a separate problem from losing the Instagram login, with its own Meta business recovery flow — do not assume fixing one fixes the other. And if you pay for Meta Verified on any of your accounts, its enhanced support channel is one more official door available to you, though availability varies by country.

How long does Instagram account recovery really take?

Honestly: it depends on which door you get to use. A login link in Route 1 can have you back inside within minutes. The email reversal in Route 2 is one tap — if you catch it early. Video selfie and support-request cases are measured in days: commonly a few days for Instagram to review and reply, and stretching to weeks in busy periods or when details do not match cleanly. Two habits genuinely affect the timeline: using your original details and a familiar device, and submitting one clean request instead of a pile of duplicates. Anyone — an "agent," a website, a video — who promises your account back within the hour for a fee is lying to you. Patience with the official process is not a flaw in the system; it is the system.

FAQ

Can I recover my Instagram account if the hacker changed the email and phone number?

Yes, often. Go to instagram.com/hacked, choose the hacked-account option, and take the path for people who can't access their email or phone number. Instagram will ask you to verify your identity — usually with a video selfie if your account has photos of you, or with your original sign-up details if it does not.

How long does it take to recover a hacked Instagram account?

From minutes, when a login link or the email-reversal link still works, to several days or more for video selfie and support-request cases. Busy periods and mismatched details make it slower; duplicate requests make it slower still.

My video selfie was rejected. What should I do differently?

Record in bright light with nothing covering your face, follow the head-turn prompts slowly, and use the phone you normally use for Instagram. Then submit once and wait for the reply at the secure email you provided, rather than sending repeated attempts.

My account has no photos of my face. Can I still get it back?

Yes. Accounts without photos of the owner are verified a different way: Instagram asks for the email address or phone number you signed up with and the type of device you used when you created the account. Answer with the original details, even if the thief has since changed them on the profile.

Someone on Facebook or Telegram says they can recover my account for a fee. Should I pay?

No. It is a scam aimed at people who have just been hacked. Instagram never charges for recovery, cannot be reached through these sellers, and no real helper needs your password or a login code. Use only instagram.com/hacked and the in-app help options.

Will I lose my posts and followers if my account is recovered?

Your followers and the content still on the account normally survive recovery — the danger is the thief deleting posts or the account being disabled for the scammer's spam while you are locked out, which is another reason to start within the first hour and warn your followers the same day.

Sources

• US Federal Trade Commission — How To Recover Your Hacked Email or Social Media Account: https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account
• Instagram Account Hacked? How to Recover It Fast (HideMyAcc guide, cross-checked against Instagram Help Center steps): https://hidemyacc.com/instagram-account-hacked
• How to Recover a Hacked Instagram Account (JO-TECH Cyber, 2026 Guide): https://jotechcyber.co.ke/blog/recover-a-hacked-instagram-account/
• Instagram Account Hacked? How to Recover & Secure Your Account (CitizenNest): https://www.citizennest.com/guide/instagram-account-hacked-recover

Related reading: WhatsApp Account Hacked? How to Recover It Step by Step · AI Phishing in 2026: How to Spot a Fake Email, Message or Voice Call