If someone has taken over your Instagram account, your first action determines everything that follows: check your email for a message from security@mail.instagram.com — it contains a "Secure my account" link valid for only 24 hours. If that window has passed or your contact information has been changed, official recovery paths exist through instagram.com/hacked. This guide walks you through every scenario in order — including when everything has been changed.
| Scenario | What you still control | Fastest path | Expected time |
|---|---|---|---|
| Only password changed | Your email + phone are intact | "Secure my account" link in your email | Immediate |
| Email changed only | Phone number is yours | Reset via phone number | 24–72 hours |
| Phone changed only | Email address is yours | Reset via email | 24–72 hours |
| Both email and phone changed | Original device or official ID | Support form + identity verification | 3–21 business days |
Key Takeaways:
- Act immediately — every hour gives the attacker more time to change your information and consolidate control.
- The "Secure my account" link in the security@mail.instagram.com email is valid for 24 hours only — your absolute first priority.
- instagram.com/hacked is the only legitimate recovery entry point — ignore every "account recovery service" outside it entirely.
- Notify your followers immediately via other platforms — the attacker will use your account to run scams targeting your audience.
- After recovery: secure your email first, then change your password, then enable two-factor authentication.
What should you do in the first minutes after discovering the hack?
Panic wastes precious time. Follow these steps in this exact order:
Step 1: Open your email immediately
Search for a message from security@mail.instagram.com mentioning a change to your account's email or password. Inside is a "Secure my account" link that lets you instantly reverse the change — but it expires after 24 hours. If you find and use it within that window, the problem ends here.
If you don't find the email:
Check your spam folder and trash. If the attacker also accessed your email, they may have deleted it — in that case proceed directly to Step 3 without wasting time searching further.
Step 2: Try "Forgot password" with every contact method you have
On the login screen, tap "Forgot password?" and try every piece of information linked to the account: email address, phone number, username. If any of these is still yours and hasn't been changed yet, you'll receive a password reset. Do this before the attacker changes the last remaining contact detail.
Step 3: Use the official support form
Go to instagram.com/hacked or tap "Get more help" on the login screen. This form allows you to verify ownership using:
- The email address you used when creating the account (even if changed later)
- Your original phone number
- The type of device you used when setting up the account (iPhone, Android, etc.)
- A government-issued ID or video selfie (if your account has photos of you)
When submitting the support request — three critical things:
- Enter an email address only you can access — this is where Meta will send recovery steps.
- Use a trusted device — not one that may have been phished.
- State the original device type precisely — it helps establish account ownership.
Step 4: Notify your followers immediately
Via WhatsApp, Twitter/X, or any other platform you control, let your audience know your Instagram is compromised and any messages, money requests, or links coming from it right now are fraudulent. Attackers immediately exploit access to large accounts to run scams targeting followers — people who know you will trust messages appearing to come from you.
How do identity verification and video selfie work?
When basic contact information isn't available, Instagram verifies your identity through two methods — the choice depends on what your account contains:
Video selfie verification (24–48 hours)
If your account contains photos of you, Instagram may ask you to record a short video turning your head in different directions. Instagram's systems compare your face against profile photos. This is typically the fastest path — 24 to 48 hours. If your account has no personal photos of you, this option won't be available and you proceed directly to government ID.
Government ID verification (3–21 business days)
A passport or national identity card is accepted. The typical timeline is 3–7 business days, extending up to 21 days in complex cases. Submit your document only through the official channels within Instagram's support form — never send your ID to any external party claiming to help you.
Strict warning: Third-party recovery services
There is no legitimate channel outside instagram.com/hacked and the in-app support tools. Any person or service claiming to recover Instagram accounts for money — via Telegram, WhatsApp, or external websites — is a complete scam. There is no back-channel access to Meta and no "Meta specialists" operating outside the official system. These services take your money, disappear, or worse — harvest additional data from you.
What should you do immediately after recovering your account?
Regaining access is the beginning, not the end. Execute these steps in the specific order listed — the order matters because each step protects the next one:
Post-recovery checklist (in order):
- 1. Secure your email first: Change its password, review active sessions, delete any unknown forwarding rules, and verify that its recovery email and phone belong to you. Your email is the master key — if it stays compromised, everything else can be re-hacked.
- 2. Change your Instagram password: Settings → Security → Password. Use a unique password not used anywhere else.
- 3. Log out of all devices: Settings → Security → Login Activity. End all sessions you don't recognize — including the attacker's active session.
- 4. Enable two-factor authentication immediately: Settings → Security → Two-Factor Authentication. Use an authenticator app (Google Authenticator or Duo Mobile) — significantly stronger than SMS.
- 5. Review connected apps: Settings → Security → Apps and Websites. Remove any app you don't recognize or no longer use.
- 6. Verify your contact information: Confirm your correct phone number and email are saved — not the attacker's information.
For the complete security setup to prevent future hacks, see our Instagram account security protection guide. For understanding the mistakes that weaken your account's standing, see our Instagram growth mistakes guide. To check your account's recommendation status after recovery, see our Instagram Insights guide.
What if all recovery attempts fail — or the attacker is someone you know?
If all attempts have failed
- No personal photos in the account? Video selfie won't be available — go directly to government ID.
- Was the support request submitted correctly? Confirm you used a secure email only you control.
- Did you receive and respond to Meta's emails? Follow up immediately — delayed responses stall the process.
- Keep submitting: A new request can be filed after a previous one expires. Persistence through the official channel always beats looking for workarounds.
If the attacker is someone you know
Sometimes account access is taken by someone close — a colleague, former partner, or family member. The official approach doesn't change: use the same recovery paths through instagram.com/hacked. If access came through a shared device rather than a stolen password, review Login Activity to identify that device, end its session, then change your password and enable two-factor authentication immediately. Don't allow any device to save your password automatically after that point.
If the account is a business account:
Access through Meta Business Suite or a linked Facebook account can sometimes open additional recovery channels. If the account is linked to a Facebook Business Page, use Meta for Business support as a parallel path.
Frequently asked questions about recovering a hacked Instagram account
How long does recovery take?
From immediate (security link within 24 hours) to 24–72 hours (if email or phone is still yours) to 3–21 business days (if both were changed and identity verification is needed).
Can you recover if the hacker changed everything?
Yes via instagram.com/hacked — through video selfie or government ID. Mention the original device type. Longer process, but possible.
Are paid recovery services real?
No — all scams. No back-channel access to Meta exists. The only legitimate path is instagram.com/hacked and in-app support tools.
How do I know my account was actually hacked?
Signs: email from security@mail.instagram.com about changes you didn't make, can't log in with correct password, posts you didn't send, or login sessions from unfamiliar locations.
Should I notify my followers?
Yes — immediately via other platforms. Attackers run scams targeting your audience the moment they gain access. Warn them not to click links or send money from your compromised account.