Instagram Account Hacked? How to Get It Back Step by Step (2026)

An Instagram takeover rarely happens slowly. In a typical case, the email on the account is swapped, the password stops working, and within minutes the bio is changed to a crypto giveaway while DMs go out to your followers asking them to “claim a reward.” If that’s happening to you right now, this guide walks through what actually gets accounts back, what wastes time, and how to stop it happening again.

What an Instagram Takeover Looks Like

Most people notice in one of a few ways: a login notification from a device or city they don’t recognise, an email saying the account’s email address was changed, or suddenly being logged out with a password that no longer works. Opening the app may show a “Welcome back” screen for an account that won’t accept your password. By the time you check from a browser, the attacker has often already changed the email and phone number so reset links go to them.

What Hackers Do in the First Few Minutes

Instagram takeovers follow a pattern that’s depressingly consistent once you’ve seen it happen. The attacker isn’t browsing your DMs for gossip — they’re executing a short, mechanical sequence designed to lock you out and monetize the account before you can react:

• Change the email address on file, so any “reset password” email goes to them, not you
• Turn on two-factor authentication using their own authenticator app, which now blocks you specifically
• Change the username and profile photo, often to impersonate a crypto exchange or giveaway account
• Edit the bio to add a scam link or “DM me to claim” message
• Send bulk DMs to your followers pushing a fake giveaway, investment scheme, or urgent money request
• Delete or archive old posts to make the account look freshly rebranded

The DM blast is the part that causes the most real-world damage — it’s not just your account anymore, it’s everyone in your following list being targeted by something wearing your face.

Why the Obvious Fixes Don’t Work

The normal “Forgot password” flow on the login screen sends a reset link to the email on file — which the attacker now controls, so it does nothing for you. Instagram’s automated systems also don’t have a phone number you can call; there’s no human on the other end of a support line for individual users, which surprises most people the first time this happens to them.

Why This Keeps Happening

Instagram takeovers aren’t random — they’re one of the most common social media attacks tracked in 2026, and the mechanism is usually boring: credential stuffing. Attackers buy leaked username-and-password lists from unrelated data breaches (a shopping site, a forum, an old app) and try them against Instagram in bulk, betting that people reuse passwords. If your Instagram password has ever been used anywhere else, that’s the most likely way this happens to you — not some targeted, sophisticated hack, just automation working through a list until something matches.

What You Still Have Going for You

Even mid-takeover, there are identity signals the attacker can’t fake, and they’re worth having ready before you contact support: your account’s creation date and roughly how many posts it has, the email and phone number that were originally on file, any linked Facebook account (Meta can sometimes cross-verify through it), payment history if you’ve ever run Instagram ads, and — if you’re a creator — your follower count and content history, which is very hard for an attacker to fabricate convincingly.

The First Hour: Step-by-Step

1. Go to instagram.com/hacked from a browser — not the app, since the app may already be logged in as the attacker on that device. Enter your username, email, or phone number.
2. Choose to get a login link or security code sent to the email or phone still associated with your account, if you still have access to either.
3. If the email was already changed, select “my email address was changed” — this routes you into Instagram’s identity-verification flow instead of a dead end.
4. Be ready to submit a short video selfie if Instagram’s Support requests one — this is a real, automated identity check, not a scam, and it’s currently the fastest path back in for a fully locked-out account.
5. Once back in, immediately change your password, log out of all other sessions under Settings → Security → Login Activity, and turn off any 2FA method you didn’t set up yourself.
6. Post one story or send one broadcast message warning your followers that any DMs sent “from you” in the last hour were not really from you.

If Instagram’s Automated Flow Doesn’t Work

For accounts that don’t recover through the self-serve flow, Meta expanded its centralized Account Recovery Hub in 2026, which handles hacked-account cases across Instagram and Facebook together — worth trying if you have a linked Facebook account, since it gives Meta more signals to verify you with. If you run ads or have a Meta Business Suite account connected to the Instagram profile, that billing and business history is another identity anchor you should mention explicitly in any support form you fill out.

If You’re a Creator or Run a Business Account

The stakes are different if the account has brand deals, a Meta verification badge, or real follower count behind it — these accounts are specifically targeted because they’re worth more once rebranded. Screenshot everything as it happens: the changed bio, the scam DMs going out, any comments from confused followers. This is evidence Meta’s review process weighs heavily, and it also gives you something concrete to post publicly (from another account) warning your audience while recovery is in progress. If you have any Meta Business Suite access, brand partner contacts, or a verification badge, lead with that in your support request — it moves creator and business cases through review faster than a personal account with no history.

What to Set Up Before This Happens to You

• Turn on two-factor authentication using an authenticator app, not SMS — SIM swaps are still common
• Add a recovery email that’s different from your primary email, and keep it current
• Use a unique password for Instagram, stored in a password manager, never reused from another site
• Log out of Instagram on shared or public devices, and review Login Activity every so often
• If you’re a creator, keep a record of your account creation date, follower milestones, and any Meta Business Suite or ad account details somewhere outside the app

Frequently Asked Questions

How long does Instagram account recovery usually take?

It varies a lot. Simple cases where you still have access to the original email or phone can be minutes. Full takeovers where the attacker changed the email typically take a few hours to a couple of days once you’re in the video-selfie verification queue. Business and creator accounts with more identity signals to check tend to move faster than accounts with little history.

Can I get my account back if the attacker deleted all my posts?

Usually yes. Deleting posts doesn’t remove the account’s creation date, ID, or backend history that Instagram’s systems check during identity verification — it just makes the account look emptier. Once you’re back in, check Recently Deleted under Settings, since Instagram keeps deleted posts recoverable for a limited window.

Should I report the scam DMs my followers received?

Yes — ask a few of them to report the specific message as spam or scam from within Instagram, in addition to you reporting the account compromise. Multiple independent reports on the same activity tend to get reviewed faster than a single report.

The Bottom Line

When an attacker has changed the email and phone number, the regular “Forgot password” screen usually does nothing — the video-selfie verification path through instagram.com/hacked is what tends to work. Speed matters more than anything else, because hijacked accounts are often rebranded and DMing followers within minutes. If this is happening to you right now: go to instagram.com/hacked first, don’t waste time anywhere else, and warn your followers the moment you can — even from someone else’s account. For related guides, see our recovery walkthroughs for Google accounts and how WhatsApp accounts get hacked.