Instagram Account Hacked? A Calm, Step-by-Step Recovery Guide
Even if the email and password were changed, there's a path back. The official recovery flow, in order, without the panic.
Diana ReyesOctober 29, 2026 · 9 min read
Reviewed by Omar Haddad · October 31, 2026
In this article
Losing an account is stressful, especially when the attacker changes the email so the normal 'forgot password' no longer reaches you. Work through these steps in order — most people recover within a few days.
Step 1 — Try the login help flow
On the login screen, tap 'Forgot password', then 'Need more help?'. Instagram can send a recovery link to the email or phone originally on the account, even if the attacker added a new one.
Step 2 — Use the 'My account was hacked' path
If the credentials were changed, choose the hacked-account option. Instagram will ask you to verify your identity — often with a video selfie if the account has photos of you. This is the strongest route when the email was changed.
Step 3 — Check your email for the 'email changed' notice
When an attacker changes your email, Instagram emails the ORIGINAL address with a 'revert this change' link that's valid for a short window. Search your inbox (and spam) for it — one tap can undo the takeover.
Step 4 — Lock it down after recovery
Once you're back in: change the password, remove unknown devices (Settings → Security → Login activity), turn on two-factor with an authenticator app (not SMS), and review connected apps.
How to avoid a repeat
The takeover almost always started with a phishing link or a reused password. Use a unique password and an authenticator app, and never log in through a link someone sent you — open the app directly.
Frequently asked questions
Can I recover an account if the email was changed?
Often yes. Use the 'My account was hacked' flow with identity verification, and look for Instagram's 'revert email change' message in your original inbox.
How long does recovery take?
From minutes (if you catch the revert-email link) to several days for identity verification. Be persistent and use the in-app flows, not third-party 'recovery services' — those are usually scams.
Diana spent eight years on a bank's fraud-prevention team before turning to writing. She focuses on account takeover, recovery, and the scams that target everyday users.
