Instagram account hacked? What Instagram says to do next

Instagram hacks tend to be obvious. Posts you did not write, messages sent to your followers, or a login that suddenly fails. This guide follows the recovery steps in Instagram's own Help Center and the FTC's advice for hacked social media accounts. Instagram notes that some steps may not be available depending on the account type, so try them all.

Start with your email inbox

Before anything else, check the email account tied to Instagram. Instagram's Help Center says that if you received a message from security@mail.instagram.com letting you know your email address was changed, you may be able to undo the change by selecting the secure my account option in that message.

If more was changed, such as your password, and you cannot change your email back, Instagram says to request a login link or security code instead. Open the message only from your email app, and be wary of lookalike senders. Hackers send fake "security" emails of their own.

If you are locked out: request a login link

Instagram describes the login link as a way to help confirm that you own the account. The steps in its Help Center are:

1. On the login screen, tap Forgot password.
2. Enter the username, email address, or phone number tied to the account, then click Send login link.
3. Complete the captcha to confirm you are a real person, then click Next.
4. Click the login link in your email or text message and follow the on-screen instructions.

Instagram adds that if you do not have access to the username, email, or phone number tied to the account, you should visit a separate page it links to and follow the on-screen instructions.

If the link does not work: request support and verify your identity

When the login link does not recover the account, Instagram says you may be able to request support from it on a mobile device. It advises entering a secure email address that only you can access. After you submit, you should get an email from Instagram with next steps.

Identity checks come next. Instagram says that for an account without photos of you, you may get an auto-response email from the Support Team at Meta asking for the email address or phone number you signed up with and the type of device you used then, such as iPhone or Android.

For an account with photos of you, Instagram says you will be asked to take a video selfie, turning your head in different directions, to confirm you are a real person. It says that if it cannot confirm your identity from the video, you can submit a new one and it will review it again.

Keep every email from this process. Do not pay anyone who promises to get your account back. The steps above are free and come from Instagram directly.

If you can still log in

Sometimes the attack is only partly successful, or you spot an attempt early. Instagram's list for that case is short and worth doing in full:

• Change your password, or send yourself a password reset email.
• Turn on two-factor authentication.
• Confirm that the phone number and email in your account settings are correct.
• Check Accounts Center and remove any linked accounts you do not recognize.
• Revoke access to any suspicious third-party apps.

The FTC's guide to hacked accounts adds more. Sign out of all devices so anyone else logged in is removed. Check that your recovery email addresses and phone numbers are ones you control. Look at your posts, messages, and any new connections you do not recognize.

Warn your followers

The FTC suggests telling friends and family about the hack. Ask them not to click links in messages from you and to ignore pleas for help or money. If the hacker was sending messages from your profile, followers may already have received them. Post a short note once you are back in, or send it by text or email.

Why it may have happened, and where to report

Some Instagram accounts are taken through phishing, such as a fake login page or a DM that says your account will be removed. Others are taken with a password that leaked in a breach elsewhere and was reused. If you used the same password on other sites, change it on each.

A free scan can show whether your email address shows up in known breaches, with passwords shown masked. It cannot tell you how your Instagram account was accessed, and a clean result does not mean your accounts are safe.

If money or personal information was involved, IdentityTheft.gov says that if you experienced a fraud, scam, or bad business practice, you can also tell the FTC at ReportFraud.ftc.gov. IdentityTheft.gov has a section for passwords and account logins. If a payment card was used, call the number on the back of the card.