Instagram account hacked, what to do

Your Instagram account is hacked when someone else can post, message, or change the login, or when you can no longer sign in yourself. If you can still log in, change the password now. Instagram’s page on unauthorized posts says a password change logs every other device out. Those devices have to sign in again. That includes the phone the other person is holding.

If you cannot log in, use the recovery steps on Instagram’s hacked-account article. Some of them depend on the kind of account. Instagram says to try each one that the screen offers.

Instagram is moving people to Meta Accounts. You may see Accounts Center, or you may see Meta Account settings. The job of each screen is the same. The label in the app may not match this page word for word.

The longer checklist is Social media account hacked. If the password reset never arrives, the mailbox may be the account that was taken. Fix that before you keep requesting links. Use Personal email account hacked.

If you can still log in

Instagram’s unauthorized-content page gives this order. A profile that comments or posts without you is a sign the password is compromised. You may also see “Try again later” when Instagram flags the activity.

1. Change the password, or send yourself a password reset email. Use a mix of at least six numbers, letters, and special characters, and avoid repetition. Instagram’s password article asks for at least six numbers, letters, and punctuation marks. The password change is what logs the other devices out.
2. Remove third-party apps you do not trust. Instagram says an app that has your username and password, or an access token, can control the account. Apps that promise likes or followers in exchange for the login are a common way in.
3. Turn on two-factor authentication.
4. Confirm that the phone number and the email in account settings are yours.
5. Open Accounts Center and remove linked accounts you do not recognise. A Facebook profile you did not add can be a way back in.

On an iPhone or Android, change the password like this:

1. Tap your profile picture at the bottom right.
2. Tap Menu at the top right.
3. Tap Password and security.
4. Tap Change password, then tap the account.
5. Enter the current password, enter the new one, retype it, and tap Change password.

The same article lists steps for iPad, Instagram Lite, and the mobile browser. Use the section that matches the device in your hand. If you are logged out and you still know a way in, the login screen has its own reset.

Turn on two-factor authentication

Instagram’s two-factor page says a code is required when a login comes from a device they do not recognise. On a computer:

1. Click More at the bottom left, then Settings.
2. Click See more in Accounts Center, then Password and security.
3. Click Two-factor authentication, then select the account.
4. Choose a method and follow the screen.

Instagram offers three methods.

• An authentication app, such as Duo Mobile or Google Authenticator. Instagram recommends this one. You can add more than one device so each can produce codes. Instagram says this method can only be turned on in the Instagram app for Android and iPhone.
• A text message to your mobile number. Use a number already on the account, or add one.
• WhatsApp. Turn on the text-message method first. Then you can receive codes in WhatsApp.

Keep at least one method on. After it is on, Instagram lets you review login requests and remove trusted devices. A backup code works if you lose the phone and the email and cannot get a login code. Save those codes somewhere other than the Instagram account.

When you sign in with a code, the screen may offer Trust this device. Trust a phone or a computer that is yours. Instagram says not to trust a public or shared device.

Text-message codes fail in a SIM swap, because the texts follow the number. If that is how you got here, prefer the authenticator app, and read SIM swap, what to do.

Sign out devices you do not know

Instagram’s login-activity page has two paths, because not every account sees Accounts Center yet.

The Accounts Center path:

1. Click More at the bottom left, then Settings.
2. Tap Password and security.
3. Click Where you’re logged in.
4. Open the account, scroll down, and click Select devices to log out.
5. Select the devices and click Log out.

If that menu is missing:

1. Click More, then Settings.
2. Click Login Activity in the left menu.
3. If a line is you, click This Was Me, then Confirm. If it is not you, click This Wasn’t Me and follow the steps. Instagram uses that path to reset the password.
4. To leave a device, click More beside the login, then Log out.

A password change already logs devices out. This list is how you check one did not sign in again.

Remove apps and linked accounts

Instagram’s apps page says an app you have used in the last 90 days can still read the non-public information you shared with it. Business and creator tools may keep access even after 90 quiet days. Removing an app stops future access to non-public information. It does not pull back copies the app already stored.

On a computer:

1. Click More at the bottom left, then Settings.
2. Under Your app and media, click Website permissions.
3. Click Apps and Websites, then Active.
4. Click Remove next to each app you do not recognise.

Then open Accounts Center and remove profiles you did not link. Do this even when the password is already new. A linked account can be a second door.

If the account is a professional account and someone is still acting on it after you are logged in, Instagram’s hacked-account article points to a separate help page for that case. Follow that page. The personal steps above still apply.

If the email changed

Search the old inbox for mail from [email protected]. Instagram’s hacked-account article says you may be able to undo the email change by selecting secure my account in that message. Do that before the other person changes more.

If the password changed as well, and the secure-my-account link cannot put the email back, request a login link or a security code. The steps are below.

If you cannot log in

Instagram’s hacked-account article says to open the secure-account page linked from that article, on a desktop browser or a mobile browser. Then try the login link.

1. On the login screen, tap Forgot password?
2. Enter the username, the email, or the phone number, then click Send login link. If you have none of those, the article sends you to another page with on-screen steps. Use that page.
3. Complete the captcha and click Next.
4. Open the link in the email or the text message and follow the instructions.

Use a device you trust. A page that arrived in a direct message, asking you to “verify” the account, is a different site.

Ask Instagram to review it

If the login link does not get you in, Instagram says you may be able to request support from the app on a mobile device. Enter an email address only you can open. Instagram sends the next steps to that address.

What they ask depends on the account.

• If the account has photos of you, they ask for a video selfie. You turn your head so they can see a live person. The video is never shown on Instagram. Instagram says they delete it within 30 days. If they cannot confirm you, submit a new video.
• If the account has no photos of you, an automatic mail from Meta support asks for the email or phone number you signed up with, and the type of device you used then. Their examples are iPhone, Android, iPad, or other.

Give them the secure email, not the address the other person just put on the account. While you wait, warn people from another app. The messages sent as you are the part that costs friends money.

Clean up what they posted

Once you are in, look through posts, reels, stories, and comments. Delete the ones you did not make. Check the bio, the link, the profile picture, and the name. Look through direct messages and see who was asked for money, a code, or a gift card. Tell those people, from a channel that is not this account, to ignore the request.

Instagram’s unauthorized-content page is aimed at posts and comments you did not write. It does not list a separate menu for the bio. The profile screen is where that text lives. Change it back while you still have the session.

Change the password on any other site where you reused this one. The unauthorized-content page already says a new Instagram password logs other devices out.

What to leave in place

Two-factor authentication stays on, with the authenticator app if your phone can set it up. The email and the phone number on the account are ones you open. Where you’re logged in shows only your devices. Apps and Websites shows only names you chose. Login alerts are worth turning on if the security screen offers them.

The recovery email has to be a mailbox you still control, with its own second factor. If that mailbox was part of this break-in, finish Personal email account hacked first. Otherwise the next reset goes straight back to the other person.

When the password is new and the devices list is yours, open Social media account hacked and do the prepare list for the Instagram account.

Related playbooks

• Social media account hacked. Someone took over your Instagram, Facebook, X, or TikTok and is posting, messaging your friends, or holding it for ransom.
• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.