Instagram Account Stolen? Here's How to Get It Back (2026)

Instagram account stolen? Use Instagram's official hacked-account flow, check your email for a revert link, then video selfie verification. No payment.

Updated: October 4, 2026 · 9 min read

The fastest legitimate fix is Instagram's own hacked-account flow at Instagram.com/hacked. Check the inbox tied to your account first, because Instagram emails a revert link that can undo a hacker's email or password change within a limited window. If that fails, you move to identity verification with a video selfie — and you never need to pay anyone.

Someone is posting from your account, your password no longer works, and your heart is somewhere near your throat. Take a breath. This happens to a lot of people every day, and the large majority get their account back, as long as they use Instagram's own recovery tools and don't hand money or passwords to a stranger in a DM.

This guide is short on theory and long on steps. Read the first section, do those three things, then come back for the rest. Instagram does not offer phone support for account recovery, so anything you do inside the official app or at instagram.com/hacked is free. Anything that asks you to pay is not Instagram.

The fastest fix: Instagram's official hacked-account route

Everything starts at instagram.com/hacked. Open it in a browser on any device — you don't need to be logged in. You can reach the same flow inside the app from the login screen by tapping the option for a forgotten password and then choosing the path that says your account was hacked. Instagram will ask how you're affected, then walk you through either resetting your password or proving the account belongs to you. It is free, and it is the only route that actually restores accounts.

From there, there are really only two paths. If the hacker changed your email or password, Instagram usually emails the original address with a message saying your details were changed, plus a link to secure the account. That link is time-limited, so check your inbox before you do anything else. If the hacker changed everything, you move to identity verification, which is slower but still works for most people.

• Check the inbox of the email address you originally signed up with, including spam and promotions folders.
• Open instagram.com/hacked on a device you trust, not a shared computer.
• Do not pay anyone, anywhere, for account recovery.

What to do in the first hour

Speed matters here, because the person inside your account is already messaging your contacts, and every hour they have is another chance to scam someone who trusts your name. Work through this list in order.

• 1. Look for Instagram's security email. Search your inbox for Instagram and read anything from the last 24 hours. If a message says your email or password was changed, use the link that reverts or secures the change. This is the single fastest way back in.
• 2. Try a password reset. On the login screen, request a reset with your username, email or phone. If your contact details are still on the account, the link comes straight to you.
• 3. If you're still logged in somewhere, act from inside the app. Open your profile menu, go to Settings and privacy, then Accounts Centre, then Password and security. Change the password, then end sessions on all other devices.
• 4. While you're in, switch on two-factor authentication. Use an authenticator app rather than SMS if you can, since SIM swapping is one of the ways accounts get taken in the first place.
• 5. Remove any email address or phone number you don't recognise from your account and your Accounts Centre.
• 6. Check connected apps and websites, and remove anything unfamiliar. Old third-party logins are a common way to lose an account a second time.

If the email, phone and password were all changed

This is the hard version, and it's the one where people give up too early. When the hacker has replaced every recovery detail, a password reset is useless because it lands in their inbox instead of yours. Go back to instagram.com/hacked and choose the option that says you can't access the email or phone on the account. Instagram will then ask you to prove you're the person in the photos.

Before you start, decide which email address you'll use going forward. Pick one you control completely, with its own strong password and two-factor authentication. If that email was compromised too — which is common, since it's often how the hacker got in — secure the email account first. Otherwise you'll recover Instagram and lose it again the same night.

The video selfie (identity confirmation) step

Instagram's identity check usually means recording a short video selfie. You get a code on screen, then you follow simple prompts while the camera records, and the system compares that to photos already on the account. Do it in good light, face the camera straight on, skip the hat and sunglasses, and don't use a filter. The check can take anywhere from a few hours to a couple of days, and the result arrives by email or in the app. Menu names differ between app versions and countries, but the flow always ends with that video.

You'll need to enter a working email address for Instagram to reply to. Use one the hacker can't read.

If the identity check fails

Denials happen, and they're not always final. Wait a day, then try again with better lighting and a calm, straight-on shot. Try a different device and a different network, because repeated failures sometimes come from a connection Instagram flags as suspicious. Make sure the email you gave is one you can actually receive mail on, and check the spam folder. If you have a Facebook account linked through the same Accounts Centre, sign in there and look for recovery options — linked accounts are sometimes the easiest door back in.

Avoid submitting the same video five times in an hour, because it can look automated. If several attempts fail, use the in-app support form to explain your situation in plain language.

Tell your friends before the scam does

While you're locked out, the person in your account is probably messaging your contacts. The classic play is a sob story asking for money, a fake investment pitch, or a vote-for-me link that harvests passwords. Your friends trust your name, so they're the target.

Ask someone you trust to post on your behalf, or put a warning in your story if you still have any access. Text your close contacts directly. Keep it short: my Instagram was hacked, if you get a message from me asking for money or a link, it isn't me — don't click and don't send anything.

• Tell people not to send money, gift cards or crypto, and never to share verification codes.
• Ask them to report your account to Instagram as hacked.
• If a friend already sent money, they should contact their bank immediately.
• Warn older relatives who might not spot the scam as quickly.

Lock the account down after you get it back

Getting back in isn't the finish line. Hackers usually leave a way back in: a saved session, a linked app, a forwarding rule on your email. Run through this list before you relax.

• Change the password to something long and unique, not used on any other site.
• Turn on two-factor authentication with an authenticator app and save the backup codes.
• Review active login sessions and log out everything you don't recognise.
• Check which email addresses and phone numbers are attached, and remove any you don't own.
• Review connected apps, websites and linked accounts, and remove anything unfamiliar.
• If you run ads, check your ad account, payment methods and business settings for changes.
• Check your email account for forwarding rules and unknown filters, and change that password too.
• Look through your posts, bio, DMs and story archive, and delete anything the hacker added.

Paid 'recovery' services and DM 'hackers': don't

Search for help with a stolen account and you'll be flooded with people promising to get it back for a fee. There is no back door into Instagram. Nobody outside Meta can flip a switch and restore an account, no matter how many screenshots of successful recoveries they post. The accounts advertising this are often the same operations that phish accounts in the first place.

Never give a so-called recovery service your login, never pay in crypto or gift cards, and never install a tool or profile-viewer app that asks for your Instagram password. Anything offering to unlock a private account, reveal who viewed your profile, or bypass two-factor authentication is a scam — Instagram does not expose that information to anyone.

Report the accounts that approach you, using Instagram's own reporting tools, and block them. Then get back to the official flow, which is free and actually works.

Sometimes it isn't a hack at all

Not every locked-out account has been stolen. A forgotten password, a mistyped email, a deactivated account or a temporary block can look identical from the outside. Instagram's login screen usually tells you if an account has been disabled, and a password reset will still work if your contact details are on the account. If a friend says your profile looks empty, it may be deactivated rather than hijacked. Either way, the route is the same: start at instagram.com/hacked, and move to identity verification only if you have to.

Frequently asked questions

A stolen Instagram account feels like a violation, and it is one — but it's also a solved problem far more often than people expect. Go to instagram.com/hacked, check the email tied to your account for the revert link, and if that fails, prove who you are with the identity check. Warn your friends, ignore everyone offering paid recovery, and once you're back in, lock the door behind you with a new password and two-factor authentication.