Regaining a hacked Instagram is about order and method, not speed. Here is the sequence that gives you the best shot at getting back in.
Discovering that someone else controls your Instagram is unsettling, but the recovery itself is less about acting fast and more about acting in the right order. People who panic and try everything at once tend to make their situation messier undoing their own progress, locking themselves out further, or tipping off the intruder.
People who move through a clear sequence securing what they can, then reclaiming the account, then locking it down tend to come out the other side with their profile intact. What follows is that sequence, in the order that actually works.
Start with your email, not the app
Before touching Instagram itself, open the email inbox connected to your account. When a password, email, or phone number is changed, Instagram typically sends a notification from its official security address, and that message often contains a link to reverse the change.
This is why the inbox comes first: if the attacker only altered your email and you catch it quickly, that single reversal link can hand control straight back to you, no lengthy process required. Just make sure you are reading the genuine message and not a convincing lookalike, then follow the legitimate link if it is there. It is frequently the fastest route home, and it is the one people skip because they rush straight to the app.
Try logging in attackers are sloppier than you’d think
It is worth attempting a normal login even if you are convinced you are locked out. Intruders often change just one thing and overlook others, or a session of yours may still be quietly active on another device.
If your usual credentials still work, even partially, you may be able to slip back in and start securing the account immediately, before the attacker tightens their grip. So do not skip this step on the assumption that the door is already bolted. Surprisingly often, it turns out to be merely ajar.
Use the route built for hacks, not a plain reset
If a standard login fails, the path you choose next matters a great deal. A simple password reset assumes you still control the contact details but a hacker may have changed exactly those. When codes are being sent to an attacker instead of to you, looping endlessly on password resets just spins your wheels.
Instead, move to Instagram’s dedicated hacked-account route and look for the option indicating that your account was hacked. This steers you into an identity-verification process designed for precisely this case, where ownership is confirmed through your history rather than a code the attacker can intercept. During that flow, Instagram will ask where it can reach you, and this detail is quietly critical: provide an email address that only you control and are certain is not compromised. Recovery follow-ups arrive there, and using an inbox the attacker can also see risks handing the case right back to them.
Cooperate with identity verification
Because the usual codes may be unreliable during a takeover, Instagram may confirm your ownership in other ways. If your profile contains photos of you, this can include a short video selfie, recorded so the platform can confirm you are a real person and match you to existing images on the account.
Give it good lighting, a clear view of your face, and a stable connection. If it does not succeed on the first try, resist the urge to retry repeatedly wait, then attempt again under better conditions. This step is working in your favor, not against you; it is the mechanism that lets a rightful owner prove themselves when an attacker has changed everything else.
Once you’re back in, move fast to secure it
Regaining access is only half the job, because the weaknesses that let the intruder in are still wide open. The moment you are inside, change your password to something strong and entirely new. Then review your login activity and end every session you do not recognize, which physically kicks the attacker out of any device they were using.
From there, check your profile details email, phone, name and correct anything that was altered while you were locked out. The mindset is to slam every door shut at once rather than one at a time, because an attacker who still holds even one foothold can often undo the rest. This is also where you cut off their hiding places: look through the third-party apps and websites connected to your account and remove anything unfamiliar, since a shady linked app can quietly preserve access long after you have changed your password. Check, too, for any unfamiliar two-factor method or recovery contact that was added, and remove it. If you suspect the breach began with malware on your device, run a trusted security scan.
Don’t forget the accounts around Instagram
A compromise rarely respects neat boundaries. If your email account itself was breached, the attacker can keep retaking Instagram no matter how many times you reset it, so secure that inbox with a fresh password and its own two-factor protection.
If your Instagram is linked to Facebook or other Meta services, check those for unauthorized changes as well, because takeovers sometimes spread across connected profiles. Treating the whole cluster as a single target — rather than fixing Instagram in isolation — is what stops you from leaving a quiet back entrance standing open.
A quick recap of the order
When the moment is stressful, it helps to have the sequence in one place. In order:
- Check your security email and use any reversal link.
- Try a normal login in case the attacker missed something.
- Use the dedicated hacked-account route, giving a clean contact channel.
- Cooperate with identity verification.
- Once inside, reset the password and end unknown sessions.
- Remove suspicious connected apps and any added recovery methods.
- Secure your email and any linked accounts.
Working through it in that order, calmly and completely, is far more effective than doing the same steps in a frantic scramble.
Lock it down, and refuse the scams
With control restored, set the account up so a repeat is genuinely harder. Turn on two-factor authentication, ideally through an authenticator app rather than text alone, and save the backup codes somewhere durable. Use a unique password you do not reuse anywhere else, and stay alert to phishing never enter your login on a page you reached through an unexpected link.
A few things to refuse along the way: do not pay anyone demanding a ransom for your account, since there is no guarantee they will return it and engaging often invites more pressure. Ignore services and messaging-app contacts promising guaranteed or instant recovery for a fee, because they cannot beat Instagram’s own process and frequently exist only to scam. And never share a verification or backup code with anyone claiming to be support. The legitimate route costs nothing and runs entirely through Instagram itself its Help Center at help.instagram.com explains compromised-account recovery, and the hub at instagram.com/hacked is built specifically for regaining and securing access.
Taking back a hacked account is a sequence, not a scramble. Check your security email, try logging in, use the hacked-account route, confirm your identity, then secure the account and everything connected to it. Done in that order calmly and completely recovery is far more achievable than it feels in that first sickening moment.