Instagram Hacked? Change Password and Recover

Short answer: If your Instagram account was hacked and you can still log in, change the password at once, log out of other sessions, turn on two-factor authentication and review the email and phone linked to the account. If you are locked out, use Instagram's official login help and hacked-account options, then scan your devices for malware.

Losing control of Instagram is stressful, particularly if the account is used for a business. Move quickly but carefully, because many "recovery services" are scams of their own. This guide covers both situations: you can still sign in, and you are locked out. Menu names in the app change from time to time, so treat the paths below as a guide and follow the on-screen wording.

Signs that your Instagram account was hacked

• You are suddenly logged out and your password no longer works.
• Your email, phone number or username changed without you doing it.
• Posts, stories or messages you did not create appear.
• You get login alerts or codes you did not request.
• Your followers say they received odd messages or links from you.

If you can still log in

1. Change your password now. Use a long, unique password that you use nowhere else. You can create one with our free password generator and store it in a password manager.
2. Log out of other sessions. In the account or security settings, find the section showing where you are logged in (the name varies) and log out of every device you do not recognise.
3. Turn on two-factor authentication. An authenticator app is generally safer than SMS codes. Save the backup codes offline.
4. Check the email and phone number linked to the account. Remove any that you do not own, and make sure the email account itself is secure.
5. Remove unknown third-party apps. Review connected apps and websites in the security settings and revoke anything unfamiliar or unneeded.
6. Review recent activity. Delete posts or messages you did not make, and check that the bio link and business details are unchanged.

If you are locked out

Use only the official routes inside the Instagram app or website: the "Forgot password" or login help option on the sign-in screen, and the hacked-account or "need more help" flow that Instagram provides. Follow the prompts and use the recovery email or phone number that you originally registered.

If the hacker changed your email address, Instagram usually sends a message to the previous email address with a link to revert the change. Open your old inbox and check the inbox and spam folders for a recent message from Instagram's official security address. Use the link quickly. Check the sender and web address carefully, because fake recovery emails are common. If you cannot recover, the official help flow may ask you to record a video selfie to prove identity.

Never pay anyone who promises to "recover" your account, give your password to a helper, or send an identity document to an unofficial profile or chat. Those are common secondary scams.

Scan your PC and phone for malware

Attackers often get in through password-stealing malware or a phishing page, not by guessing a password. If you use a Windows PC, run a full scan and remove anything found before you sign in again, otherwise the password you just changed may be captured too. See our guide to checking whether your PC has a virus and the malware removal guide. On your phone, remove apps you do not recognise and update the operating system.

Secure the linked email account

An attacker who controls your email can reset Instagram again. Change your email password, turn on two-factor authentication there, review forwarding rules and recovery options, and make sure you did not reuse the same password anywhere.

Warn your followers and report

Tell followers and friends through another channel that messages from your account during the incident are not from you, and ask them not to click links or send money. Report the hacked account through Instagram's official report options. If money or personal information was lost, call 1930 and report at cybercrime.gov.in.

How to prevent it happening again

• Use a unique, long password for each account, and a password manager.
• Keep two-factor authentication on and use an authenticator app where possible.
• Never enter your login on a page opened from a message. Read social engineering attacks and is this website legit.
• Do not download "follower" or "story viewer" apps.
• Keep Windows, your browser and apps updated.

Frequently asked questions

What should I do first if my Instagram is hacked?

If you can still log in, change your password, log out of other sessions and turn on two-factor authentication. If you cannot log in, use the official login help and hacked-account options in the Instagram app or website.

How do I recover a hacked Instagram account if the email was changed?

Check your old inbox, including spam, for an email from Instagram about the change and use the link to revert it. If there is none, follow Instagram's official help flow, which can ask for further proof of identity.

Should I pay someone to recover my Instagram account?

No. Paid recovery offers and people asking for your password or ID are scams. Use only the official recovery routes provided by Instagram.

How did my Instagram get hacked?

Common causes are phishing pages, reused or weak passwords, password-stealing malware and giving login access to unofficial apps. Scanning your device and using a unique password with two-factor authentication reduces the risk.

Where can I report Instagram account fraud in India?

Report the account to Instagram, and if you lost money or private data call 1930 and file a complaint at cybercrime.gov.in. Keep screenshots and messages as evidence.

Protect your Windows PC

Scan your PC on demand with PremiumAV Total Security: Quick, Full and custom scans, USB drive scans, real-time file monitoring and a quarantine vault are listed as included on the features page. See pricing or download the installer to try it on your Windows PC.