Waking up to find your Instagram account hijacked feels like a punch to the gut. Your photos, your followers, your DMs gone in seconds.
But here’s the thing most people don’t realize: the first 30 minutes after you notice something’s wrong are everything. Act fast with the right steps and you’ll probably get your account back. Panic, spam random password resets, or wait too long, and you could be locked out for weeks.
This guide walks you through exactly what works right now, in 2026, based on Meta’s latest recovery flows and what real users have reported getting results with.
Secure Your Email Before You Touch Instagram
This is the step almost everyone skips, and it’s the reason most recovery attempts fail. Think about it: if a hacker still has access to your email, they can intercept every single recovery code Instagram sends you. You’d basically be handing them the keys again right after changing the locks.
So before you even open the Instagram app, go to your email provider and reset that password first. Turn on two-factor authentication using an authenticator app like Google Authenticator or Authy. Then check your forwarding rules hackers love setting up sneaky email forwards to their own inbox so they silently receive copies of everything. Remove any forwarding addresses you don’t recognize, revoke unknown sessions, and make sure you’re the only one logged in.
Once your email is airtight, you’re ready to tackle Instagram.
The Fast Recovery: When Your Email or Phone Still Works
If the hacker changed your password but didn’t swap out your email or phone number yet, you’re in the best possible position. This is the quickest path back in.
Open the Instagram app and tap “Forgot password?” on the login screen. Type in the email address, phone number, or username that’s linked to your account. Instagram will send a one-time login link to your email or a code via text message. Click that link, and you’ll be logged right in and prompted to create a new password.
One critical warning here: request only one login code at a time. Spamming the “send code” button can actually trigger a 24 to 48 hour security block on your account. That’s Instagram’s anti-abuse system kicking in, and it’ll delay your entire recovery. Patience really matters in this moment.
After you’re back in, immediately go to Settings, then Accounts Center, then Password and Security. Check your login activity and remove every device you don’t recognize. Change your password to something completely new — not a variation of the old one.
When the Hacker Changed Everything: Using instagram.com/hacked
Here’s where it gets trickier. If the attacker swapped your email, changed your phone number, and updated the password, the regular “forgot password” flow won’t help because those recovery links are going to the hacker’s contact info now.
This is where Meta’s dedicated recovery page comes in. Open a browser on your phone or computer and go directly to instagram.com/hacked. Select “My account was hacked” and follow the on-screen prompts. You’ll be asked for your username, any email or phone number that was ever linked to the account, and some details about what changed.
Instagram will then route you into what recovery specialists call the “secure recovery tunnel.” This process bypasses the hacker’s modifications and sends verification to a secure contact address you control — or it pushes you toward identity verification if no original contact info can be confirmed.
One detail that trips people up: use your original username when filling out this form, not whatever the hacker might have changed it to. Instagram keeps records of previous usernames, and entering the one you originally had actually helps their system locate your profile faster.
Video Selfie Verification: The 2026 Default for Tough Cases
When none of your old contact information works, Instagram will ask you to complete a video selfie. This has become Meta’s go-to identity check in 2026, and it works better than most people expect — if you do it correctly.
Here’s how it goes: Instagram prompts you to record a short video of yourself turning your head in different directions. Their system compares your face against photos that exist on your account. If the match is confident, you’re in. The whole verification usually takes somewhere between 5 and 24 hours, though during high-volume periods like after a major data breach scare, it can stretch to 2 or 3 business days.
Tips that actually help with the video selfie: record in natural, even lighting. Hold your phone at eye level. Don’t wear sunglasses or a hat that shadows your face. And use the Instagram app itself — not a mobile browser. The app captures video in the format Instagram’s system expects, and browser-based attempts seem to have higher rejection rates.
If your selfie gets rejected, don’t panic and don’t immediately resubmit ten more. Rapid resubmissions can trigger longer lockouts. Wait at least a few hours, try from a different device if possible, and make sure your lighting is significantly better on the next attempt.
What About Accounts With No Face Photos?
This is a legitimate concern, especially for brand accounts, meme pages, or anyone who never posted personal photos. If Instagram can’t match your video selfie to anything on the account, they may escalate to an ID-based verification process instead.
In that case, you’ll need to submit a government-issued photo ID. Instagram compares the name on the ID against the name associated with the account. This process typically takes longer — expect 3 to 5 business days for a response.
For business accounts, having your account connected to a Facebook Business Page can speed things up considerably. Meta’s Accounts Center links these together, and having verified business information on the Facebook side gives Instagram additional ways to confirm you’re the real owner.
The “I Got a Reset Email I Didn’t Request” Situation
In early 2026, a wave of unexpected password reset emails hit millions of Instagram users, causing widespread panic. Instagram actually addressed this and confirmed it was related to a system issue, not necessarily individual hacks. Their official guidance was straightforward: if you receive a password reset email you didn’t request, simply don’t click the link.
However, this is exactly the kind of confusion scammers exploit. They send phishing emails that look almost identical to official Instagram notifications, complete with subject lines about suspicious login activity or policy violations. Before clicking anything in an email claiming to be from Instagram, check the sender address. Legitimate Instagram emails come from [email protected]. Anything else is a red flag.
You can also verify directly inside the app by going to Settings, then Accounts Center, then Password and Security, then Emails from Instagram. This shows you every real email Instagram has sent you recently. If the email you received isn’t listed there, it’s a phishing attempt delete it.
After Recovery: The Steps Most People Forget
Getting back into your account is only half the battle. If you stop there, you’re basically leaving the door propped open.
First, change your password to something strong and unique. Don’t reuse a password from any other platform. Credential stuffing attacks, where hackers test leaked username and password combos from other breaches across Instagram, remain one of the most common ways accounts get compromised.
Second, enable two-factor authentication right away. Go to Settings, then Accounts Center, then Password and Security, then Two-Factor Authentication. Choose “Authentication App” as your method instead of SMS. Text message codes are vulnerable to SIM-swapping attacks, where someone convinces your phone carrier to transfer your number to their device. Authenticator apps generate codes locally on your phone and are significantly harder to intercept.
Third, go to Settings, then Apps and Websites, and revoke access to every third-party app you don’t actively use and trust. Those follower tracker apps, auto-posting tools, and analytics services are some of the most common entry points for account compromises. Many of them ask for your login credentials directly, which is a massive security risk.
Finally, check your Accounts Center for any unfamiliar linked accounts. Hackers sometimes connect their own Facebook or Instagram accounts to maintain a backdoor even after you’ve changed your password.
What Doesn’t Work and What’s a Scam
Let’s clear this up: there is no Instagram support phone number. Any number you find online claiming to be Instagram support is a scam, full stop. Meta handles all account recovery through automated in-app flows and web forms. There are no humans you can call.
Similarly, anyone on social media offering to “hack your account back” for a fee is running a scam. These so-called recovery services will take your money, ask for personal information they can use against you, and deliver nothing. Instagram’s recovery process is free. Always has been.
If you’ve been going through the recovery process and haven’t heard back after several days, your best move is to submit one more appeal through the official channels and then wait. Repeatedly submitting forms doesn’t speed things up and can actually slow the process down by creating duplicate tickets.
The Realistic Timeline
People want to know how long this whole thing takes, and the honest answer depends on your situation. If your contact info hasn’t been changed, you can be back in within minutes. For video selfie verification, the median is 24 to 48 hours. ID verification can take up to 5 business days. And complex cases where the account has been significantly altered might take even longer.
The biggest factor in how quickly you recover your account is how fast you act. The sooner you start the process after noticing the hack, the less time the attacker has to change your settings, remove your content, or further lock you out.
Your Instagram account is recoverable in almost every scenario. The key is following the right steps in the right order, starting with your email, moving through Meta’s official recovery channels, and finishing by locking everything down so it doesn’t happen again.