# Hacked Instagram: How to Recover Your Account and Secure It

URL: https://socialboostexpert.com/blog/hacked-instagram
Updated: 2026-10-31

> How to recover a compromised Instagram account according to the official help centre, enable two-factor authentication, recognise phishing and where to report an incident.

Home
/ Blog
/ Safety and rules
Safety and rules
## Hacked Instagram: What to Do, How to Recover Your Account and How to Secure It
Has someone gained access to your Instagram account? Step by step: recovery via the official website, securing your account, how to recognise fraudulent messages and when to contact the police.
The Social Boost editorial team · Published October 31, 2026 · Last reviewed October 31, 2026 · 7 min read
### In short
- Start recovering a compromised account on the official page instagram.com/hacked, never via links in messages from third parties.
- If an attacker has changed your e-mail address, look for a message from security@mail.instagram.com with an option to revert the changes.
- Without access to your e-mail and phone, Instagram may verify your identity by video selfie, if your photos are on the account.
- After recovery, change your password, enable two-factor authentication and remove unknown devices and apps.
- Suspicious e-mails can be forwarded to phish@instagram.com; account theft or damage can be reported to Policie ČR.
If someone has gained access to your Instagram account, start the recovery on the official page instagram.com/hacked
. Check the e-mail from security@mail.instagram.com, which can be used to revert the e-mail change, or request a login link to be sent to you. After returning to your account, immediately change your password, enable two-factor authentication and remove unknown devices and apps.
### What should I do in the first hour?
First, find out whether you can still log in to the account. The next steps depend on this. Whatever the situation, use only the official Instagram app or website, never links from messages you receive after the account has been compromised.
- Try to log in. If you can, skip to the section on securing your account below.
- Open your e-mail inbox and look for a message from Instagram about a change of e-mail address or password.
- Secure your e-mail account as well: change its password and enable two-factor authentication. According to Instagram's help centre, anyone with access to your e-mail will most likely also gain access to your account.
- If you used the same password elsewhere, change it everywhere.
- Warn acquaintances through another channel (SMS, a different network) that fraudulent messages may be coming from your account, such as requests for money or codes.
### How do you recover a hacked Instagram account?
Instagram offers several options, and it is worth trying them in this order: an email about the change, a login link, a support request and identity verification. All of this is described in the official help page for compromised accounts
(as of October 2026).
#### Email from security@mail.instagram.com
If an attacker has changed your email address, Instagram may send a message to the original address from security@mail.instagram.com. It contains an option to secure your account (in English, "secure my account"), which allows you to reverse the change. Before clicking anything, check the sender's exact address.
#### Login link
- On the login screen, tap Forgotten password.
- Enter your username, email address or phone number.
- Choose to send a login link and complete the captcha verification (confirming that you are not a robot).
- Open the link you receive by email or SMS and follow the instructions.
#### Support request and identity verification
If email and phone do not work, request support through the page for compromised accounts. Provide a secure email address to which only you have access, as further instructions will be sent there.
- Account without your photos: Instagram may ask for the email address or phone number you registered with, and for the type of device you used to create the account.
- Account with your photos: you may be asked to record a video selfie, turning your head in different directions. According to the help page, the video is not published anywhere and is deleted within 30 days.
Button names in the app may change. If the steps do not match, follow the current version of the website instagram.com/hacked
.
### How do you secure your account once you regain access to it?
Change your password immediately, turn on two-factor authentication, and check your contact details, linked accounts and apps. An attacker may have left a "backdoor" in the account, for example their own phone number or a connected app.
- New password. Use a password that you do not use anywhere else. Instagram security help
recommends a combination of numbers, letters and special characters without personal information, and a password manager.
- Logging out unknown devices. In the security settings, review where you are logged in and log out of any unknown devices.
- Contact details. In the settings, check that both your email address and phone number are yours.
- Accounts Center. The Accounts Center is a place in the settings where Meta manages linked accounts across Instagram, Facebook and other services. Check whether an attacker has connected a foreign profile to your account.
- Third-party apps. Remove access from apps and websites you do not recognise. The help page warns that apps to which you entrust your login details gain full access to your account.
- Content and messages. Review your posts, Stories and sent messages to check whether an attacker has added anything, and delete any such content.
#### How do you turn on two-factor authentication?
Two-factor authentication is a protection under which Instagram, after a login from an unknown device, asks for a one-time code in addition to your password. Instagram describes it in its help centre as the most effective protection for an account.
According to guide to two-factor authentication
(as of October 2026) follow these steps: More menu (three-line icon) → Settings → See more in Accounts Center → Password and security → Two-factor authentication → select the account and method.
Method How it works Note
Authentication app Codes are generated by an app, e.g. Google Authenticator or Duo Mobile Instagram recommends this option
SMS The code is sent to your registered phone number Depends on access to the phone number
WhatsApp The code is sent via WhatsApp Available after SMS has been set up
Backup codes One-time codes saved in advance For use if you lose your phone or e-mail access
Store your backup codes somewhere other than your phone, for example in a password manager or printed and kept in a secure place. Do not share them with anyone, including “support” staff who contact you unprompted.
### How are Instagram accounts most often attacked?
The most common method is phishing. Phishing is a fraudulent message or link designed to make you enter login or personal details on a fake page. According to Instagram's help page on phishing
fraudsters often claim that your account will be deleted or blocked.
In practice, these are typically the following kinds of messages:
- alleged copyright infringement with a threat of account deletion and a link to an “appeal”,
- an offer to verify your account (blue ticks) or a collaboration that leads to a login form,
- a message from an acquaintance whose account has already been hacked, asking for an SMS code or a vote in a contest,
- an offer of a gift or prize, or conversely a demand for payment of a fee.
Instagram states that it communicates with users, among other things, from the addresses notification@facebookmail.com and noreply@facebookmail.com and from the domains @fb.com, @meta.com, @support.facebook.com and @account.meta.com (status as of October 2026). However, a matching address alone is not sufficient; we recommend not clicking links in e-mails and checking the status of your account directly in the app.
Another common route is leaked and reused passwords, and apps promising free followers or likes in exchange for logging in. We explain why these are risky in our article on free follower apps
. Similar tricks are also used by fraudulent sellers of followers
.
### Where to report an account takeover?
Report fraudulent e-mails to Instagram, fake messages and profiles directly in the app, and you can report account theft involving damage or blackmail to the Policie ČR (Police of the Czech Republic).
- Phishing e-mail: forward it to phish@instagram.com.
- Fake profile or message: report them directly in the app via the menu on the profile or message.
- Policie ČR: according to the page Criminal complaint
it can be filed orally at any police station, in writing, electronically with a qualified electronic signature or via a data box, or at the state prosecutor's office. State what happened, when and how, any known information about the perpetrator, evidence and the amount of damage.
As evidence, save screenshots of fraudulent messages, e-mails about changes to the account, and communication with the attacker. If the attacker demands money in return for restoring the account, do not pay and contact the police. This text is general information, not legal advice; please verify your specific situation with the police or a lawyer.
If you manage to restore your account but Instagram restricts some features, follow the guide, what to do with a restricted account
.
### When paid promotion makes sense and when it does not?
After an attack, security comes first: restore the account, secure it, and check that it has no warnings or restrictions. Until then, do not address paid promotion. Instagram's Community Guidelines explicitly ask users not to artificially collect likes, followers or shares
, so restrictions on reach or on the account cannot be ruled out; the same is stated in Art. 3.3 terms and conditions
. A package does not replace content, does not guarantee audience interest or sales, and may worsen the ratio of interactions to followers.
For a secured profile with good content, a package can followers on Instagram
serve as initial social proof alongside your own work on content. On sledujici.eu, no password is entered for an order, and the service starts only after payment. Variants can be found in price list
. Anyone who asks you for a password or code for promotion purposes should not be given one.
### Frequently asked questions
#### An attacker changed my password, e-mail address and phone number. Do I still have a chance of recovering the account?
Yes, there is a chance. Check your original e-mail inbox to see whether you received a message from security@mail.instagram.com with an option to secure the account and revert the changes. If not, continue via instagram.com/hacked and request support. For an account containing your photos, Instagram may ask you for a video selfie; for an account without photos, it may ask for the details used at registration and the type of device.
#### I received a message saying my account will be deleted due to copyright infringement. Is it genuine?
Be careful. Instagram's help centre warns that scammers often claim that your account will be deleted or blocked and try to obtain your login details. Do not click the link and do not reply to the message. Check the status of your account directly in the app and compare the e-mail with the addresses Instagram officially uses. You can forward a suspicious e-mail to phish@instagram.com.
#### Which two-factor authentication method is the most secure on Instagram?
Instagram recommends an authentication app, such as Google Authenticator or Duo Mobile. Other options are codes sent via SMS or WhatsApp. Whichever you choose, save your backup codes in a secure place away from your phone. They will help you log in if you lose your phone or do not have access to your e-mail.
#### Does it make sense to report a hacked Instagram account to the police?
If you have suffered a loss, if the attacker is misusing the account to extract money from your followers, or if you are being blackmailed, it may make sense to file a criminal complaint. This can be done at any Policie ČR station, in writing or electronically. Prepare a description of events, times, screenshots and information about the loss. This is not legal advice; please discuss your specific situation with the police or a lawyer.
#### Do promotion services need my Instagram password to promote my profile?
Do not give your password or two-factor authentication codes to anyone offering followers, likes or promotion. Instagram's help centre warns against applications to which you entrust your login details, as they gain full access to your account. A request for your password is a signal that you should not proceed with such an offer.
### Want to give your profile a head start?
Choose a package for your platform. We never ask for your password, the order takes two minutes and delivery starts after payment.
See packages and prices
Not sure which package fits? Write to us on WhatsApp or by e-mail and we will recommend one. WhatsApp
· info@socialboostexpert.com
### Sources
- My Instagram was Hacked – Instagram Support
(checked October 31, 2026)
- My Instagram account has been hacked – Instagram Help Center
(checked October 31, 2026)
- Secure your account with two-factor authentication – Instagram Help Center
(checked October 31, 2026)
- Tips for keeping your Instagram account secure – Instagram Help Center
(checked October 31, 2026)
- Protect yourself from phishing on Instagram – Instagram Help Center
(checked October 31, 2026)
- Community Guidelines – Instagram Help Center
(checked October 31, 2026)
- Trestní oznámení – Policie České republiky
(checked October 31, 2026)
Prepared by our editorial team with AI assistance and checked against the sources above. Platform rules change: always check the current wording at the source. This article was translated with AI assistance. The sources are in their original language.
### Related articles
Safety and rules Free Followers: How Apps and Websites Work and What Risks You Face Free follower apps usually ask for your password or your activity. We explain how they work, what platform rules say about them, and how to secure your account if you have already tried them. October 31, 2026 · 6 min read
Safety and rules Instagram has restricted your account: what to do, how to appeal and how to prevent it Restricted actions, a removed post or a deactivated account: where to find the reason, how to submit a review request and what to write in it, and how to prevent further restrictions. October 31, 2026 · 6 min read
Safety and rules How to Avoid Being Scammed When Buying Followers: Warning Signs and a Checklist How to recognise a suspicious seller of followers, likes and views, what rights you have when buying online, and what to do if nothing arrives after payment. October 31, 2026 · 7 min read