If you lost access to Instagram, the first actions can preserve your route back into the profile. Secure the email address and phone number that were connected to Instagram first, then check official change notices and use instagram.com/hacked. Do not message “Meta Support” in comments or give anyone a password, two-factor code or backup code; we never ask for those either.
Do not spend the first hour arguing with the profile you no longer control. The goal is to stop further changes and leave Instagram a clear record that you are the account holder.
- Sign in to the email address linked to Instagram, preferably from a device you normally use. Change its password to a unique one and review active sessions, forwarding rules and recovery email addresses. Someone controlling the inbox can undo every action you take on Instagram.
- Check Inbox, Spam and Promotions for an Instagram email about an email-address or password change. Open it only after checking the sender and link destination carefully; a genuine notice may offer an option to reverse the change. Take screenshots of the wording, date and old address before you act.
- Type instagram.com/hacked into the browser yourself, rather than using a direct-message link. Choose the option that best describes what happened: someone entered the profile, the email changed, or you cannot log in. Use the former username, email or phone number where the form accepts it.
- If you remain signed in on another phone or browser, do not sign out. In Settings and activity, review Password and security, change the password, end unfamiliar sessions and remove unknown contact details. That is a stronger position than beginning from scratch.
- Warn friends and clients through another safe channel. Briefly explain that the profile is not under your control and they should not open links, send money or trust requests for codes from it.
Record when you noticed the issue, the last successful sign-in and every changed detail. They help with a later review, but the official form is still needed.
Recognising the Instagram email that matters
For an account that someone has taken over, the email-address change message is often the most useful notice. It may arrive minutes before you lose access. Look at the date around the incident, the old and new email address, and whether the message concerns your exact profile, not just the word “Instagram”.
Avoid an email that sends you to an unrelated domain, asks you to reply with a code or pressures you to pay. The same applies to profiles offering “priority support” in comments. Genuine notices can be checked in the app; common fake messages are covered in our guide to a fake verification link.
If you reused the same password elsewhere, change it there too. Your main inbox, Facebook profile and accounts used by team members to access shared assets are especially important. Never send a screenshot that exposes codes or sign-in links.
When both the email and phone number have changed
Changed contact details do not automatically close the case. A new Instagram profile with the same name as “proof” and repeated password attempts can complicate the record and trigger further checks.
- Continue through instagram.com/hacked with the old details you remember. If one option does not recognise you, return to the available step for further help rather than filing unrelated forms at the same time.
- Prepare proof of ownership: former usernames, old email and phone number, an approximate creation date, the device you usually used and copies of genuine notices. Passwords and 2FA codes cannot support that proof and should never be sent.
- If Instagram requests a video selfie, follow the instructions inside the app. Record it in good light, without filters and with your face clear; the system uses it to compare the request with photos on the profile. A profile without photos of you may receive a different check, so follow only the screen you are shown.
- Watch your inbox, including Spam, for a reply or new task. Do not submit the same form every few minutes unless the procedure itself asks you to resubmit.
If the profile is connected to Facebook through Accounts Center, check Facebook security too. Change its password, review sessions and confirm that nobody added a new sign-in method. The connection can help you see what was affected, but it does not replace Instagram’s own review. See our overview of restrictions and solutions for the broader picture.
After access returns
Once you are back in, check that the username, email address, phone number, connected Facebook accounts and sign-in methods belong to you. Review Login activity and end sessions you do not recognise. Look through recent stories, posts and sent messages, without blaming recipients who were misled.
Then turn on two-factor authentication through an authenticator app, store backup codes offline and use a distinct password for Instagram. Do not share it with a colleague or agency; for business access, use roles and keep track of who administers the assets. Content rules are a separate matter, covered in our guide to permitted content.
Where a profile has business value, advertising assets or important history, send the notices and timeline through diagnostics if the official flow has stopped without an answer. We can organise the facts and evidence for the case. Do not send passwords, codes or backup codes.
Official sources
Checked on 23 October 2026.