Instagram Recovery Guide

Instagram Account Hacked? Here's How to Get It Back

Last updated: October 2026

Instagram account theft is brutal because Instagram is where your photos, your business, and your identity live. The good news: Instagram built more recovery paths than almost any other platform — including an email reversal link and video selfie verification. The bad news: they're spread across the app, the web, and help forms, and the order you try them matters. Here's the full path, fastest first.

Step 1: Check your email for the reversal link (do this first)

When an attacker changes the email on your Instagram account, Instagram emails the old address with a "Revert this change" link. This is the fastest route back in existence — one click undoes the change. Go check now, including your spam and junk folders.

Step 2: Try the login link

On the login screen, tap "Forgot password?" and enter your username, email, or phone — then request a login link. Try every identifier you have: hackers often change the email but leave the username and phone untouched, and any one of those can get you back in. If a link lands in your inbox, open it immediately and reset your password.

Step 3: Go to instagram.com/hacked

If the easy routes are dead, Instagram has a dedicated recovery portal: instagram.com/hacked. Select "My account was hacked" and follow the flow. From a mobile device, you'll be asked for a secure email you control — this can be a brand-new address, it just needs to be one the attacker can't touch.

This walkthrough covers Instagram's official recovery portal and the identity verification steps:

Watch on YouTube: How to Recover a Hacked Instagram Account (Security & Password Reset Guide)

Step 4: Verify your identity with a video selfie

If you're fully locked out, Instagram may ask you to record a video selfie, which it matches against the photos already on your account. On iPhone or Android, you can reach this through the login screen via "Need more help?" or "Get help logging in" when asked for a code you can't receive.

• Record in good lighting with your phone at eye level, turning your head as instructed.
• Remove hats, sunglasses, and anything covering your face.
• The catch: this only works if your account has photos of you. For faceless, meme, or business accounts, verification leans on your signup email and phone plus the device you normally use — so note those details down carefully.

Step 5: Use the Facebook shortcut (if your accounts are linked)

If your Instagram and Facebook accounts are linked, "Log in with Facebook" can restore access directly. Obvious caveat: secure Facebook first if it's compromised too, or you're handing the attacker a spare key.

What proof helps, strongest first

• Video selfie matched to photos on the account — Instagram's primary verification for locked-out users.
• The original email address or phone number you signed up with.
• The type of device you originally used (Android or iPhone).
• A detailed description of what happened — when you lost access, what changed, what you've tried.

Honest timelines

• Minutes if you still have access to the email or phone on file (reversal link, login link).
• Hours to a few days for extra verification like the video selfie.
• Roughly 3 to 7 business days for support-request reviews, per secondary reporting.

Rules that will save you

• Submit one request, not five. Multiple requests from different devices don't speed anything up and can look like bot activity, which slows your case.
• Check spam for Instagram's replies. Missing their email stalls the process entirely.
• Secure the linked email first. If the attacker controls your email, they can keep re-taking the account every time you recover it. The mailbox is step zero, not an afterthought.
• If the account was deleted — by you or the hacker — you must log back in within 30 days, or it may be permanently gone.

Once you're back in

1. Change your password to something unique and strong.
2. Turn on two-factor authentication.
3. Review login activity and log out any device or location you don't recognize.
4. Remove any email or phone number you don't recognize from your account details.
5. Revoke suspicious third-party apps that have access to your account.