Instagram account hacked: what to do in the first 60 minutes

Was your Instagram account hacked or suspended?

If your password, email address or phone number changed without you doing anything, you've been hacked. If the app shows a notice about a rule violation, it's a suspension.

Typical signs of a hack:

• Emails about changes you didn't make: new password, new email address, new phone number.
• You can't log in, even though you're sure you're entering the right password. The German consumer advice center Verbraucherzentrale calls this a clear sign if the error persists after you try again 1.
• Logins from unfamiliar devices or locations.
• Followers report strange messages "from you", often crypto offers or requests for money.
• Your phone suddenly has no signal, even though you should have reception. That can point to SIM swapping: someone has had a replacement SIM issued for your number and is receiving your text message codes.

Both can also happen together. A New York Times investigation in July 2026 looked into five reported "wrongful bans". According to Meta, two of them were hacked accounts that were suspended because the hackers had posted prohibited content 2. So if you're suspended and don't know why, always check whether someone else was in your account. For suspensions alone, follow the steps in Instagram account suspended: appeal and next steps.

Minutes 0 to 10: how do you get your email inbox back?

Through your email provider's recovery process, and before you deal with Instagram. The Verbraucherzentrale recommends exactly this order: secure your inbox first, so the hacker can no longer read your reset emails, then the other accounts 1.

1. Use a different device if you suspect your phone or laptop itself is compromised. The Verbraucherzentrale advises running a virus scan first 1.
2. Change your inbox password and turn on two-factor authentication (2FA) there.
3. Check forwarding and filter rules. Hackers like to set up silent forwarding. Delete anything you didn't create yourself.
4. Search your inbox for emails from Instagram reporting a change. Some contain a link that lets you undo the change. Before you click, make sure the email is genuine (see How to spot phishing from "Meta").

If the hacker has taken over your inbox as well and you can't get in, use your email provider's recovery process. It's tedious, but it's the key to everything else.

Minutes 10 to 30: how do you recover a hacked Instagram account?

Through the official page instagram.com/hacked or through the login help in the app. The Verbraucherzentrale points out that the standard "I can't access my account" forms are not the right ones after a hack. Hacked accounts have their own page, instagram.com/hacked 3.

Here's how to go about it:

• Go to instagram.com/hacked by typing the address yourself, and don't follow any link from an email or DM.
• Say what happened, for example that your password or email was changed.
• Request a code to an email address or phone number you still control. Often that's the original address that was on the account before the change.
• Confirm your identity if Instagram asks you to.

The video selfie: Since October 2024, Meta has been testing recovery of hacked accounts by video selfie, and since March 2025 in the EU too. Your face is compared with the photos on your profile. Meta says it deletes the facial data after the comparison 4. Only record the video selfie in the official app or on the official site, never for someone who asks you for it by DM.

Important if your profile shows no recognizable photos of you: the comparison needs them. Without them, this route can fail, and other proof is needed, such as an ID. How to weigh that against your privacy is covered in Can you stay anonymous on OnlyFans?

Why speed matters: As long as the hacker is in your account, they can send scam messages, delete content or post prohibited material. The sooner you're back in, the smaller the damage.

Minutes 30 to 45: what do you do as soon as you're back in?

Lock the hacker out and close every back door.

1. Change your password: long, random and used nowhere else.
2. Turn on 2FA or set it up again. Check whether the hacker added their own authenticator app or phone number, and remove it. The Verbraucherzentrale names 2FA set up by the hacker as a common reason people stay completely locked out 1.
3. Log out of all unfamiliar sessions in your login activity.
4. Check the email address and phone number on the account.
5. Review connected apps and roles, and remove anything you don't recognize.
6. Generate new backup codes, because the hacker may have seen the old ones.
7. Check Account Status to see whether anything posted or sent from your account led to warnings.

The full list, including what to do afterward, is in Secure your Instagram account in 15 minutes.

Minutes 45 to 60: who do you need to warn?

Your followers, your contacts and, if needed, your other platforms.

• Tell your followers: a short Story or post saying your account was hacked and messages from that period weren't from you. Ask people not to open links or send money.
• If you're not back in yet: warn people through your own channels, such as a newsletter, your own website or other platforms. That's why a connection to fans that doesn't depend only on Instagram pays off (see Which traffic source suits you?).
• Check other accounts that use the same password or the same inbox, especially your OnlyFans account. What to do there is described in OnlyFans account banned, hacked or payout frozen.
• Inform your agency or team, so nobody responds to the hacker's messages.

Secure evidence: Take screenshots of change emails, unfamiliar logins, the hacker's messages and anything posted from your account. Note the date and time. The Verbraucherzentrale recommends reporting the incident to the police 1. In Germany, many state police forces also accept reports through an online police station; elsewhere, check your local police's reporting options.

How do you spot fake recovery helpers?

They contact you first and want money, codes or photos of your ID. As soon as you post publicly that your account was hacked, accounts turn up posing as Meta employees, "ethical hackers" or recovery specialists.

Typical signs, according to security vendors 5:

• An unsolicited message right after you ask for help, often in the comments or by DM.
• Guarantees such as "100% back in 24 hours".
• Payment up front, often in crypto or gift cards. Amounts from a few hundred to several thousand dollars are mentioned.
• Requests for your password, 2FA code, ID or a video selfie outside the Instagram app.
• No company details, no registered business, no contract.

Then these "helpers" disappear with the money or take over your inbox as well. Nobody outside Meta has access to Meta's recovery process. A law firm acting for you toward Meta, on the other hand, is legitimate. More in "Unban guaranteed": how to spot the scam.

A case from this year shows why you should check support routes carefully: at the end of May 2026, attackers got Meta's own AI support chatbot to add other people's email addresses to accounts. Meta closed the gap. Accounts with 2FA were reportedly not affected 6.

What do you do if recovery doesn't work?

Keep at it, document everything and, if your account matters for your business, get legal advice early. Whether legal steps are possible, a lawyer can tell you. More on the routes after a suspension in Instagram account suspended.

Good to know for EU residents: the Appeals Centre Europe, the free, independent dispute settlement body, doesn't review hacked accounts. You only end up there when it's about a suspension.

And in the meantime, don't create a replacement account to keep posting. Meta can suspend accounts that are meant to get around a removal, and that makes your situation harder (see Instagram account suspended).

Checklist: Instagram account hacked

• [ ] Hack confirmed: change emails, unfamiliar logins, strange DMs, no signal on your phone?
• [ ] Email inbox recovered, password changed, 2FA on, forwarding rules deleted
• [ ] instagram.com/hacked typed in yourself and recovery started
• [ ] Identity confirmed only in the official app or on the official site
• [ ] New password, new 2FA, unfamiliar sessions logged out, new backup codes
• [ ] Followers and team warned, other accounts checked
• [ ] Evidence secured, police report filed
• [ ] No reply to any "recovery expert"

Frequently asked questions

Our take

In the first hour after a hack, order matters: email back, recovery through the official route, hacker locked out, followers warned, evidence secured. Anything someone offers you by DM as a shortcut isn't one.

If you'd like a team that builds your channels with you and thinks about security from the start, maevia works with English-speaking creators who live in Germany, Austria or Switzerland and write native-level English. To talk with us without obligation, apply now.