How to Recover a Hacked Instagram Account
A staged response for an Instagram account someone else has taken over — secure the recovery email first, then use Instagram’s "My account was hacked" flow to reclaim it, and harden it so it can’t happen again.
When someone takes over your Instagram, the instinct is to fight for the app itself — but the real battleground is the recovery email. An attacker who controls your email can undo anything you do. So the order matters: secure the email first, then run Instagram’s hacked-account flow, then close the doors that let them in.
If your situation is actually …
- They changed the email → Email changed by a hacker →
- They changed the phone number → Phone changed by a hacker →
Reclaim a hacked account
Secure the email, cut the attacker off
- Sign in to your recovery email provider, change its password, and enable two-factor on the email account itself.Whoever controls the email can reset Instagram at will — this is the first thing to take back.
- If you can still open Instagram, check for a "We made it easier to get back into your account" email from Instagram and use its revert link to undo the email change.Where: Your email inbox — security@mail.instagram.com
Establish what they touched
- On the login screen, use "Need more help?" → "My account was hacked".Where: Instagram login → Need more help? → My account was hacked
- Note what changed — username, email, phone, profile photo — so you can describe it accurately during verification.
Run the hacked-account flow
- Complete identity verification, including a video selfie if asked, and have recovery instructions sent to an email you now control.Where: Instagram identity verification
- Reset the Instagram password to something the attacker has never seen.
Close the doors
- Turn on two-factor authentication (authenticator app preferred over SMS) and save backup codes offline.Where: Settings → Accounts Center → Password and security
- Review login activity and remove any sessions or linked apps you don’t recognise.Where: Settings → Accounts Center → Password and security → Where you’re logged in
Mistakes that make a hack worse
Recovering Instagram before securing the email
If the attacker still owns your email, they reset your Instagram again seconds after you recover it. Always lock the email first.
Why it happens: The hacked app feels like the emergency; the email is the actual control point.
Paying a "recovery service"
These are scams Meta warns about. They cannot do anything beyond Instagram’s own flow and often steal your money or remaining access.
Why it happens: Desperation when the official flow feels slow or uncertain.
Ignoring the Instagram revert email
When an email is changed, Instagram often sends a "secure my account" / revert link to the original address. Missing it loses the quickest route back.
Why it happens: The email lands while you’re focused on the app.
Frequently asked questions
Delvia
Access issues are easier to prevent when roles, owners, and responsibilities are recorded clearly
Most access problems trace back to the same gap — no clear record of who has access, what role they hold, and what should happen when that changes. Delvia helps you keep that record so problems are visible before they become incidents.