Step 1: Check your original email immediately

When someone changes the email address on an Instagram account, Meta sends a security alert to the original email address. This email contains a link to undo the change — but it only works for about 24 hours.

Check the original email address linked to your Instagram account. Look for an email from Instagram or Meta with a subject like "Your Instagram email was changed" or "We noticed a change to your account." If you find it, click the link immediately to reverse the change before the hacker secures their access.

Step 2: Use Instagram's "My account was hacked" flow

If the undo link is gone or didn't work, go to Instagram.com and click "Forgot password." Even if hackers changed the email, Instagram has a dedicated hacked account recovery path accessible at instagram.com/hacked or through the app's login screen.

The recovery flow will ask you to verify your identity using your phone number, original email, or government ID. Follow the prompts carefully — each option you skip narrows the recovery path.

Step 3: Request a security code by phone

If your phone number was still linked when the hack occurred, Instagram can send a 6-digit code to that number. Even if the hacker has changed everything else, the phone number may still work for a short window. Try this immediately.

Step 4: Submit a video selfie verification

Instagram's most powerful identity verification tool is the video selfie. You record a short video of your face, which Meta's system compares against photos already on the account to confirm you're the real owner. This works even when email, password and phone have all been changed.

This option appears in the "Need more help?" section of Instagram's login page. Take the video in good lighting, facing forward, moving your head as instructed.

Step 5: Submit government ID

If video verification isn't available or doesn't resolve the issue, you can submit a government-issued photo ID. Instagram accepts passports, driver's licences and national ID cards. The name on the ID must match the name associated with the account.

What NOT to do

Don't pay anyone on Telegram or Instagram DMs who claims they can "hack back" your account. These are scams — 100% of the time.
Don't create a new account using the same phone number or devices. Instagram can link accounts and this sometimes triggers further restrictions.
Don't wait. After 30 days with no recovery activity on a hacked account, certain recovery paths close permanently.
Don't share your password with anyone offering to help, including recovery services — no legitimate service needs your password.

When self-recovery isn't working

Instagram's self-service recovery tools are designed for simple cases. If hackers changed your email, phone, and enabled 2FA from a new device, you've entered a more complex recovery scenario that Meta's automated tools handle poorly.

Signs you need professional help:

You've tried all self-service options and none worked
Instagram rejected your ID submission
The video selfie verification failed
More than 48 hours have passed since the hack
The account is monetised and every day offline costs you money

Still can't get back in?

We recover hacked Instagram accounts through official Meta channels. Free assessment, no upfront payment.

Get free case assessment →

How to prevent being hacked again

Once your account is recovered, take these steps immediately:

Enable two-factor authentication using an authenticator app (not SMS — SIM swap attacks can bypass SMS 2FA)
Review and remove all third-party apps connected to your Instagram
Change your password to something unique, not used on any other site
Check "Login activity" in Instagram's Security settings and log out of all unrecognised devices
Set up a backup email address that's on a different provider than your main email