The short version: Go to Instagram's own hacked account form, not the regular login help page, request a security code to your original email or phone, and follow the identity checks even if they feel slow. Most genuine recovery cases resolve within a few days to two weeks, not hours, so build that delay into how you manage clients and content while you wait.
What happens when an Instagram account is hacked
Someone gets into your account, usually through a phishing link, a reused password, or a fake "your account will be deleted" email that panics you into typing your login details somewhere you shouldn't. Within minutes they change the email and phone number on the account, turn on two-factor authentication with their own device, and sometimes change the username and profile photo too. That last step is the one that throws people, because when you search your own handle it looks like your account has vanished rather than been stolen.
If you've ever wondered why a profile suddenly says it doesn't exist, that's worth understanding. I've written about what it means when a profile is not available on Instagram, and a hacked account that's been renamed is one of the most common causes.
Step by step: how to get it back
Here is the order I'd work through, because doing it in the wrong order wastes days you don't have, especially if you post for a business.
- Step 1: Try to log in normally first. If the password no longer works, tap "forgotten password" and try every email and phone number you've ever used on that account. Sometimes the hacker hasn't got round to changing all of them yet.
- Step 2: Check your email for Instagram's security alert. When someone changes your email address, Instagram sends a message to the old one with a link that says "this wasn't me." Click it within the window given (usually it works for a short period after the change) and it can reverse the takeover instantly without you needing to go through the full recovery form.
- Step 3: Use the dedicated hacked account form. Search "Instagram hacked account" and use the official in-app or web form built for this, not the general login troubleshooting page. Describe the account as compromised, not "forgotten password," so it routes to the right review queue.
- Step 4: Submit a video selfie if asked. Instagram sometimes requests a short video turning your head in different directions to match it against photos on the account. This feels invasive the first time you do it, but it's one of the few reliable ways they can confirm you're the real owner rather than someone else trying to claim the handle.
- Step 5: Report it as hacked again from a friend's account. Having someone report your profile as compromised adds a second data point for Instagram's systems and can speed up review in some cases.
- Step 6: Once back in, change your password, log out of all sessions, and turn on two-factor authentication using an app rather than SMS. SMS codes can be intercepted if someone has done a SIM swap, which is how a lot of these hacks start in the first place.
A worked example
Say you run a small skincare brand on Instagram with 14,000 followers built up over three years, and one morning you get a DM that looks like it's from Instagram support saying your account has been reported for copyright violation. You click the link, log in on what looks like the real site, and twenty minutes later you're locked out. The bio now promotes a crypto-style giveaway, your profile photo is a stock image, and your business email has been removed from the contact button.
In this situation the first useful move isn't panicking in the comments or posting from a personal account begging followers to report the hacker, it's going straight to your email inbox to look for that "this wasn't me" security alert, because it may still be live. If it's not there or the window has passed, you move to the hacked account form, submit the video selfie when asked, and in the meantime you tell your email list and any other channels you have (a Facebook page, a website banner, a WhatsApp broadcast) that the Instagram account is compromised so customers don't get scammed by the fake giveaway in the meantime. That communication matters more than people admit, because the financial damage from followers losing trust or losing money to the scam can outlast the hack itself.
The uncomfortable part nobody likes to say
If you don't have two-factor authentication turned on, haven't used a unique password for Instagram, and don't have a backup email that's checked regularly, you are, to a large extent, choosing to be the easy target. That's not blaming anyone who's been hacked, scammers are sophisticated now, but most of the accounts I see recovered too slowly or not at all are ones where basic security hygiene was never set up in the first place. Instagram's own recovery process assumes you've got at least one working line of proof back to the real you, an old email, a linked Facebook account, a phone number on file. If every single one of those has also been changed or was never added, recovery gets a lot harder and sometimes doesn't happen at all. Set this up before anything goes wrong, not after.
How long it takes
There's no fixed timeline Instagram publishes, but from what's widely reported by users and small businesses dealing with this, straightforward cases where you still have access to the original email tend to resolve in a few days. Cases needing the full identity verification process, video selfie included, commonly take one to two weeks. Accounts that were used for something clearly against Instagram's rules before being hacked, or ones reported heavily by other users while compromised, can take longer or get permanently disabled by mistake, which is its own appeals process on top.
Locked out? our guide to logging into Instagram with Facebook shows another way back in.
Protecting the account once you're back in
Getting back in is only half the job, the other half is making sure it doesn't happen again next month.
- Turn on two-factor authentication through an authenticator app, not text message.
- Remove any third-party apps connected to your Instagram that you don't recognise or no longer use, these are a common entry point.
- Change your password to something you've never used anywhere else, and store it rather than in a notes app.
- Add a recovery email and phone number that you check weekly, not one you abandoned years ago.
- Review your login activity in settings every so often and log out of any device you don't recognise.
While you're tightening up account security, it's a sensible moment to also review your content calendar and make sure nothing scheduled during the downtime went out looking strange. If you had anything queued for a seasonal push, things like Black Friday countdown posts for Instagram Stories or Thanksgiving captions for business pages, check it manually rather than trusting the scheduler picked back up where it left off.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
What to do if the hack cost you followers, trust, or money
If the hacker ran a scam through your account before you regained control, be upfront with your audience about what happened rather than quietly going back to normal posting as if nothing occurred. A short pinned post explaining the timeline, what was and wasn't legitimate, and what you've done to secure the account now, does more for rebuilding trust than silence. If you run a business page and want a longer-term plan for keeping your presence secure and consistent across campaigns, it's also worth getting real AI consultant support for small business to review your wider digital setup, not just Instagram, since the same weak passwords and unmonitored logins often sit behind email and website accounts too.
Related reading: can you message a deactivated tiktok account.
Frequently asked questions
How do I know if my Instagram was hacked rather than disabled?
If you can't log in and the email or phone number on the account has changed without your knowledge, it's hacked. If Instagram has removed the account entirely for a policy violation, you'll usually see a message saying your account was disabled, which is a different appeals process to account recovery.
Can I get my Instagram account back if the hacker changed the username?
Yes. The username is just one field tied to the underlying account, so changing it doesn't affect your ability to recover ownership through the hacked account form, it just means your old handle may have been searchable as "not available" in the meantime.
Does Instagram ever refuse to give an account back?
It can happen, particularly if you have no working recovery email, no linked Facebook account, and no phone number ever added, because Instagram's system needs some verifiable link to the real owner. This is the main reason to set up two-factor authentication and a current recovery email before anything goes wrong.
Should I make a new Instagram account while waiting for the old one to be recovered?
Only as a temporary measure to communicate with your audience, clearly labelled as a backup account, and don't abandon the recovery process for your original handle, since starting again means losing your follower history, saved content, and search ranking built up over time.
Run a business, a brand or a blog? I feature tools, products and expert guest posts for an audience of 15,000. See how it works
