The short version: Instagram recovery lives inside the app under “Get help logging in”, and the fastest route is usually the video selfie verification, not emailing support. Most accounts that get recovered are recovered within 24 to 72 hours; if it’s been three weeks with no reply, treat that account as gone and start rebuilding rather than waiting for a miracle.
I’ve helped four different clients through this exact nightmare in the last two years, and I’ve lived it myself once, back when I still ran a personal account with just under 90,000 followers. So this isn’t theory. This is what I typed, what worked, and what wasted my time.
How to know it’s a hack (not just a glitch)
Before you panic, check the signs. A hacked account usually shows one or more of these:
- You’re logged out and your password doesn’t work, even after a reset attempt.
- Your email address or phone number on the account has changed and you didn’t change it.
- Your profile photo, bio, or username has changed to something you don’t recognise.
- Followers are messaging you saying you’re posting crypto giveaways or “click this link” stories you never made.
- You get a login alert email from Instagram for a device or city you’ve never used.
If it’s just an app crash or Instagram is down for everyone, none of that applies. Check Twitter (X) or Downdetector first. I’ve seen people go through the entire recovery process at 2am for what turned out to be a five-minute outage.
Step one: try the in-app recovery before anything else
Go to the login screen and tap “Get help logging in” (Android) or “Forgot password?” (iOS). Instagram will ask for your username, email, or phone number. Type in whichever one you still remember, even if it’s outdated. This matters because Instagram’s system checks against every email and phone number that has ever been linked to that account, not just the current one.
If you still have access to the email or phone number on file, you’ll get a login link or code within minutes. This is the fastest path and it works for the majority of simple password loss cases, no hack involved.
Step two: if the hacker changed your email, use the “This wasn’t me” flow
This is where it gets more involved. If someone has already swapped your linked email or phone number, Instagram shows a message during the reset attempt that effectively says “someone changed the contact info for this account.” Tap through it. You’ll be asked to confirm your old email or phone number, and Instagram will send the recovery link there instead, even though the hacker changed it. This one detail trips people up constantly. They assume that because the hacker changed the email, they’re locked out permanently. You’re not. Instagram keeps a record and defaults back to your original contact details for exactly this reason.
Step three: verification through video selfie
If password reset doesn’t work at all, Instagram will sometimes ask for a video selfie to prove you’re a real person and, in some cases, that you match the face on the account’s photos. You turn your head in different directions on camera. It sounds odd, and it is, but it’s one of the more effective anti-fraud tools they’ve built, because it’s much harder for a hacker sitting in another country to fake than it is for them to guess a password.
This step usually gets triggered automatically after two or three failed recovery attempts, or if the account has a decent following and Instagram’s systems flag it as higher risk to lose.
Step four: report the account as hacked directly
Inside the app, or from a browser on desktop, go to help.instagram.com and search “hacked account.” There’s a dedicated form for this specific problem, separate from general support. Fill it in with as much detail as you can: your username, the email or phone linked when you last had access, and roughly when you noticed the takeover. Attach a screenshot if the hacker has changed the profile to something visibly different, since that speeds up the human review.
This is also where I need to be blunt about something most guides gloss over: Instagram’s support for individual accounts is mostly automated, and the humans who do review these cases are stretched incredibly thin across more than two billion accounts worldwide. There is no phone number. There is no live chat with a real agent for a personal account. If you’re a Meta Verified subscriber (roughly £11.99 a month in the UK, or around $14.99 in the US at time of writing) you get faster, more direct support access, which changes the odds. For everyone else, you’re in a queue with everyone else.
The real story: what happened when a client’s business account got hacked
A client of mine, an ecommerce owner selling handmade jewellery, had her business Instagram account taken over in early 2025. 34,000 followers, five years of content, and it was her single biggest sales channel; roughly 40 percent of her monthly orders came through Instagram Shopping tags and Stories links.
The hacker changed her email, posted two crypto scam Stories within the hour, and locked her out completely. We submitted the hacked account report the same day. Nothing for six days. On day seven, she got the automated video selfie prompt. She completed it, and 19 hours later the account was returned to her, email and phone number reset back to hers, no data lost.
Compare that to another client, a fitness coach with around 12,000 followers, whose account was hacked the same month. She waited, assumed it would sort itself out, submitted the report ten days late, and never got it back. Eight months on, it’s still sitting there, occasionally posting spam. She rebuilt from scratch on a new handle and, honestly, she’s now past her old follower count because she treated the rebuild seriously instead of half-heartedly. Speed of reporting made the difference between those two outcomes far more than luck did.
What to do while you wait
- Warn your audience elsewhere. Post on Facebook, LinkedIn, or email your list saying your Instagram has been compromised so followers don’t click scam links posted under your name.
- Check if your account is linked to Facebook. If so, you can sometimes recover access or at least confirm ownership through Facebook’s own security tools, which is one reason it’s worth understanding how to recover a hacked Facebook account even if Instagram is your main platform, since the two are tied together through Meta’s shared login system.
- Do not pay anyone on Fiverr, Reddit, or Telegram who claims they can “get your account back for £200.” This is one of the fastest-growing scams around Instagram recovery right now. They either take the money and vanish or they’re the ones who hacked you in the first place, running a fake recovery service to extract more from you.
- Screenshot everything: your last known posts, follower count, bio, and any DMs from the hacker if you have them, before the trail goes cold.
The uncomfortable truth about when to stop trying
Here’s the part almost nobody wants to say plainly: not every hacked account comes back, and chasing one for months is often the wrong use of your time. I’ve seen business owners spend six, seven, eight months resubmitting the same form, refreshing their email every morning, effectively frozen in place while their actual marketing sits untouched. If you’ve reported it correctly, done the video verification, linked Facebook, and heard nothing after three to four weeks, the statistical likelihood of recovery drops sharply. At that point the better move, financially and mentally, is to open a new account and rebuild with intent, rather than staying stuck hoping for an email that may never come.
Rebuilding isn’t starting from zero in the way it feels. You keep your email list, your website traffic, your Google reviews, your LinkedIn network, your Facebook page. Instagram is one channel, not the whole business. I say this as someone who built a following of close to 300,000 across platforms over fifteen years: no single platform owns your audience, and treating Instagram as irreplaceable is exactly the trap that keeps people stuck mourning an account instead of growing a new one.
Turning your Facebook and Messenger connections into a safety net
Because Instagram and Facebook share infrastructure, one of the most practical things you can do before anything ever goes wrong is strengthen the Facebook side of your presence. If your Instagram business account is linked to a Facebook Page, you get an extra recovery route and an extra layer of two-factor protection. It’s also worth knowing what’s true about who can see your Facebook activity, since misunderstanding your own visibility settings is often how people end up handing over credentials to phishing pages that look identical to a real login screen.
And if your business relies on direct messages for sales, which most Instagram shops do, building the same habits on Facebook Messenger gives you a backup channel that survives even if Instagram temporarily disappears. I’ve written before about Messenger tactics for business pages that move sales along, and the same customer-service discipline applies directly to DM-based Instagram selling.
Prevention that would have stopped most of this
- Turn on two-factor authentication using an authenticator app, not SMS. SMS codes can be intercepted through SIM swapping, which is how a growing number of these hacks start.
- Use a password manager and a unique password for Instagram specifically. Reused passwords from other breached sites are the single most common entry point.
- Add a recovery email that isn’t your main personal or business email, so if one gets compromised the other still works.
- Never click “you’ve been reported for copyright violation, verify here” links in DMs, even from accounts that look like real brands. This exact phishing message is behind a huge share of the hacks I’ve seen this year.
- Log out of Instagram on shared or borrowed devices every single time.
Frequently asked questions
How long does Instagram account recovery usually take?
Most successful recoveries happen within 24 to 72 hours of submitting the hacked account report and completing video verification if requested; cases that drag past three to four weeks without any response rarely resolve after that point.
Can you recover an Instagram account without access to the original email or phone number?
Yes, through the video selfie verification process, which checks that you match the account’s photos rather than relying only on email or phone access, though it isn’t available for every account and can take longer to trigger.
Is it worth paying someone to recover a hacked Instagram account?
No. There is no legitimate paid third-party recovery service for personal Instagram accounts; anyone charging for guaranteed recovery outside Instagram’s own official support and Meta Verified subscription is almost certainly running a scam.
What should you do if your business relies on the hacked Instagram account?
Report it as hacked immediately, warn your audience through email or other social channels so they don’t fall for scam posts under your name, and start rebuilding in parallel rather than pausing your marketing while you wait for a response.
Official documentation
Related reading: How to Recover a Deleted Instagram Account After a Year and LinkedIn Account Banned or Restricted? Here’s Your Ultimate Recovery Guide.
Still stuck? Try Instagram fixes, settings and how-tos.
