The short version: Instagram asks for ID verification when its systems flag your account as possibly fake, possibly underage, possibly run by someone other than the name on the profile, or possibly involved in a mass reporting attack. It is not personal, it is not usually because you did anything wrong, and in most cases it is resolved within 48 hours if you submit exactly what is asked and nothing extra.
The four real triggers, not the vague “security” line Instagram gives you
Instagram’s own help pages say something like “we ask for ID to help keep the community safe.” True, but useless if you’re staring at a locked account at 11pm wondering if you’ve lost three years of content. In my experience helping clients through this, and from going through it myself once, there are really only four situations that trigger the request.
- Age flags. Meta runs an age estimation system (built partly on tech from the identity company Yoti) that scans behaviour signals such as birthday messages received, the language used in captions, and how the account interacts with age-restricted content. If it thinks you’re under 18 but your profile says otherwise, it asks for ID or a video selfie to prove your real age.
- Suspicious login or device patterns. Logging in from a new country, a new device, and a VPN all in the same week is basically catnip for the fraud detection model. It doesn’t know it’s you on holiday in Portugal, it just sees three red flags stacked together.
- Impersonation or duplicate name reports. If several people report your account as “pretending to be someone,” or another account with a similar name and photo already exists, Instagram wants proof you’re the real person behind the handle.
- Sudden account behaviour changes. A big follower spike, a burst of DMs sent in a short window, or posting patterns that look automated (which, ironically, happens to real small businesses using scheduling tools too aggressively) can trip the same wire as a bot farm.
What happened when it happened to me
In March 2025 I logged into my main account from a hotel Wi-Fi in Tel Aviv, on a laptop I don’t usually use, having just changed my password the week before after a phishing scare. Three flags in one login. Instagram locked me out mid-session and asked for a video selfie: turn your head left, turn it right, blink. Thirty seconds of footage, nothing else required at that stage.
It took Instagram 6 hours to clear it that time. A client of mine, Sarah, who runs a jewellery brand with around 40,000 followers, wasn’t so lucky. Hers escalated straight to a photo ID request after a competitor’s followers mass reported her account as “fake,” something that still happens more than people admit in competitive niches. She uploaded a passport photo through the in-app form, and it took 4 days, not the “24 to 48 hours” the app promised. Her ad campaigns paused, her DMs went unanswered, and she lost roughly 1,200 followers in that window from people assuming the account had been hacked or shut down for good, the kind of confusion covered in more detail in why Instagram accounts get deactivated.
What Instagram does with the ID once you send it
Here’s the part most articles skip. Instagram says the ID is deleted after 30 days once your identity is confirmed. What they don’t advertise clearly is that the image is processed by a third-party verification vendor first, not reviewed by a human Meta employee sitting in Dublin, unless the automated check fails twice. That’s why a blurry photo, a torn corner, or a passport photo taken at an angle gets rejected instantly and asks you to resubmit, sometimes twice, before it escalates to a person. If you’re in a hurry, use natural daylight, lay the ID flat, and photograph it straight on, not at an angle to avoid glare. That one change cuts rejection rates noticeably, based on what I’ve seen with clients redoing the process.
The uncomfortable bit nobody likes saying out loud: Instagram is not obligated to tell you which of the four triggers caused your specific flag. You get one generic message. That opacity is deliberate, because if Meta told everyone exactly what trips the system, bot networks and fake account farms would simply engineer around it within a week. So yes, it’s frustrating that a real 53-year-old business owner and a fake account run from a server farm in Vietnam get the identical vague notice. That’s the trade-off of the system working at scale rather than working fairly for every individual case.
Age verification specifically: why this got more aggressive in 2026
If you’re under 18, or Instagram thinks you might be, the ID request is tied to a specific policy push. Meta expanded its age verification rollout across the UK and EU through 2025 into 2026 in response to the UK’s Online Safety Act, which requires platforms to make “” (their word, not mine) attempts to confirm user age for anyone accessing age-restricted features, sensitive content settings, or messaging permissions. This is separate from the fraud-detection ID request. If your account gets flagged for age reasons, you’ll usually see wording about “confirming your age” rather than “confirming your identity,” and Instagram will accept either a government ID or a video selfie run through its age estimation model, which analyses facial features to guess an age range rather than reading a date of birth off a document.
Step by step: what to do when the request appears
- Read the exact wording of the request first. “Confirm your identity” and “confirm your age” trigger different review queues, and sending the wrong document type (a birth certificate instead of photo ID, for example) adds days.
- Choose the video selfie option if it’s offered instead of document upload. It’s processed faster in most cases I’ve seen, often within an hour, because it doesn’t require a manual document check.
- If document upload is required, use a passport or driving licence, not a work ID or student card, both of which get rejected automatically because Instagram’s system only accepts government-issued IDs.
- Submit in good lighting, flat, no filters, no cropping software, no screenshots of a photo, an actual fresh photo taken through the in-app camera when the option exists.
- Check the email tied to your account, not just app notifications. Meta sometimes sends the review outcome to your registered email address and it lands in spam more often than it should.
- If it’s rejected, don’t resubmit the same file. Take a new photo. Resubmitting the identical rejected image just triggers the same automated rejection loop.
How long it takes, realistically
Meta’s own copy says “usually within 48 hours.” In practice, based on what I’ve tracked across my own account and roughly a dozen client cases over the past two years: straightforward video selfie checks clear in under 6 hours about half the time. Document uploads for suspected fake accounts or impersonation reports take 2 to 5 days on average. Appeals that get escalated past the automated system, meaning a human looks at it, can stretch to 30 days, and Meta will tell you this upfront if your case reaches that stage. If you’re running a business account with active ad spend, the financial pressure of a multi-day lock is real, which is exactly why prevention matters more than the fix.
What triggers the request without you doing anything wrong
This is the part that makes people furious, and fairly so. You can get flagged purely because of who is looking at your content, not what you’re posting. A sudden wave of profile views or story views from a coordinated group, sometimes triggered by the exact kind of anonymous viewing behaviour discussed in whether the Instagram story viewer feature is really anonymous, can look like bot activity to Instagram’s systems even though you did nothing. Similarly, a green icon appearing on stories, which some users mistake for a security flag, is unrelated to identity checks entirely, it’s a live broadcast indicator, explained in why Instagram shows a green icon on some stories, but the confusion between the two often sends people down the wrong troubleshooting path.
Business accounts and the extra layer of pain
If you run a business or creator account with a linked WhatsApp Business number, Meta Business Suite, or Facebook Page, an ID lock on Instagram can ripple sideways. I’ve seen it happen where a flagged Instagram account froze ad manager access, and separately caused a linked WhatsApp Business account to display messaging restrictions, the kind covered in why WhatsApp Business sometimes says your account can no longer be used. The systems aren’t fully separate even though Meta presents them as independent apps, and a fraud flag on one identity check can shadow into the others because they all sit on the same underlying Meta account graph.
Preventing it in the first place
- Don’t log in from a brand new device and a new location in the same session if you can help it. Log in from your normal phone first, then move to the new device a day later.
- Keep your profile name and your ID name reasonably close. A drastic rebrand of your handle plus a profile photo swap in the same week reads as suspicious to the system, even for legitimate business rebrands.
- Avoid third-party growth or automation tools that mimic bot-like posting frequency, dozens of comments or follows within minutes is a classic trigger.
- If your account has ever been the target of a mass-reporting campaign, screenshot the reports if you can and keep them, they help if you need to appeal a wrongful disable, similar to the process outlined in why Instagram accounts get disabled and how to stop it happening.
What if you simply refuse to send ID
You can decline. Instagram won’t force you. But the account stays locked, sometimes permanently, until the review completes one way or another. There is no workaround, no “wait it out” option that restores access without either submitting what’s asked or losing the account entirely. I’ve had two clients try to wait it out on principle, both lost the accounts after 30 days of inactivity on the locked profile. If the account matters to your business, submit what’s asked, even if the process feels invasive. The alternative is worse.
Frequently asked questions
Does Instagram delete my ID after verification?
Meta states that ID documents are deleted within 30 days of successful verification, and the images are stored encrypted and separately from your regular account data during that window, but Instagram does not publish an independent audit confirming exact deletion timelines.
Can I use a passport photo I already have saved on my phone?
Only if it’s a genuine, unedited photo taken recently in good lighting, screenshots, scans, or heavily compressed images usually get flagged and rejected automatically by the verification system before a human ever sees it.
Why did Instagram ask for ID even though my account is old and active?
Account age and activity history don’t exempt you. A single new-device login, a mass reporting spike, or an age estimation flag can trigger the request regardless of how long the account has existed or how consistently you’ve posted.
Will my business account keep running while I’m locked out for verification?
No, scheduled posts stop, ad campaigns pause, and DMs go unanswered until the account is unlocked, which is why prevention steps like avoiding sudden device and location changes matter more for business accounts than personal ones.
