Instagram Hacked? How to Recover Your Account and Stop the Scams

You try to log in to Instagram and it says your password is wrong, even though you typed it carefully. You check your inbox and there's an email saying the address on your account has changed. Or a friend texts you to ask since when you've been into bitcoin, because your stories show some so-called expert who supposedly made you £2,000 in an afternoon. Having your Instagram hacked is horrible, especially when you see your face and name being used to fool the people you care about, but there's an official way back, and in most cases you can do it without paying anyone.

Here's how to recover your Instagram using Instagram's own process, what to do if the email and phone number were changed, how to stop the scams being posted from your profile and how to report it. And if it hasn't happened to you, the last part covers the tricks hackers use to take over accounts and how to lock yours down in five minutes.

In this article

1. How to tell if your Instagram has been hacked
2. Recover your account with the official process
3. If the hacker changed your email and phone number
4. When your account is used for crypto or investment scams
5. Fake profiles and impersonation on Facebook and Instagram
6. Report it and warn your followers
7. If someone lost money
8. Imagine this happens to you
9. How to protect your Instagram so it doesn't happen
10. Beware of anyone promising to recover your account
11. If you or your followers lost money

How to tell if your Instagram has been hacked

Sometimes it's obvious, because you're locked out and can't get back in. Other times it's quieter, and you only find out when someone asks about something you never posted. These are the most common signs:

• Instagram won't accept your password, or asks for a two-factor code you never set up.
• You get an email from Instagram saying your email, phone number or password was changed, and it wasn't you.
• Stories or posts you didn't upload appear on your profile, usually about crypto investments, giveaways or unbelievable discounts.
• Your followers get DMs from you asking for money, asking them to vote in a contest or to send you a code.
• You see logins from cities or devices you don't recognise.

It's almost never a movie-style hacker guessing your password. Usually you were tricked into handing it over, or into passing on a code. It might be a message from a friend asking you to help them win a contest, with a voting link that's actually a page copying Instagram's login. It might be an email warning that your account will be deleted for copyright infringement, or offering you a verified badge. Or a contact saying a code meant for them was sent to you by mistake and asking you to forward it, when it's really the code to get into your account. The nastiest part is that these messages often come from someone you trust, whose account has also been hacked.

Recover your account with the official process

What you need to do depends on whether you can still get in or you've already been locked out. Either way, move quickly, because the hacker will try to change every recovery detail as fast as they can.

If you can still log in

1. Change your password to a new one you don't use anywhere else.
2. Log out of sessions you don't recognise. In Accounts Center, under Password and security, you'll find where you're logged in. Close anything that isn't yours.
3. Check the email and phone number on the account. If the hacker added theirs, replace them with yours.
4. Turn on two-factor authentication, ideally with an authentication app rather than text messages. There's more on why below.

And check your email account too. If you used the same password for your email and Instagram, they may well have got into both, and whoever controls your email can take your account again whenever they like.

If you've been locked out

1. Find the email from Instagram. When someone changes your account email, Instagram sends a message from [email protected] to your original address. According to Instagram's Help Center, that email includes a link to secure your account and undo the change. Check your spam folder too.
2. Request a login link or code. On the login screen, tap "Forgot password?", enter your username, email or phone number and ask for a login link. This works if you still have access to the account's email or phone.
3. Go to instagram.com/hacked in your phone or computer browser. It's the official page for these cases: you choose that you think you've been hacked and it guides you through the steps that fit your situation.

One important tip here: don't rush to open a new account and don't delete anything. You need the original account to still exist so you can recover it and, if needed, prove what happened.

If the hacker changed your email and phone number

This is the most stressful situation, because it feels like they've taken every key, but Instagram has a route built for exactly this.

First, look at your old inbox again. Instagram explains that when the email is changed, it sends two messages: one to the new address to approve the change and one to the original address to reverse it. If you find that second email, use it to put your address back on the account.

If that's no longer possible, go to instagram.com/hacked and follow the steps for when you can't access your email or phone. You'll be asked for a secure email address, which must be one only you can open, because that's where the reply will arrive. The UK's National Cyber Security Centre has a useful general walkthrough on recovering a hacked account if you want to check you haven't missed anything.

If the account contains photos of you, Instagram may ask for a video selfie where you turn your head in different directions. It's not posted anywhere: it's used to confirm you're a real person and that the account is yours, because photos and documents can be edited. Instagram explains on its video selfie page that you won't have access to the account while they review it, and that the result arrives at that secure email with a link to set a new password. If it doesn't pass the first time, you may be able to submit it again.

You may have to wait a little for an answer. It's maddening, we know, but it's the route that works. In the meantime, use that time to warn your followers, which is what prevents the most harm.

When your account is used for crypto or investment scams

This is what happens most often with stolen accounts. The scammer doesn't want your photos, they want your credibility. They post stories where "you" say you invested £200 with an expert who turned it into £2,000, show screenshots of fake payouts and encourage your followers to message them. Because it's on your profile, plenty of people believe it, and a classic investment scam begins: a small first payment, profits that only exist on a fake website and, when they try to withdraw, fees and "taxes" that never end.

If this is happening with your account:

• Take screenshots of the stories, posts and messages, showing your username and the date.
• Warn people on another channel that your account was stolen and that nobody should invest or pay anything that comes from your profile.
• Ask friends to report the posts inside Instagram as fraud or a scam so the platform takes them down.

And if someone has already fallen for it, don't blame yourself. You're a victim too. What that person needs to do is in the section below, and if they paid in crypto, they'll find every step in can stolen crypto be recovered?.

Fake profiles and impersonation on Facebook and Instagram

Sometimes they don't steal your account at all. Instead they create a copy, with your photo, your name and an almost identical username, and start messaging your followers. That's impersonation, and it can be stopped too.

Instagram lets you report an account pretending to be you from the app, from a browser or, if you don't have an account or can't log in, through a form. Facebook works the same way, with its option to report a profile pretending to be you. Ask your contacts to report the fake profile as well, and not to reply to it or pay it anything.

If it's your Facebook account that was stolen, the route is similar to Instagram's, through Facebook's page to recover a hacked account. And if you're worried your details could be used for more than a fake profile, like opening accounts or taking out loans in your name, we cover that in identity theft: what to do.

Report it and warn your followers

Warning people comes first, even before you get the account back. If you have another account, post a warning from it; if not, ask two or three friends to share it in their stories and text the people closest to you. Something this simple works:

"My Instagram has been hacked. If I message you asking for money, a code or talking about investments, it isn't me. Don't pay anything and let me know."

Then report it. Getting into someone else's account without permission is a crime: in the UK it falls under the Computer Misuse Act 1990, and in the US under the Computer Fraud and Abuse Act, and using your profile to take money from your followers is fraud. In England, Wales and Northern Ireland you can report to Report Fraud, in Scotland to Police Scotland on 101, and in the US to the FTC at ReportFraud.ftc.gov and to the FBI's IC3. Keep the screenshots, your username, Instagram's emails about the changes and any receipts. The FTC also has a clear page on recovering a hacked social media account. We explain the whole process in how to report a scam.

If someone lost money

Time matters a lot here. Whoever paid, whether a follower or you, should do this as soon as possible:

1. Call their bank on its official number, say it's fraud and ask them to try to stop or recall the transfer, card payment or app payment.
2. Keep the receipts and screenshots of the conversation, with the account, website or crypto address the money went to.
3. Report it quickly, because a police report helps the bank and the authorities act on the receiving account.
4. Complain to the bank in writing, explaining how it happened.

Having paid because you were tricked doesn't mean the money is gone. If the bank is told quickly, it can often be held before it moves, and a lawyer can trace it and claim it back. In the UK, many bank transfer scams are also covered by the APP fraud reimbursement rules. We go through every option in how to get money back after being scammed.

Imagine this happens to you

Imagine a classmate messages you on Instagram: she's in the final of a photography contest and needs one more vote, can you help? You open the link, it asks you to log in "to vote" and you enter your username and password. That night you can't get into your account, your email and phone number are no longer on it, and the next day your stories are announcing that you made £1,500 investing with someone called Mark, who you're meant to message on Telegram. Your cousin sends him £300.

In a case like that, the most useful thing would be to look for the [email protected] email to reverse the change and, if it isn't there, go to instagram.com/hacked and follow the process with a secure email and the video selfie. At the same time, friends would post a warning, and your cousin would call his bank that same day to try to stop the payment and report it with the receipt. You'd report the account theft as well. It's only an example, but this is how many of these cases start, and acting in the first few hours helps enormously.

How to protect your Instagram so it doesn't happen

If it hasn't happened to you yet, these habits shut the door on most account takeovers:

• Turn on two-factor authentication in Accounts Center, under Password and security. Meta explains how on its two-factor authentication page. An authentication app is better than text messages, and keep your backup codes somewhere safe: they're your spare key if you lose your phone.
• Never share a code you receive by text or email, not even with a friend. If they ask for it "by mistake", call them first, because their account may no longer be theirs.
• Don't log in from a link, whether it's for a vote, a giveaway or to "verify" your account. If in doubt, open the app yourself.
• Check emails that claim to be from Instagram. In the app, under login and security in Accounts Center, you can see the recent emails Instagram has really sent you. If the one you got isn't there, it's fake. And remember Instagram doesn't DM you about your account security.
• Use different passwords for Instagram and your email, and protect your email with two-step verification too.
• Check where you're logged in from time to time and close anything you don't use.

If you're also noticing strange things on your phone, like apps you never installed, the problem may not be limited to Instagram. We explain how to check in how to tell if your phone is hacked.

Beware of anyone promising to recover your account

As soon as you mention online that your Instagram was stolen, so-called hackers, "recovery experts" or profiles claiming to work for Meta start messaging you, promising to get your account back within hours for an upfront fee. Don't let the rush get to you: recovering your account is free, it's done through the official process and no outsider has a secret back door around it. Instagram doesn't have a public phone line for this either, so if someone gives you one, be suspicious. Most of the time they vanish after you pay, or ask for your details to take over more accounts. We explain how to spot them in crypto recovery scams.

If you or your followers lost money

Getting your account back and seeing your name used to fool people who care about you hurts, but it isn't the end of the story. If someone paid, if there were charges on your bank account or if the hack went beyond Instagram, it's worth having a professional look at it.

We are lawyers and expert investigators specialising in online scams, cryptocurrency and cybercrime, and every case is handled by a lawyer or an expert investigator. We document how your account was used so it's on record, trace the money to the receiving account or wallet, prepare the claim to the bank and ask the authorities for whatever is needed to try to freeze the funds. In many cases the money is recovered, especially if you act fast. At Kironic we do everything we can to recover your money: send us your case and we'll look at it together.