How to recover a hacked Instagram account

If you’re reading this, your Instagram is probably already in someone else’s hands. Maybe the email and phone number on the account were changed. Maybe two-factor was switched to a number you don’t recognize. Maybe you got the “suspicious login” email an hour too late.

This guide walks through what to actually do — in order, without the noise. We handle these cases every day, so the order matters: the wrong move early (like resetting from the hacker’s number) can make recovery harder.

Step 1 — Stop the bleeding

Before anything else, lock down the other accounts the attacker could touch from your Instagram email.

• Change your email password (the one used to sign up for Instagram). Use a password manager.
• Enable 2FA on the email account — preferably with an authenticator app, not SMS.
• Check for forwarding rules in your email — attackers often add rules that auto-forward password-reset codes.
• Review recent activity in your email account: any logins you don’t recognize, sign them out remotely.

Step 2 — Try Instagram’s recovery flow first

Instagram’s own “Need more help?” option, accessed from a login screen, is the fastest path when it works. From a device the account has previously logged in on:

1. Open Instagram, tap Get help signing in (or Forgot password?).
2. Enter your username, email, or phone — whichever the attacker hasn’t changed yet.
3. Tap Need more help? at the bottom.
4. Follow the prompts to verify yourself with a video selfie or photo ID.

This route works best within the first 72 hours, on a device that has previously logged into the account, with reasonably clean session history (no constant logouts, no suspicious activity flags).

Step 3 — If that fails, use the identity verification form

Instagram has a public form for hacked-account reports at instagram.com/hacked. Use it when:

• The attacker has changed the email and phone.
• You can’t get the in-app recovery to recognize you.
• The account previously had a profile photo of you (this matters — see below).

The form asks for:

• The email and phone originally used at signup.
• A photo of yourself holding a handwritten code Instagram emails you.
• Government-issued ID if your account doesn’t have a clear photo of you.

Step 4 — Submit from a clean device

This part matters more than people realize. If you submit recovery requests from:

• A device the account has never logged in from
• An IP address from a different country than usual
• A browser with no Instagram cookie history

…the request gets flagged as suspicious. Instagram’s recovery system weights these signals heavily.

If possible:

• Submit from the phone you originally used.
• Use the same Wi-Fi network the account used most.
• Avoid VPNs during the recovery process.

Step 5 — Wait, but document

Once you’ve submitted:

• Don’t submit again. Multiple submissions create duplicate cases that get auto-closed.
• Don’t change anything. No new password resets, no email changes, no profile edits.
• Document everything. Screenshot every confirmation email, every reference number, every form submission. You’ll need them if you escalate.

Typical response times:

When self-recovery isn’t working

If you’ve submitted twice with no response, or you keep getting form rejections, the case usually needs targeted appeal work — the wrong appeal type submitted to the wrong form is the most common reason cases stall.

This is what Shilder does: a recovery expert looks at what was already submitted, identifies why it stalled, and prepares the correct submission. You can start a case here — review is free, you only pay if we accept it, and you get a full refund if recovery fails.

What to do once you have your account back

The moment you’re back in:

1. Change the password to something long and unique.
2. Enable 2FA with an authenticator app (not SMS — SMS is what got you here).
3. Review login activity in Settings → Security. Sign out all devices except yours.
4. Remove unfamiliar email/phone the attacker may have added as recovery options.
5. Check connected apps and revoke anything you don’t recognize.

Common questions

Will Instagram tell me what happened? Sometimes. The notification you get back usually says “account access restored” and not much more. You’ll have to piece together the timeline from the login activity log.

Should I report the attacker to Meta? After your account is back, yes — through Settings → Help → Report a Problem. It’s a long shot but it adds a data point to their pattern-detection.

Is paying a “Telegram recovery guy” ever a good idea? No. There is no legitimate insider-recovery service. Anyone claiming Meta connections is lying. The people who say they’ve got someone inside have either (a) gotten lucky resubmitting your forms or (b) taken your money and disappeared.

If you’re stuck, open a case. Our expert reviews are free, and if we don’t think recovery is realistic we’ll tell you up front — no fee.