Instagram hacked and the email and phone number changed — how to get it back

The worst version of an Instagram hack is the one where you cannot even get a reset link, because the hacker has already swapped the email address and phone number for their own. Every "Forgot password?" request now goes to them.

If the hacker also switched on two-factor authentication, see Instagram hacker turned on two-factor authentication for the extra steps.

This is still recoverable in many cases. Instagram has a specific route for it, and it does not depend on the contact details the hacker changed. This guide walks through it in order: the security email, the official hacked-account flow, identity verification and the video selfie, what to try when the flow keeps failing, and how to lock the account down once you are back in.

Step 1: look for the security email in your original inbox

Before anything else, open the email account that used to be on your Instagram.

According to Instagram's help article on email changes, when the email on an account is changed, Instagram sends a message to both the original and the new address. The message to the original address comes from security@mail.instagram.com and includes a link to reverse the change and secure the account.

• Search your inbox, spam and archive for security@mail.instagram.com.
• Open the most recent message about an email change and use its link to undo it.
• If the phone number was also changed, there may be a separate notice; work through the newest messages first.

If that works, you will be prompted to reset the password. Do it immediately and skip to the section on securing the account.

Step 2: the official instagram.com/hacked flow

If the security email is missing, expired or the link no longer works, use Instagram's hacked-account page. Instagram's article If you think your Instagram profile has been hacked describes the route:

1. Try a login link first. On the login screen, tap Forgot password?, enter your username and request a login link. If the hacker changed both contact details, this will usually go to them, but it costs nothing to try, and occasionally one of your old details is still attached.
2. Go to instagram.com/hacked in a mobile or desktop browser. Choose the option that says your account was hacked and enter your username.
3. Request support on a mobile device. When you are asked for contact details, give an email address only you can access. Do not use the old address if you think the hacker has access to it. Instagram sends next steps to this address.
4. Verify your identity. What happens next depends on the account (see below).

Instagram's Hacked Instagram Account page collects the related help articles if you need them.

Step 3: identity verification

Once you have requested support, Instagram asks you to prove the account is yours. Its help page describes two versions:

• Accounts without photos of you. You get an automated email from Meta Support asking for the email address or phone number you originally signed up with, and the type of device you used when you signed up (for example iPhone, Android or iPad). Answer accurately; guessing makes it worse.
• Accounts with photos of you. You are asked to record a video selfie.

If you have identity verification questions or you are not sure which details you signed up with, check old emails for "Welcome to Instagram" messages; they often show the original address and approximate date.

How the video selfie check works

Meta's help page on video selfies explains the reasoning: photos and IDs can be digitally altered, so Instagram asks for a short video of you turning your head in different directions to confirm you are a real person.

What to expect, based on Meta's own pages:

• The check: you record yourself turning your head as instructed. Meta's announcement on recovery and scams says that, where facial recognition is used, the selfie is compared with the profile pictures on the account.
• During review: you cannot access the account until Instagram has confirmed it is you.
• If it passes: you receive an email at the secure address you provided with a link to reset your password.
• Privacy: Instagram says the video is never visible on Instagram and is deleted within 30 days. Meta says facial data generated for the comparison is deleted immediately afterwards, match or not.
• Availability: Meta has described the facial recognition option as optional and rolled out by region, so what you see can differ by country.

If the video selfie fails

Meta's pages say that if your identity could not be confirmed, you will get an email and may be able to submit a new video. Before you retry:

• Use bright, even light from the front. No window behind you.
• Remove anything covering your face: sunglasses, hat, mask, heavy filters.
• Hold the phone at eye level and keep your whole face in frame as you turn.
• If the profile photos are old, it can help to look as close to them as reasonably possible (glasses on or off, for example).
• If the account's profile photos were never of your face, the comparison has nothing to match; in that case the details-based route is the one to push.

If you decline the video selfie, Meta's help page warns you may not be able to log back in.

When recovery "isn't working"

The most common complaint is a loop: you submit, get an email, and end up back at the start. Things worth trying, one at a time:

• Use a familiar device and network. Try from a phone or computer you have logged into Instagram from before, on your usual Wi-Fi. Facebook's hacked account guidance gives the same advice for Facebook, and a recognised device helps recovery look less like another takeover attempt.
• Switch device if one keeps failing. If the app errors out, try instagram.com/hacked in a mobile browser instead, or the other way round.
• Go back to the original email. Re-check for security@mail.instagram.com messages you missed, including older ones from before the hacker changed the phone number.
• Check Accounts Center from a linked account. If your Instagram was linked to a Facebook account or another Instagram account in Accounts Center, and you still have access to that one, check whether the hacked account still shows there. Instagram's help pages also advise removing linked accounts you do not recognise once you are back in.
• Use a fresh secure email. If you suspect your email account was also compromised, secure that first. Instagram notes it cannot help you regain access to your email provider; you need to contact the email provider directly.
• Do not spam requests. Submit once, wait for the reply, respond to it fully. Repeated parallel requests can slow things down.

Secure the account the moment you are back in

Instagram's hacked-account article lists the essentials: change your password, turn on two-factor authentication, confirm the email and phone number in settings are yours, remove linked accounts you do not recognise in Accounts Center, and revoke access for suspicious third-party apps.

Our checklist on how to secure your account after recovery covers each of these in order, plus the steps people usually forget, such as signing out other sessions and checking who has access to a professional account.

When professional help makes sense

If the security email link works, or the video selfie passes, you do not need anyone's help. Most personal accounts should go through the steps above themselves first.

It is worth getting help when the official flow has stalled for a business or creator account: the identity checks keep failing, the account had no photos of you to match, the hacker also took over linked ad accounts or a Business Manager, or every request lands back at the start. In those cases our Instagram hacked account recovery service prepares and files the case through Meta's official routes. We never ask for your password, and fees are held in escrow under our protected payment terms. See pricing for details, and our guide on whether recovery services are legit for how to judge any provider, including us.