Instagram hacker turned on two-factor authentication

When a hacker turned on two-factor authentication on your Instagram account, the usual "forgot password" fix stops working. You can reset the password and still hit a screen asking for a six-digit code that is being sent to someone else's phone. It feels like a dead end, but it is a known pattern, and Instagram's official hacked-account flow is built to handle accounts where the security details have been changed by someone else.

This guide explains why hackers switch on their own 2FA, the two official steps to try first, how identity verification works, what to do when the codes go to the hacker's device, and how to lock the account down once it is yours again. If you would rather hand the case over, our Instagram 2FA lockout service covers this situation for businesses and creators.

Why a hacker turned on two-factor authentication (their own 2FA)

Instagram's page on securing your account with two-factor authentication explains that 2FA requires a code whenever there is a login attempt from a device Instagram does not recognise. That protection works for whoever set it up. When the hacker turns it on with their own phone number, WhatsApp or authentication app, every login from your devices that Instagram does not already trust asks for a code only they can see.

It is a common step after a takeover because it blocks the simplest recovery path. Hackers often pair it with other changes:

• changing the email address and phone number on the account
• changing the password
• generating new backup codes, which Instagram's backup codes page says can only be viewed or replaced while logged in
• adding their own devices as trusted devices

Instagram hacked two factor authentication cases look harder than they are. The official flow does not rely on you receiving the code. It relies on proving that you are the owner.

Step 1: the security email 'revert' link

Start with your original inbox, not with Instagram.

Instagram's page on what to do if your account email was changed says that when the email on a profile changes, Instagram sends two emails: one to the new address to allow the change and one to the original address to deny it. The one to your original address comes from security@mail.instagram.com and contains a link to reverse the email change and help secure your account. The hacked account help page describes the same message and says you may be able to undo the change by selecting secure my account.

What to do:

1. Search every folder, including spam, promotions and archive, for messages from security@mail.instagram.com.
2. Open the most recent message about an email change and use its link to reverse the change.
3. Follow the on-screen steps to reset your password.

Two cautions. First, if the hacker also changed the password and turned on 2FA, reversing the email may not be enough on its own; you may still be asked for a login code. Move on to step 2 if so. Second, hackers send fake security emails. Instagram's page on reviewing recent emails from Instagram lists the official sender domains and says Instagram never contacts you about profile security through Direct Messages. Check the sender before you click anything.

If the hacker changed both the email and the phone number, our guide on recovering Instagram when the email and phone were changed goes through that combination in more detail.

Step 2: instagram.com/hacked from a known device

Instagram's hacked-account help page says that if someone gains access to your account or you cannot log in, you should visit instagram.com/hacked on your desktop or mobile browser to secure it.

Use a phone or computer you have logged in to Instagram from before, on the same home or work network where possible. Instagram's 2FA page says the code is required when the login comes from a device Instagram does not recognise, so a familiar device gives you the best chance of a smoother check. If you are still logged in on any device, even an old tablet, do not log out of it.

On the hacked page:

1. Pick the on-screen option that best matches what happened to your account.
2. Enter your username, or the email or phone number that used to be on the account.
3. If you cannot receive a login link, follow the option to request support. Instagram's help page says you should enter a secure email address that only you can access, and that you should then receive an email with next steps.

Use a fresh email address that the hacker has never seen, and keep it for this case only. All further messages about the recovery go there.

Identity verification (video selfie, business documents)

Instagram's hacked-account page describes two kinds of check, depending on the account:

• Accounts with photos of you. You may be asked to take a video selfie, turning your head in different directions. Instagram's page on why you might be asked to upload a video selfie says this is used because photos and IDs can be digitally modified, and that you will not have access to the account while it is reviewed. If you pass, you may receive an email with a link to reset your password.
• Accounts without photos of you. Instagram says you should get an automated email from Meta's support team asking for the email address or phone number you signed up with and the type of device you used at sign-up (for example, iPhone, Android or iPad).

Instagram's help page also says the video is never visible on Instagram, is deleted within 30 days, and that if your identity could not be confirmed you can submit a new video for another review.

For business and brand accounts where the photos show products rather than a person, prepare proof that ties you to the account: the original sign-up email, receipts for any ads run from the account, business registration documents and a website that links to the profile. Instagram's flow decides what it asks for, but having this ready saves time if a later step requests it.

If 2FA codes go to the hacker's phone

This is the core problem, so it is worth being clear about what does and does not help.

• Do not keep requesting codes. They go to the hacker's number or app. Repeated requests do not reach you and can tell the hacker you are trying to get back in.
• Old backup codes may still work. If you saved backup codes before the hack, try one at the code prompt. If the hacker generated new codes, the old ones stop working.
• Check your own authenticator app. If you had set up an authentication app before the hack and the hacker added theirs alongside it, your app may still produce valid codes. Instagram's page on connecting multiple devices to two-factor authentication says up to five devices can be connected.
• If your phone number was taken over, contact your mobile carrier first. When someone moves your number to a SIM they control, Instagram text codes follow the number.
• Go back to instagram.com/hacked. When you cannot receive the code, the support request and identity verification in step 2 is the official route.

If you have tried these and are still stuck on the code screen, our page on Instagram account hacked recovery explains how we handle takeover cases, and our two-factor lockout case study shows what a 2FA recovery can look like in practice.

After recovery: lock it down (authenticator app, backup codes, sessions)

Getting back in is only half the job. The hacker's settings are still in place until you remove them. Do this in one sitting, straight after you log in.

1. Change the password to one you have never used anywhere else.
2. Reset two-factor authentication. Follow Instagram's steps in Settings > Accounts Center > Password and security > Two-factor authentication: turn off the methods the hacker added, then turn it back on with your own authentication app. Instagram's 2FA page recommends the authentication app over text messages.
3. Get new backup codes. Instagram's backup codes page explains how to get a new set, which cancels the current codes. Store them offline, away from your phone.
4. Remove unknown devices and sessions. Instagram's 2FA page says you can see login requests and remove trusted devices. Remove anything you do not recognise.
5. Check your contact details and linked accounts. The hacked-account page recommends confirming your email and phone number, checking Accounts Center for linked accounts you do not recognise, and revoking access for suspicious third-party apps.
6. For professional accounts, Instagram's page on a hacker still taking actions on a professional account explains how to find unauthorised people in Meta Business Suite and remove them.

Our full checklist on how to secure your account after recovery covers the rest, including email security and spotting phishing.

When professional help makes sense

Many people get back in with the security email or instagram.com/hacked and a video selfie. If the hacked flow gives you clear steps and you can complete them, do it yourself first; it is free and it is the route Meta reviews.

Outside help is worth considering when the account is a business or creator account that earns money, the verification keeps failing or loops, the account has no photos of you, or several things were changed at once and you are not sure which route applies. Shilder is an independent service. We prepare the case and file through the same official Meta channels described above, and we cannot override Meta's decisions. See our Instagram 2FA lockout service and pricing before deciding.