GUIDES · September 15, 2026 · 7 min read
On this page
Act in this order: change the password if you still can, secure the email account first if you cannot, log out every other session, then use Instagram's official recovery at
instagram.com/hacked. Warn your contacts early — a stolen account is used to scam the people who trust it.
Speed matters more than anything else. Most takeovers follow a script: change the password, change the email, enable 2FA against you, then message your followers. Every step you beat them to is one they have to undo.
If you can still log in
- Change your password immediately and choose to log out of all other devices.
- Check Where you're logged in and end any session you do not recognise.
- Open your email and confirm the address on the account is still yours; check for a "your email was changed" message with a revert link.
- Turn on two-factor authentication with an authenticator app and save the backup codes.
- Revoke third-party apps. One of them may be how this happened.
If you are locked out
Go to instagram.com/hacked and follow the account-recovery flow, which can verify you by a code to a still-controlled email or phone, or by a video selfie for accounts with photos of you. Use the same device and network you normally use — recovery weighs familiar signals heavily. If the attacker changed the email address, check your old inbox for Instagram's notification of that change: it contains a link that reverses it, and it works for a limited window.
Keep a copy of what is at risk
Photos on your own disk survive any takeover — the Stelvo posts downloader saves them locally.
Why the email comes first
Because whoever controls the mailbox controls every reset that follows. Recovering Instagram while the attacker still reads your email means they simply reset it again an hour later. If both were compromised, fix the email account — new password, new 2FA, check the forwarding rules and recovery address the attacker may have added — and only then start the Instagram flow.
Warn people immediately
A stolen account's value is the trust it carries. Within hours it will be messaging your followers with a crypto pitch, a "vote for me" link, or a request for a login code that hijacks their account too. Post from another platform, message close contacts directly, and tell them explicitly not to act on anything from your handle. The patterns they will see are catalogued in how to spot Instagram DM scams.
What not to do
| Do not | Why |
|---|---|
| Pay a "recovery hacker" | They take payment and disappear. There is no back door |
| Use a "support" account that DMs you | Instagram never contacts you that way |
| Create a duplicate account first | It can complicate verification of the original |
| Spam the recovery form | Repeated submissions do not speed anything up |
After you get it back
Assume everything was read. Change the password again, re-enable 2FA with fresh backup codes, remove any device or app the attacker added, and check your DMs for what was sent in your name. Check whether the profile email, phone number or linked Facebook were altered. Then close the door properly with the full pass in how to secure your Instagram account. If the account was disabled rather than stolen, that is a different process — see how to appeal an Instagram ban.
FAQ
Where do I start recovery?
At instagram.com/hacked, from your usual device and network.
The attacker changed my email — is it lost?
No. Check your old inbox for the change notice and its revert link.
Does Instagram have live support?
Not for most users. Anyone offering it in a DM is a scammer.
How long does recovery take?
Hours to weeks, depending on the verification path.
Should I tell my followers?
Yes, immediately — they are the next targets.
the Stelvo Team
The people behind Stelvo — a privacy-first team writing honest guides on anonymous Instagram viewing, downloads, and staying invisible online.