To recover an Instagram account when you’ve lost access to the email and phone number, start at instagram.com/hacked, request a login link or security code, and if that fails, look for the Instagram email with a “Revert this change” link or complete a video selfie verification. This guide works whether you were hacked or simply changed numbers and abandoned an old email. Recovery is free and only happens through Instagram’s own channels.
Before you start: what to know
Three rules save a lot of frustration:
- Submit one request. Sending several from different devices won’t speed things up and can look like bot activity, according to ESET.
- Don’t pay anyone. Paid “recovery” services and support phone numbers found in ads or comments are scams. Instagram doesn’t charge to give an account back.
- Never share your password or codes. Instagram won’t ask for your password by email or direct message. Anyone who does is trying to take over your account.
As for timing, if you still have your email or phone, recovery can take minutes. When extra checks kick in, it can take hours or days.
Step by step: how to recover the account
- Open the recovery page. Go to instagram.com/hacked, or tap “Forgot password?” on the app’s login screen.
- Enter your username, email or phone number and request a login link or security code.
- Check that the code arrived. Look in your spam folder too, and make sure you typed the email or number correctly. If the account had a different email on file, the code went there.
- If you can no longer reach that email and phone, search your inbox for the email Instagram sent when someone changed your account details. It includes a “Revert this change” link. Click it right away. According to ESET, Instagram can also verify you regardless of the contact details an attacker set.
- If there’s no link or it doesn’t work, contact Instagram support. You may be asked to verify your identity, usually with a video selfie that Instagram matches against the photos on your account. ESET’s article doesn’t describe other options if this step also fails.
- If the account is linked to Facebook, tap “Log in with Facebook,” then reset your password. This only works if the accounts are linked and your Facebook account is still secure. If it was hacked too, recover Facebook first.
- If the account was disabled, follow the on-screen instructions at login to request a review. Approval isn’t guaranteed and response times vary. Avoid repeated or misleading appeals.
How do you know your account was hacked?
A few signs show up often: a “wrong password” message even though you’re sure it’s right, logins from places you don’t know, changes to your photo, name, email or phone number, posts you didn’t make, and two-factor authentication turned off without you touching it. If you notice any of these and still have access, change your password immediately, go to Settings, then Help, and use “Report a Problem.” Also run Security Checkup to review login activity and contact info.
What to do after you get back in
Getting back in is only half the job. To keep the attacker out:
- Change your password to a unique one stored in a password manager.
- Log out other sessions. Go to Settings, Accounts Center, Password and security, “Where you’re logged in,” and sign out anything that isn’t yours.
- Secure your email. Change its password, turn on two-factor authentication and check for forwarding rules the attacker may have added.
- Re-secure linked Facebook and Threads accounts, if you have them.
- Turn on two-factor authentication under Settings, Accounts Center, Password and security. ESET recommends an authenticator app or a passkey over SMS, because text messages can be intercepted.
- Review third-party apps with access to the account and remove any you don’t recognize. Making the profile private and hiding your email and phone number helps too.
If your trouble is with another account, the same logic applies to email, as we explain in our guide to recovering your Gmail password. And if you only want a break from the app without risking your account, follow our steps to deactivate Instagram temporarily.
How do you keep it from happening again?
Be skeptical of unsolicited messages, urgent demands, fake copyright violation notices and giveaways that seem too good to be true. Never type your password into a link you received in a message: open the Instagram app or website directly. Keep the contact details on your account up to date, because those are what get you back in later.
Frequently asked questions
How long does Instagram account recovery take?
If you have access to your email or phone, it can take minutes. When Instagram asks for extra checks like a video selfie, it can take hours or days.
Can I pay someone to recover my account?
No. Recovery is free and only works through Instagram. Paid services and support numbers seen in ads or comments are scams.
I submitted several recovery requests. Does that hurt?
It doesn’t help. Repeating the request, especially from different devices, won’t speed anything up and can look like bot activity. Submit one and wait for the reply.
What if the hacker changed my email and phone number?
Search the inbox of your old email for Instagram’s warning message with the “Revert this change” link and click it right away. If it isn’t there, use the official recovery flow and the video selfie verification.
