How to Recover a Hacked Instagram Account in 2026 (Step-by-Step)

How to Recover a Hacked Instagram Account in 2026 (Step-by-Step)

If your Instagram account has been hacked, the next 30 minutes matter a lot. The faster you act, the higher your chances of recovery. The process is bureaucratic and sometimes frustrating, but it works — if you follow the right steps in the right order.

Don't waste time trying random things. Follow this sequence.

Step 1: Try to Log In First

Before assuming you're locked out, try logging in normally. Sometimes hackers change your password but haven't yet changed your email or phone number. If you can still log in:

• Go immediately to Settings → Password → Change Password
• Change it to something new and strong
• Enable Two-Factor Authentication (Settings → Security → Two-Factor Authentication) using an authenticator app, not SMS
• Go to Settings → Security → Apps and Websites and revoke access for any apps you don't recognize
• Go to Settings → Security → Login Activity and log out all other sessions

If you can do all of this before the hacker responds, you've reclaimed your account.

Step 2: If Your Password Was Already Changed

On the login screen, tap "Forgot password?" Enter the email address or phone number associated with your account. Instagram will send a recovery link.

If the hacker changed your email, this won't work directly. But there's a fallback:

On the login screen, tap "Get more help." Instagram will ask you to verify your identity. The most reliable option is a video selfie — Instagram uses facial recognition to compare against the profile photos on the account. This process is more reliable than it used to be in 2026 and can verify ownership even when email and phone access is lost.

Step 3: The Official Instagram Support Form

If the selfie option isn't available or doesn't work, go to Instagram's official support page through a browser (instagram.com/hacked). This opens a dedicated recovery flow for compromised accounts.

Fill in the username, the email address originally associated with the account, and a description of what happened. Instagram's team reviews these requests — response time varies from a few hours to a few days.

One important note: do not use any third-party "account recovery services" you find through Google ads or Instagram DMs. These are almost universally scams that will ask for payment and deliver nothing, or worse, collect your information. Instagram's official channels are the only legitimate path.

Step 4: While You Wait

While recovery is in progress:

• Check whether the hacker has posted anything from your account and document it (screenshots)
• Alert your followers that your account has been compromised — do this through other social platforms or by asking someone you trust to post on Instagram temporarily
• Check whether any connected accounts (Facebook, Threads) were also compromised and secure those independently

After Recovery: How Your Follower List Changed

Once you recover your account, something you may not think to check: your follower and following lists may have been modified. Hackers sometimes use compromised accounts to follow spam accounts, unfollow specific people, or run follow-unfollow operations.

The best way to audit what changed is to compare your current follower list against a pre-hack record. If you have a previous Instagram data export, you can upload both to FollowCheck and compare them — seeing exactly who was added to or removed from your following list during the period of compromise.

If you don't have a previous export, request one now and document your baseline. That way you have a record for future reference.

The Lesson for Prevention

Two-factor authentication using an authenticator app (not SMS) is the single most effective protection against Instagram account hacking. SMS-based 2FA can be defeated through SIM swapping. Authenticator apps cannot. Enable it now if you haven't already.

Use a unique, randomly generated password for Instagram — one that's not used on any other platform. A password manager makes this practical. And never give any third-party app your Instagram login credentials. Not for any reason.

Recovery is possible. Prevention is easier.