How To Recover A Hacked Instagram Account

Speed and documentation decide most outcomes. Recovery is never guaranteed, and no agency or service can promise it — only the platform decides. What you can control is how quickly you act and how complete your case is.

First hour

1. Check your email for Meta notifications about changed email, password or two-factor settings. Some contain a 'revert this change' link that works only for a limited window.
2. Attempt password reset from the login screen using every email and phone number ever attached to the account.
3. If the account is linked to a Business Manager you still control, check whether access there still exists.
4. Secure your email accounts first — email compromise is usually the root cause, and recovering the account without fixing it means losing it again.
5. Enable or reset two-factor authentication anywhere you still have access.

Evidence to gather before filing

• A government ID matching the account's registered name, if the account is personal.
• Business registration documents and a business email on the matching domain, for brand accounts.
• Screenshots of the account before compromise and of any suspicious notifications.
• A clear timeline: dates, times, what changed, what you did.
• Any prior support case numbers.

Official routes

Use Instagram's in-app 'Need more help?' and hacked-account reporting flows, the web support forms for hacked accounts, and — for accounts connected to an advertising or Business account — the business support channels available in Business Manager. Meta Verified subscribers have access to additional support routes. Submit once, completely, and then wait; duplicate submissions can slow review.

What to avoid

• Anyone claiming a guaranteed recovery, an 'insider contact' or a fee for priority review. These are overwhelmingly scams.
• Creating multiple new accounts to appeal from — it can complicate review.
• Paying a ransom to whoever took the account. It rarely ends there.

After recovery

Change passwords everywhere, revoke unknown sessions and connected apps, move two-factor to an authenticator app rather than SMS, add a second admin on business assets, and verify your domain. The point of recovery work is to not need it again.