Identity · guide

Instagram hacked: getting the account back, and who not to pay

By Alberto Gulotta · Updated 10 September 2026 · 19 min read

If your Instagram hacked message arrived this morning, start in your mailbox rather than in the app: a changed email address can be undone from Instagram’s own security email. If that is gone, the routes are a login link, then a support request, then proving who you are.

Every step below is quoted from Instagram’s own help page, read on 10 September 2026, with the exception of the section on paid recovery offers, which is quoted from two FBI alerts. There is nothing to buy on this page and nobody to call.

The order and the wording are Instagram’s own, from its help page read on 10 September 2026. Figure drawn by AI Tools Primer.

Before Instagram: the message that can undo it

The first move is not on Instagram at all. When the email address on an account is changed, Instagram sends a message to the old address, and that message contains the undo. Its own help page says it plainly: “If you received an email from security@mail.instagram.com letting you know that your email address was changed, you may be able to undo this change by selecting secure my account in that message.”

So the first place to look is the mailbox, including the spam folder, and the first thing to search for is that sender. Instagram adds the limit in the same breath: if other things were changed too, such as the password, and you cannot change the address back, the next step is to “request a login link or security code from Instagram”.

And the order this implies matters more than the tip itself. Whoever holds your mailbox can reset almost everything else you own, so an Instagram password changed while somebody else still reads your email is an hour spent for nothing. If there is any sign that the mailbox itself was reached, the email account comes first, and the same is true if the account you sign in with is a Microsoft one.

The route Instagram documents, step by step

Instagram keeps one address for this, and it is not a support form: it is a lookup. instagram.com/hacked opens on a single field under the heading “Find your account”, with the instruction “Enter your username, phone number or email so we can identify your account”. That is the whole first screen, and knowing that saves the minutes people spend looking for a way to explain the situation in words.

The login link. Instagram’s written steps are: on the login screen tap Forgot password?, enter the username, email address or phone number on the account, then click Send login link. Complete the captcha, then follow the link that arrives by email or text message. Its own note covers the case where none of those three still reach you: if you do not have access to the username, email address or phone number, the route is the help page’s own link rather than this one.

The support request. When the login link does not get you in, Instagram describes requesting support from a mobile device, and its instruction contains the sentence to read twice: “Be sure to enter a secure email address that only you can access.” Once submitted, it says you should receive an email with the next steps.

Proving you are you. Here Instagram splits by whether the account carries photographs of you. For an account without them, the help page says it will ask “you to help us verify your identity by providing the email address or phone number you signed up with and the type of device you used at the time of sign up”. For an account with them, you are “asked to take a video selfie of you turning your head in different directions to help us check that you’re a real person and confirm your identity”. And it states what happens to that file: “Keep in mind that the video you submit will never be visible on Instagram and will be deleted within 30 days.” If the video is rejected, Instagram says you can submit a new one and it will be reviewed again.

The four routes Instagram documents, what each one needs from you, and where it sends the answer. From Instagram’s help page, read on 10 September 2026.
Route	What it needs	Where the answer goes
The security email	Access to the mailbox that was on the account	Back into the same mailbox, as an undo link
Login link	The username, email address or phone number, plus a captcha	The email address or phone number on the account
Support request	A mobile device, and an email address only you can open	The secure address you gave
Identity verification	A video selfie, or the signup details and device type	The secure address you gave

Both branches, and the 30 days, are quoted from Instagram’s help page. Figure drawn by AI Tools Primer.

If you are still logged in, this is the ten minutes that matter

Being able to open the app does not mean the problem is over, and Instagram lists six things for exactly this state. In its order: change your password or send yourself a password reset email; turn on two-factor authentication; confirm that the phone number and email address in your settings are still yours; check Accounts Centre and remove any linked accounts you do not recognise; revoke access to any suspicious third-party apps; and go through its security tips.

The third and fourth are the two that decide whether the recovery holds. A changed password locks the front door; a recovery address or phone number that still belongs to somebody else is a key left in the back one, and it is the key Instagram’s own reset process would post through. On a phone, the list of credentials that may be reused elsewhere is in the settings rather than in the browser, and the reason the same password matters twice is what a leaked one opens next.

If the reason you are here is that the password itself is the problem rather than the account, that is a shorter job with its own route.

The right-hand column is quoted from FBI alerts I-040723 and I-041825; the left-hand column is a description of the offer, not a transcript of one. Figure drawn by AI Tools Primer.

The people who will offer to get it back for money

Search this and offers appear: accounts promising recovery, direct messages from people who say they have a contact inside Meta, adverts for services that will handle it for a fee. Measured on the first screen of results for this exact phrase on 10 September 2026, not one of the five pages mentions the FBI, the IC3 or any federal reporting route — and the FBI has published twice on this shape of offer.

Alert I-040723, 7 April 2023. Written about sextortion victims, and about the same market: it states that these companies “charge exorbitant fees, whereas law enforcement and non-profit agencies will provide assistance at no charge to victims”, that some “may also attempt to discourage victims from reporting the sextortion to law enforcement”, and — the line that should settle it — “Limited reporting indicates the companies are directly or indirectly involved in the sextortion activity.” Among the indicators it lists: you are asked to pay before anything is done, you are pushed to sign a contract, and “The for-profit company claims to be connected to government or law enforcement officials.”

Alert I-041825, 18 April 2025. This one is about people impersonating the FBI’s own complaint centre while offering to recover what you lost, and it gives a rule that is easy to carry: “The IC3 will never directly communicate with individuals via phone, email, social media, phone apps, or public forums.” It adds: “The IC3 will not ask for payment to recover lost funds, nor will they refer a victim to a company requesting payment for recovering funds.”

Nothing on this page is for sale, nothing linked from it charges anything, and this site earns nothing from any of it. Instagram’s routes are free. Reporting is free.

How accounts are taken, in the terms Meta documents

This section exists for one reason: to make the recovery stick. It is not a description of method, and there is nothing here anybody could use.

A password that was already somewhere else. The reason Instagram’s post-recovery list has “Change your password” and “Turn on two-factor authentication” next to each other is that a password on its own is a single point of failure, and one that has appeared in a breach at some other company is a public one. This is the route that needs no cleverness at all.

A message that was not from Instagram. The undo link described above arrives from security@mail.instagram.com; a message asking you to confirm your login somewhere else does not. Telling one from the other is its own skill, and it is the same skill whether the message claims to be a platform, a bank or a delivery company.

A phone number that stopped being yours. If two-factor codes go to a text message and the number is moved to somebody else’s SIM, the second factor moves with it. That is a SIM swap, and it is worth knowing about here because it is the one route where nothing you did on Instagram made any difference.

Something else with access. Instagram’s own list ends with revoking third-party apps, which is there because access granted once stays granted.

If whoever took it is threatening you with what is inside

Recovery is not the whole problem when the account holds private messages or photographs and the person holding it says so. Instagram treats that as a separate case and its instruction has two halves: “If someone is trying to blackmail you by threatening to share private information unless you send money or something else you’re uncomfortable with, please report it. Also, contact your local law enforcement.”

Do not pay, and take the screenshots before you block anything. The order, the free removal routes and the deadline a platform is under once you ask are all on the page about being blackmailed, which is where that part of this belongs.

The short version

In order, and the first two are where most of it is decided.

Search your mailbox for security@mail.instagram.com That message contains the undo for a changed email address. Check spam. If the mailbox itself was reached, secure it first.

Use instagram.com/hacked, or Forgot password? One field: username, phone number or email. The login link goes to the address or number on the account.

If that fails, request support from a phone Give an email address only you can open. Then either a video selfie, or the signup details and the device you signed up on.

Pay nobody The FBI’s alerts on paid “assistance” are quoted above. Instagram’s routes cost nothing, and so does reporting.

When you are back in, do the six things Password, two-factor, check the recovery address and phone number, Accounts Centre, third-party apps, security settings.

What this page deliberately does not contain. It does not explain how to get into an account, and it does not link to anything that does. The four routes above are Meta’s documented recovery process; the section on how accounts are taken is there because the recovery does not hold unless the way in is closed, and it is written at the level Meta itself documents — a reused password, a message that was not from Instagram, a phone number that moved, an app with access that should not have it. Nothing more specific than that is useful to somebody trying to get back in, and everything more specific than that is useful to somebody else.

If the account will not come back. There is a point at which the honest answer is that the recovery has not worked, and the useful thing then is to stop the damage spreading rather than to keep resubmitting. Change the password anywhere the same one was used — that is the door that was probably open in the first place — check what of yours is reachable from outside on your digital footprint, and if the person holding it is asking for money, treat it as blackmail and report it rather than negotiate.

Where to start

Four ways in, depending on what you still have access to.

“The email address was changed.”: The undo, and where it arrives — the email first
“I just cannot log in.”: The four documented routes — the official route
“I am in, but something is wrong.”: The six things to change — still logged in
“Someone offered to get it back.”: What the FBI says about that — paid recovery

The password underneath it

Instagram’s own list after a recovery starts with the password and two-factor authentication, and that is the part you can close.

Instagram password resetThe reset itself, when you still control the email address on the account.Open this guide → Facebook password resetThe other Meta account, which is often linked to the first through Accounts Centre.Open this guide → Resetting a Gmail passwordThe mailbox that can reset everything else, and what happens when the recovery options are gone.Open this guide → Passwords saved on an iPhoneWhere the phone keeps them, which is where you find out what else shares this one.Open this guide → Turning two-factor off, and what it costsThe setting Instagram asks you to turn on, seen from the other direction.Open this guide →

The rest of the damage

An account taken is usually one event in a sequence, and the others have their own pages.

Being blackmailed with private imagesDo not pay, the free removal routes, and the deadline a platform is under once you ask.Open this guide → A SIM swapWhen the second factor moves to somebody else’s phone, and the free carrier lock that stops it.Open this guide → PhishingThe message that was not from who it said, which is the usual first move.Open this guide → A data breachThe event before this one, and the part of it that is actually worth acting on.Open this guide →

Questions people also ask

My Instagram was hacked and the email was changed. What now?

Search your mailbox, spam included, for a message from security@mail.instagram.com. Instagram states that such a message lets you “undo this change by selecting secure my account in that message”. If the password was changed too, request a login link or a security code instead.

How do I get a login link from Instagram?

On the login screen tap Forgot password?, enter the username, email address or phone number on the account, then Send login link. Complete the captcha and follow the link that arrives by email or text message.

What if I cannot reach the email or phone number on the account?

Request support from a mobile device. Instagram’s instruction is to “enter a secure email address that only you can access”, and it sends the next steps there. Then it asks you to prove who you are.

What happens to the video selfie Instagram asks for?

Instagram states that it is used to check that you are a real person, and that “the video you submit will never be visible on Instagram and will be deleted within 30 days”. If it cannot confirm your identity from it, you can submit a new one.

Should I pay someone to recover my Instagram account?

No. The FBI’s alert I-040723 says such companies “charge exorbitant fees, whereas law enforcement and non-profit agencies will provide assistance at no charge to victims”, that some discourage victims from reporting, and that some are involved in the original crime.

I am still logged in. What should I change?

Instagram lists six: the password, two-factor authentication, the phone number and email address in settings, linked accounts in Accounts Centre, third-party app access, and its security settings. The recovery address is the one people skip.

Not covered here. It does not explain how accounts are broken into, and it does not link to anything that does. The section on how they are taken stays at the level Meta documents and exists to keep the recovery from being undone a week later.

It does not cover business or creator accounts managed through Meta Business Suite, where the recovery route runs through the business account rather than the profile.

And it does not promise the account back. Instagram decides that, and the honest thing a page can do is name the routes it documents and the order to try them in. What holds instead is simple: every recovery step is quoted from Instagram’s own help page with the date it was read, the warning about paid recovery is quoted from two FBI alerts with their numbers and dates, the page names no product and no service, and it contains nothing about how an account is broken into beyond what Meta documents for the purpose of defending one.

Sources

Instagram Help Centre — If you think your Instagram profile has been hacked: the security@mail.instagram.com message and the undo it contains, the login link steps, the support request and the instruction to give an email address only you can access, the two forms of identity verification including the video selfie and the statement that it is never visible and is deleted within 30 days, and the six things to do while still logged in — help.instagram.com, read 10 September 2026.
Instagram — My Instagram was Hacked: the account lookup itself, headed “Find your account”, with the single field and the instruction to enter a username, phone number or email so the account can be identified — www.instagram.com, read 10 September 2026.
FBI Internet Crime Complaint Center — Alert I-040723, For-Profit Companies Charging Sextortion Victims for Assistance and Using Deceptive Tactics to Elicit Payments (7 April 2023): the exorbitant fees against help given free by law enforcement and non-profits, the discouragement from reporting, the indicators of a paid assistance scheme, and the finding that limited reporting indicates some of these companies are involved in the activity itself — www.ic3.gov, read 10 September 2026.
FBI Internet Crime Complaint Center — Alert I-041825, FBI Warns of Scammers Impersonating the IC3 (18 April 2025): that the IC3 never directly communicates with individuals by phone, email, social media, phone apps or public forums, and that it does not ask for payment to recover lost funds or refer victims to companies that do — www.ic3.gov, read 10 September 2026.
Instagram Help Centre — Dealing with blackmail on Instagram: the instruction to report the profile when someone threatens to share private information in exchange for money, and to contact local law enforcement as well — help.instagram.com, read 10 September 2026.

Written by Alberto Gulotta

Founder and editor of AI Tools Primer, writing from Palermo, Italy. Thirty-five years of taking computers apart, starting with a Commodore 64 — the long version is on the about page.

Something wrong on this page? Write to aitoolsprimer@gmail.com and it gets fixed.

Written on 10 September 2026.

Independence and limits

No affiliate links and no paid placements anywhere on this site. Nobody pays to appear here, and no company has seen this page before you did.

This is general information, not professional advice. Where a page touches money, health, safety or the law, it names its source and the date it was read — and your situation may still differ. See the privacy page and the cookie policy.