Instagram hacked? Here’s what to do

Instagram accounts can be hacked in various ways, sometimes affecting not only your profile but also the email address linked to it. Begin by changing your Instagram password, and update the linked email address if needed.

What to do if your Instagram account is hacked? Quick guide

1. Check your email inbox to see whether you received an Instagram no­ti­fic­a­tion about a password change.
2. If you didn’t make this change yourself, undo the password change using the link in the email.
3. Reset your Instagram password again yourself right away.
4. Check your email account. Was anything changed there, or were there unusual logins? If so, set a new password.
5. Change the email address on Instagram (if you still have access to the account).
6. If you can no longer log in to Instagram, start the recovery process in the Instagram app via ‘Forgot password?’ -> ‘Need more help?’.

Why is Instagram a popular hacking target?

Instagram is one of the most widely used social platforms, with over a billion active users sharing photos in their feeds and Stories. For many people, it can even serve as a source of income, since accounts with large numbers of Instagram followers can generate earnings through in­flu­en­cer part­ner­ships.

Because so much personal content is shared, Instagram is also a frequent target for hacking attempts. Hijacked accounts may be used to dis­trib­ute ma­nip­u­lated or harmful posts or to blackmail the account owner.

Signs of a hacked Instagram account

It’s not hard to tell whether an Instagram account has been com­prom­ised. The following signs indicate this:

• Posts, Stories, or comments that weren’t made by you
• A new Instagram profile picture shows up even though you didn’t change it
• You suddenly can’t log in

How can an Instagram account be hacked?

There are several common ways attackers can gain access to your Instagram login. Below, we’ll take a closer look at these methods so you can take action to protect yourself—before your Instagram account is hacked or com­prom­ised.

Phishing — fake messages and login pages

With phishing, attackers send fake emails, messages, or links that appear to come from Instagram. These messages prompt you to enter your login details — but the data goes directly to the attacker.

Example: An email claiming ‘Your account has been suspended — log in here’ and linking to a coun­ter­feit login page.

Pro­tec­tion: Treat un­ex­pec­ted messages with caution, check no­ti­fic­a­tions directly in the official app or on the website, and avoid entering passwords through external links.

Com­prom­ised devices and session theft

If your mobile phone, tablet, or computer has malware such as a keylogger or you use public, unsecured Wi‑Fi networks, attackers can intercept session data like cookies or login cre­den­tials and sign in without your password.

Example: An open coffee shop Wi‑Fi network where login in­form­a­tion is in­ter­cep­ted.

Pro­tec­tion: Keep your operating system and apps up to date, use public Wi‑Fi with caution (and avoid it for sensitive logins if possible), and use security software.

Reused or weak passwords

If you reuse passwords across different services or rely on simple ones, a single stolen login can give attackers access to other accounts — in­creas­ing the chances of you ending up with your Instagram account hacked.

Example: A password leaked from another platform also unlocks your Instagram account.

Pro­tec­tion: Create long, unique passwords for every service and use a password manager to lower the risk of having your Instagram account com­prom­ised.

How to get your hacked Instagram account back

If you’re dealing with a hacked Instagram incident, respond as fast as possible. If you can still access your account, create a strong new password right away. After that, go to ‘Security’ → ‘Login Activity’ in the app to look for un­fa­mil­i­ar devices — and remove them.

If you’ve received an Instagram email about a password or email address change, use the link in that message to reverse any un­au­thor­ised changes. If your email account is also com­prom­ised, secure it first by setting a strong new password and reviewing sus­pi­cious logins — attackers can otherwise regain control of your Instagram account at any time. Once your inbox is safe and you still have access to Instagram, update the email address stored in your account settings so you can receive recovery messages again.

If you can’t sign in to Instagram or your email, start the recovery process via ‘Forgot password?’ on the login screen and then choose ‘Need more help?’. Follow the steps and provide an email address you can currently access.

Instagram now handles most recovery pro­ced­ures directly in the app through in-app veri­fic­a­tion. You’ll be guided through identity checks that may include:

• Con­firm­ing an alternate email address or phone number linked to the account
• Entering a security code sent via email or SMS
• Recording a selfie video, which Instagram compares with your profile photos
• Approving known devices or login locations you used pre­vi­ously

Final step: After regaining access after your account was com­prom­ised, change all relevant passwords and keep an eye on your login activity to maintain long-term security.

How to protect your Instagram account

Meta now offers several modern security options to protect your account, which you can manage centrally in the Accounts Center. You can find it in the app under ‘Settings’ → ‘Accounts Center’ → ‘Password and security’.

The Meta Accounts Center acts as a central control hub for all Meta services. It unifies settings for login, passwords, security, privacy, and ad­vert­ising, and is designed to create a more con­sist­ent way of managing separate platforms like Facebook, Instagram, Threads, and Messenger over time.

In the ‘Password and security’ section, you’ll find:

• Device and session overview: Shows all signed-in devices, IP addresses, and locations.
• Login alerts: Enable push or email no­ti­fic­a­tions when someone logs in from a new device.
• 2FA and passkey man­age­ment: One place to centrally enable, change, or remove your au­then­tic­a­tion methods.
• Meta Protect in­teg­ra­tion: Monitors unusual activity, provides security tips, and can auto­mat­ic­ally enable pro­tect­ive measures for sus­pi­cious logins.
• Account linking: Here you can decide whether to use the same login for Facebook and Instagram or keep separate login cre­den­tials.

Thanks to this in­teg­ra­tion, account security becomes both stronger and easier to un­der­stand. Users can instantly see which pro­tec­tion features are enabled and receive direct guidance within the system if something goes wrong — without nav­ig­at­ing through endless menus. Below is an overview of the key security features:

Meta Protect

Today, most account recovery steps run behind the scenes through Meta Protect, Meta’s security framework. Meta Protect iden­ti­fies unusual activity, places affected accounts in a temporary pro­tec­tion mode, and guides the recovery process. If your account is covered by Meta Protect, Instagram may limit access until you verify your identity through in-app checks.

Two-Factor au­then­tic­a­tion (2FA)

Two-factor au­then­tic­a­tion adds an extra layer of security to your password. Even if someone knows or steals your password, access remains blocked without the second factor.

Meta supports multiple 2FA methods:

• SMS codes: You receive a six-digit code via text message every time you log in, which you must enter as well.
• Au­then­tic­at­or apps: Apps like Google Au­then­tic­at­or, Authy, or 1Password generate one-time codes that work in­de­pend­ently of the mobile network and are more secure than SMS.
• Security keys (hardware tokens): You can also register physical security keys (e.g., YubiKey or Feitian) that you activate when logging in via USB or NFC.

In the Accounts Center (‘Password and security’ → ‘Two-factor au­then­tic­a­tion’), you can easily set up 2FA. You can also save backup codes there in case you lose access to your device.

Passkeys – the next level of account security

Since 2024, Meta has been gradually rolling out passkeys for Facebook and Instagram. This new tech­no­logy com­pletely replaces tra­di­tion­al passwords with a cryp­to­graph­ic key that is securely stored on your device. A passkey works as follows:

• When you first set it up, a key pair is created on your smart­phone or computer—one public key and one private key.
• Only the public key is sent to Meta; the private key stays securely on your device (e.g., in Android’s TPM module ).
• When you log in, you don’t enter a password. Instead, you confirm your identity using a biometric method—such as a fin­ger­print, Face ID, or your device PIN.
• Meta verifies your identity using the public key, without any sensitive data ever leaving your device.