Hacked on Instagram? How to get your account back
Whoever took your account has almost always swapped the phone number and email for their own. You can still get back in: Instagram lets you prove the account is yours with a short selfie video. It takes five minutes to send in, and the sooner you do it, the better.
Watch how it is done
I showed the process for Telenor. The video is two minutes long and goes through the steps below, screen by screen. It is in Norwegian.
Step by step
The button names are the ones Instagram showed when the video was made. They may be worded slightly differently on your phone.
Tap “Forgot password?”
Open the Instagram app, enter your username on the login screen and tap “Forgot password?”.
0:06Choose “Try another way”
You will most likely see the scammer's phone number, not yours. You can't reach it, so tap “Try another way”.
0:15Say you have lost access
Tap “I no longer have access to these”, meaning none of the login methods work for you any more.
0:22Choose the selfie video
You get two options: “Yes, take a selfie video to confirm my account” or “No, request help from friends”. Choose the selfie video if there are photos of you on the profile.
0:33Enter an email you can read
Type in an email address you control and tap “Submit”. Enter the code Instagram sends there and tap “Confirm”.
0:44Record the selfie video
Hold the phone at eye level and follow the instructions on screen while the app scans your face. Tap “Submit” when it is done.
1:00Wait for an answer
Instagram usually takes 3–4 working days before you hear anything more. Keep an eye on the email address you entered.
1:25
If the selfie video is not an option
The selfie video needs photos of you on the profile, so Instagram has something to compare with. If you have none, choose “No, request help from friends” in step 6 instead. Friends on Instagram can then confirm the account is yours. Both routes work.
Sometimes Instagram also asks for a password you have used on the account before. It has to be one you have had within the last year, so don't wait to get started.
Try from the phone you normally use Instagram on. Instagram recognises devices that have been logged in before.
Once you are back in
- Switch to a long password you don't use anywhere else. The password generator makes one for you, and a password manager remembers it.
- Turn on two-step verification, ideally with an authenticator app instead of text messages. Then the password alone is not enough to get in.
- Check that the email address and phone number on the account are yours, and remove whatever the scammer added.
- Log out every device you don't recognise. You find the list in Accounts Center, under password and security.
- Go through the apps and websites connected to the account, and remove anything you don't recognise.
How does it happen?
Most takeovers start with phishing: a message that looks like it comes from Instagram, Meta or a friend, asking you to log in or send a code. The code you get by text message is the key to your account. Never give it to anyone, not even a friend who asks.
Many people are hacked from a friend's account that has already been taken over. The message comes from someone you trust, and that is the whole trick. It is called social engineering.
What people ask
when the account is gone.
After you send in the selfie video, Instagram usually takes 3–4 working days before you hear anything more.
Want your colleagues to be spared this?
I give talks on how scammers work and how to recognise them, for companies, schools and conferences.