If your Instagram account was hacked, the fastest fix is Instagram's own recovery hub at instagram.com/hacked — not a third-party "unlock" service, and not your password reset alone if the attacker has already changed your login details.
First, confirm it's actually a hack
Look for these signs before you start the recovery process:
- You're logged out and your usual password no longer works.
- Your profile photo, bio, username or linked email/phone changed without you touching them.
- Posts, Stories or DMs appear that you never sent.
- You get a login notification for a device or location you don't recognise.
- Followers report receiving strange DMs "from you" (often a scam or crypto pitch).
If none of that applies and you just can't remember your password, that's a simple reset, not a hack — the same instagram.com/hacked hub covers both, so start there either way.
If you can still log in
Act immediately, in this order:
- Change your password to something unique you don't use anywhere else.
- Check active sessions. In Settings, review where your account is logged in and log out any device or location you don't recognise.
- Review connected apps. Remove any third-party app or website you don't remember authorising — a common way attackers keep access after a password change.
- Secure your linked email first. If an attacker also controls the email address tied to your account, they can just reset your Instagram password again. Change that password too, and turn on its two-factor authentication.
- Turn on two-factor authentication on Instagram itself, ideally through an authenticator app rather than SMS.
Weak vs. good response
- Weak: change the Instagram password and stop there.
- Good: change the password, log out every other session, secure the linked email, and turn on 2FA — closing every door the attacker used, not just the one you noticed.
If you're locked out completely
When the attacker has already changed your password, email or phone number, go to instagram.com/hacked on your phone or a browser and choose the option that matches your situation — hacked, forgotten password, lost access to two-factor authentication, or disabled account. From there:
- Instagram will ask for an email address or phone number it can reach you on. Use one the attacker doesn't control.
- You may be sent a login link or security code to verify it's really your account.
- If standard verification isn't possible, Instagram offers an identity-check option, including asking a couple of your Instagram friends to confirm you're the real account owner.
- Give the process a little time — recovery flows involving identity checks aren't instant, and repeatedly restarting the form can slow things down rather than speed them up.
If your account shows as "disabled"
A disabled or restricted account isn't always a hack — it can also follow a policy review on Instagram's side. The appeal path is the same hub: instagram.com/hacked lets you flag that your account was disabled and start a review, separate from the hacked-account flow.
Common mistakes
- Only changing the Instagram password. If the linked email is also compromised, the attacker can just trigger another reset.
- Ignoring active sessions. A changed password doesn't log out devices the attacker is already using.
- Trusting a DM or email offering to "recover your account fast." Instagram never contacts you directly by DM to ask for your password or a code — treat any message like that as a scam.
- Restarting the recovery form repeatedly. It doesn't speed up identity verification and can reset progress.
- Skipping two-factor authentication after getting back in. Recovering the account without closing the gap that let the attacker in just invites a repeat.
Once you're back in
Getting the account back is step one — the shadowban guide covers how to check whether the hack left any trailing reach or visibility issues once you're back in control. And if the account you just recovered doesn't have a business account set up yet, that's also the moment to add the extra login and contact-verification options a personal account doesn't offer.
A secure account is the foundation — growing it deliberately is the next step. That's what Startviral's creator ads are built for: measurable reach and follower growth once your account is locked down. If you want to talk through your setup, get in touch or see current plans.
Frequently Asked Questions
How do I know if my Instagram account was hacked?
Common signs: you get logged out and your password no longer works, your profile photo, bio or username changes without you touching it, posts, Stories or DMs appear that you never sent, or you get a login alert for a device you don’t recognise.
What is instagram.com/hacked?
It’s Instagram’s own hub for compromised or locked accounts. You choose whether your account was hacked, you forgot your password, you lost access to two-factor authentication, or your account was disabled, and Instagram walks you through the matching recovery flow.
What if I can’t log in at all anymore?
Go to instagram.com/hacked and request a login link or security code to the email address or phone number on the account. If the attacker changed both, Instagram offers an identity-verification option, including having two Instagram friends confirm it’s really you.
Can Instagram disable my account without me being hacked?
Yes. A "disabled" or locked message can also come from a policy review on Instagram’s side, separate from a hack. The appeal path is the same: instagram.com/hacked, or the in-app notice you get when you try to log in.
How do I stop it happening again?
Use a unique, strong password, turn on two-factor authentication, ideally via an authenticator app rather than SMS, review connected apps and active sessions regularly, and be suspicious of any DM or email asking you to enter your password — Instagram never messages you directly to ask for it.
The startviral team supports creators with social growth. We write about algorithm research, Creator Ads, and sustainable growth.
