TL;DR: When a hacker changes your Instagram email, Instagram sends a message to your old address from security@mail.instagram.com with a link to revert the change. Use it first. If that fails, request a login link to your phone, and if both your email and phone were changed, choose "I can't access this email or phone number" and complete the video selfie check. Never pay anyone who offers to recover the account.
Step 1: Look for the "revert this change" email
When the email on an Instagram account changes, Instagram emails the old address. According to Consumer Reports, the message comes from security@mail.instagram.com and contains a link that lets you undo the change. Search your inbox, spam and promotions folders for it.
- Check the sender address letter by letter. Fake "Instagram security" emails are common, and a lookalike domain is how many accounts get stolen in the first place.
- Don't reply to the email. Click the revert link, then change your password straight away.
- If the hacker also took over your email inbox, recover that first using our guide on recovering a hacked email account.
Step 2: Request a login link or code
If the revert link doesn't work, go to the Instagram login screen and tap Forgot password? (iPhone) or Get help logging in (Android). Ask for a login link sent to the phone number or email on the account. This only works if the hacker hasn't changed both, so try every phone number and email you've ever used.
Step 3: If your email and phone were both changed
On the login help screen, choose I can't access this email or phone number and follow the prompts. Instagram may ask for a short video selfie, which it compares with photos on the account. That is why it helps if the account has clear photos of your face. Submit one request and watch the email address you gave for a reply.
Instagram's official help page is How to fix and secure hacked Instagram profiles. Use only that page, the app, or links inside the app. Anyone who messages you offering to "recover your account for a fee" is running a scam, and many target people who just posted about being hacked.
Step 4: Kick the hacker out
Once you're back in:
- Change your password to one you've never used anywhere else. If you reused it, read what to do when a password leaks.
- Log out every other session in Accounts Center, under Password and security, Where you're logged in. Our guide to logging out of all devices covers this for Instagram and other apps.
- Check your email and phone in Accounts Center are yours, and remove anything you don't recognise.
- Turn on two-factor authentication with an authenticator app, not SMS. See how to set up 2FA properly.
- Remove unknown apps connected to the account, and check that no new posts, stories or DMs were sent in your name.
Why hackers change the email first
Changing the email cuts you off from password resets, so it's usually the first thing an attacker does. Most Instagram takeovers start with a password reused from an old breach, a fake "copyright violation" or "verify your badge" message, or a friend's hacked account asking you for a code. Our breakdown of common Instagram scams shows the messages to watch for.
If your email address appears in old breaches, attackers can pair it with leaked passwords and keep trying. A free email exposure check shows which breaches your email is in, so you know which passwords to retire.
If you can't get it back
- Ask friends to report the account as hacked or pretending to be you. Our guide to reporting a fake or impersonation account explains the steps.
- Warn your followers on other platforms not to send money or codes to your old account.
- Keep screenshots of the email-change notice and any messages the hacker sent.
Frequently Asked Questions
What do I do if my Instagram was hacked and the email changed?
Look for the email from security@mail.instagram.com in your old inbox and click the link to revert the change. If that fails, request a login link to your phone, or choose "I can't access this email or phone number" and complete the video selfie check.
Can I recover Instagram if the hacker changed my email and phone number?
Often yes. Instagram offers an identity check, usually a video selfie compared with photos on the account, when you say you cannot access the email or phone on file.
How long does the Instagram video selfie review take?
Instagram does not publish a fixed time. Keep checking the email address you gave during the request, and avoid submitting many duplicate requests.
Should I pay someone to recover my Instagram account?
No. People offering paid recovery in comments or DMs are scammers. Use only the Instagram app and help.instagram.com.
How do I stop my Instagram getting hacked again?
Use a unique password, turn on app-based two-factor authentication, log out unknown sessions, remove unknown connected apps and ignore messages asking for codes or badge verification.
Sources
- Instagram Help Center: How to fix and secure hacked Instagram profiles
- Consumer Reports: What to do if your Instagram account gets hacked