My Instagram Account Was Hacked: What to Do in the Next 10 Minutes
If your Instagram has been hacked, act now. You have a very short window of time before the attacker changes the recovery email and locks you out permanently. Follow these steps in order.
Step 1 — Try to recover access right now
First, try to log in before they change your recovery details. Open Instagram and start the process from the login screen.
Enter your email or phone number. Instagram will send you a reset link. If you still have access to that email or phone, use it now.
Instagram lets you verify your identity via a video selfie or official document. Follow the process to the end even if it seems long.
Go to instagram.com/hacked — it's the official entry point for compromised accounts. Select your exact situation so Instagram directs you to the correct process.
⚠️ Critical timing
Every minute counts. The attacker will try to change the recovery email as soon as possible. If you receive an email from Instagram saying the email was changed, there's a link to revert it — use it immediately.
Step 2 — Revoke all active sessions
If you still have access to the account, close all open sessions before doing anything else. This logs out the attacker even if they have your password.
You'll see all devices with active sessions, with approximate location and date.
Tap on each suspicious session and select "Log Out". If you see locations you don't recognize, close all of them.
A long, unique password generated by a password manager. Never reuse a password you've used elsewhere.
Step 3 — Report the account to Instagram
If you've already lost access, reporting the account is critical so Instagram suspends it while they investigate — this prevents the attacker from continuing to use your profile to scam your contacts.
Select "My account was hacked and I can't log in".
Instagram may ask for a video selfie, a photo with a code, or an official document. Have your ID or passport ready.
The attacker will likely try to scam your followers by impersonating you. Warn them through other channels — WhatsApp, email, another network — that your account has been compromised.
ℹ️ Instagram response time
Instagram support can take between 24 hours and several days to respond. There's no way to speed up the process — the only thing you can do is complete the form correctly on the first attempt.
YOU MIGHT BE INTERESTED IN
What is 2FA and how to protect your Instagram accounts with YubiKey?
Step 4 — Protect linked accounts
An Instagram hack rarely comes alone. If you had Facebook linked, or used the same password on other services, those accounts are also at risk.
It's the most critical entry point. If the attacker accesses your email, they can reset any other account.
Go to Facebook Settings → Security and login → Change password.
If so, change it on all of them now. Prioritize: email, banking, other social networks. See security tools →
Step 5 — Enable 2FA when you regain access
As soon as you recover the account, enable two-step verification before doing anything else. Without 2FA, a stolen password is enough to get in again.
Instagram offers three methods: SMS, authentication app, or physical security key.
SMS is vulnerable to SIM swapping. An app like Authy or Google Authenticator is much more secure.
Instagram supports FIDO2 security keys like YubiKey. It's the most secure method available — impossible to phish remotely.
What does the hacker do with your Instagram account?
Understanding the motivation helps you act faster. Attacks on Instagram accounts almost always follow the same pattern:
The attacker impersonates you and contacts your followers asking for money, urgent loans, or inviting them to invest in crypto. The more followers you have, the more valuable the access.
They post malicious links in your stories or in your account bio. Your followers trust you — they're more likely to click.
Accounts with real followers are sold on dark markets. An account with 10,000 followers can sell for several hundred euros.
Frequently asked questions
How long does Instagram take to respond?
Between 24 hours and several days, depending on the volume of cases and whether identity verification was completed correctly. There's no way to speed up the process. If you don't get a response in 5 days, repeat the form from instagram.com/hacked.
Can I recover my photos if they deleted the account?
If the account was deleted, Instagram keeps it in a 30-day grace period before permanently deleting it. If you regain access within that period, the content should still be there. After 30 days, no recovery is possible.
What if the hacker enabled 2FA on my account?
It's the worst-case scenario — the attacker locked you out with their own 2FA. In that case, only Instagram's identity verification process remains, which may include video selfie or official document. It's lengthy but works if you complete all steps correctly.
Should I report it to the police?
Yes, especially if the attacker is using your account to commit scams. You can report online through your national police or civil guard website. The report is also useful if you need to prove to Instagram that you're the victim.
PROTECT YOUR ACCOUNTS
YubiKey security keys — protect your Instagram accounts forever
