Hacked Instagram Account — Step-by-Step Recovery Guide 2026

You discover that you can no longer get into your Instagram account. The email address has been changed, the password doesn't work, and the hacker might be posting embarrassing things in your name. The panic is real — but there is a clear step-by-step process for regaining access. Here it is.

First: breathe. You have 72 hours.

Instagram has a 72-hour window during which their system allows recovery via your original details. Act within this time for the best chance.

Step 1: Determine what the hacker has changed

Try logging in with your current password. If:

• "Wrong password" error: The hacker has changed the password.
• "Account not found": The hacker may have changed the username or email.
• You get in but everything is strange: The hacker has access but hasn't locked you out (yet).

In all three scenarios: the actions you need to take are similar, but the priorities differ.

Step 2: Check your email inbox

The hacker has likely changed the account's email. But Instagram sends a "change made" email to your old email within 24h of the change. Search for: "security@mail.instagram.com" or "Your Instagram email was changed".

If you find such an email WITHIN 24h: Follow the link "If you did not make this change, revert it here" — this restores the email immediately.

If more than 24h have passed: The link no longer works. Go to Step 3.

Step 3: Use Instagram's password reset

Go to instagram.com/accounts/password/reset.

Try with:

1. Your original email (the one you used when you created the account)
2. Your phone number (if linked)
3. Your username

If any of these are still linked, you will receive reset instructions via email/SMS. Follow them immediately.

Step 4: If the reset doesn't work — report a hacked account

Go to instagram.com/hacked (or in the mobile app: Instagram > Login Screen > "Need more help?" > "My login info isn't working" > "I think my account has been hacked").

You will get a form to fill in. Key information:

• Last known username
• Email or phone previously linked
• Description of what happened

Instagram then sends a recovery link to your previous email (even if the hacker changed it, Instagram tries all historical emails).

Step 5: Video selfie verification

If step 4 didn't give immediate recovery, Instagram will likely request a video selfie verification:

• You receive an email with instructions
• Record a short video (3-5 sec) of your face from different angles
• It is matched against photos on your account (from your posts/stories)
• AI + manual review confirm that you are the account owner

Success rate for Swedish users: ~75% get their account back this way. Processing time: 2-7 days.

Step 6: Secure your email account first

Important — before Instagram is restored: secure your email. Hackers often get into Instagram via a hacked email first. If the email isn't secured, the hacker can take back even your restored Instagram.

1. Change the email password to a strong new one (12+ characters, unique)
2. Enable 2FA on the email account
3. Check the "Sent" folder in your email — the hacker may have sent phishing to your contacts
4. Warn your contacts that email or Instagram messages from you in recent days may be phishing

Step 7: Once you're back — enable 2FA immediately

Settings > Security > Two-Factor Authentication > Authenticator App (not SMS — SMS can still be hacked via SIM swap).

Recommended apps: Google Authenticator, Authy, 1Password.

Save your backup codes securely (password manager or a printout hidden in a safe place).

Step 8: Review your security settings

Once you're back, do these immediately:

1. Settings > Security > Login Activity — log out all unknown sessions
2. Settings > Security > Apps and Websites — revoke access for all third-party apps you don't explicitly want
3. Settings > Account > Personal Information — verify that your email and phone are correct
4. Settings > Privacy > Account Privacy — consider a temporarily private account while you restore friends/customers

Step 9: Post an explanation to your followers

The hacker may have posted strange things in your name. Your audience is confused.

Post a Story: "My account was temporarily hacked [date]. I have got it back and secured it. If you saw strange messages or posts from me in recent days — ignore them. Everything is now safe."

This preserves your reputation and prevents confusion.

Step 10: Report to Swedish authorities in case of financial damage

If the hacker:

• Sent phishing to your contacts and someone was scammed
• Published scandalous content that affected your reputation
• Asked for money in your name

Police report: polisen.se/anmal-brott. Even though an international hacker is often hard to identify, the report creates official documentation important for: (a) insurance claims, (b) civil claims, (c) Meta's press reporting.

Prevention for the future

1. A strong, unique password. 12+ characters, a mix of letters/numbers/symbols. DO NOT use the same one as for other services.

2. 2FA via an Authenticator App. NOT SMS. SIM-swap attacks are common in Sweden.

3. Update your recovery email regularly. Check every 6 months that your Instagram email is still active and controlled by you.

4. Be suspicious of "Instagram emails" asking for your password. Instagram NEVER asks for your password via email. Phishing emails are common.

5. Avoid sharing your phone number publicly. Hackers use phone numbers as a starting point for SIM-swap attacks.

6. Secure your email account at least as strongly as Instagram. Email is the "master key" to all your online accounts.

Boostora's role

If your account hack led to a loss of followers, Boostora packages can help you rebuild your base faster. But the priority is securing the account first — buy followers only once all 2FA and security is in place.

Summary

A hacked Instagram is frightening but manageable. Act within 72 hours. Use Instagram's official hacked page. Video selfie verification succeeds for 75% of Swedish users. Once restored: 2FA is mandatory + secure your email account at least as strongly.

For those who are still safe: enable 2FA today, before you become a statistic. It takes 2 minutes and potentially saves you weeks-long recovery processes.