You can usually tell that your Instagram has been hacked before you lose access: a security email about a change you did not make, a device or place you do not recognize under Where you’re logged in, posts, comments or messages you did not send, or an account in Accounts Center that is not yours. If you see any of these and can still log in, change your password from inside the app straight away. Instagram says changing it logs every other device out.
In the takeovers we work on, the gap between the first sign and a full lockout is often minutes, not days. Here is what to look for, how much weight each sign deserves, and what to do in the first ten minutes.
The short answer
- Strong signs: security emails about changes you did not make, unknown devices in Where you’re logged in, activity you did not do, and changes in your account history.
- Also worth acting on: a login code you did not request, an unfamiliar linked account or app, and Instagram telling you your account is at risk.
- Not proof on its own: a password reset email you did not request. Instagram says it does not necessarily mean a hack.
- First move: change the password from inside the app, then log out every device you do not recognize.
- Already locked out: go to instagram.com/hacked.
Sign 1: a security email about a change you did not make
Messages saying your email address, phone number or password was changed are the clearest sign. Instagram’s page on what to do if your account email was changed says it sends a message to the original address from security@mail.instagram.com, with a link to reverse the change. That email is both the warning and the fix: confirm it appears in Recent emails (Accounts Center, then Password and security), then use the link immediately. Because attackers also send fake security emails, our guide to telling real Meta emails from fake ones is worth reading before you click anything.
Sign 2: a login you do not recognize
Go to Accounts Center, then Password and security, then Where you’re logged in. Instagram’s login activity page says the list shows devices that have recently logged into your account. If one is not yours, log it out and tell Instagram the login was not you, which takes you to a password reset. In our experience, locations shown for mobile connections are approximate, so a nearby city is not alarming on its own; a device type you do not own is.
Sign 3: activity you did not do
Posts, stories, comments, follows or messages you never made. Instagram’s page on a profile posting unauthorized content says that if your profile is leaving comments or sharing things you haven’t posted, your password may be compromised. Friends asking about strange messages from you, often about crypto, giveaways or urgent requests for money, are the same sign seen from the outside. The same page notes that if Instagram detects inauthentic activity on your account, you may see a “Try again later” error.
Sign 4: changes in your account history
Open Your activity, then Account history. Instagram’s page on account history says it lists the changes made to your account, and you can filter by date. A change to your password, email, name or username that you did not make is a sign someone else has been in, even if nothing else looks wrong yet.
Sign 5: an account in Accounts Center that is not yours
Accounts Center connects your Instagram to other Meta accounts. Instagram’s hacked account page tells you to check Accounts Center and remove any linked accounts you don’t recognize. In our experience, attackers add one to keep a way back in after the owner changes the password.
Sign 6: apps you did not authorize
Check the apps and websites connected to your account. Instagram warns that if you give an app your login information, by access token or password, it can gain complete access to your account. An app you never connected, or a “free followers” service you once tried, is a door to close today.
Sign 7: a login code you did not request
If two-factor authentication is on, Instagram asks for a code when there is a login attempt from a device it does not recognize. A code you did not ask for therefore means someone is trying to log in as you, and in our experience they usually already have your password. Do not share the code with anyone, including someone claiming to be Instagram, and change your password.
Sign 8: Instagram says your account is at risk
Instagram’s page on why it tells you your account is at risk explains that it asks you to change your password when it notices the password is weak or may have been exposed, for example because you used it on another site that had a data breach, or because the account is synced with an unauthorized third-party app. That is not proof of a hack, but the fix is the same, so do it now.
Not a reliable sign: a reset email you did not request
Instagram’s page on password reset emails you didn’t request says receiving one does not necessarily mean your account has been hacked: someone may have typed your email address or username by mistake. Only people who know your password or click the login link in that email can log in. Do not click it, and if you want peace of mind, change the password from inside the app.
What to do first, in this order
If you can still log in:
- Change the password from inside the app. Instagram says any devices logged into your account are logged out when you do.
- Log out unknown devices under Where you’re logged in, in case a session survived.
- Confirm your email address and phone number are yours. If either was changed, use the reversal link in the security email.
- Turn on two-factor authentication, preferably with an authentication app.
- Remove linked accounts and third-party apps you do not recognize.
- Secure your email account. Instagram says anyone who can read your email can probably also access your Instagram account.
- Warn your followers if the attacker posted or sent messages, so nobody acts on them.
Password first, because it ends the attacker’s sessions; everything else is easier once they are out.
If you are already locked out
Go to instagram.com/hacked from a browser and follow the steps. It is the official starting point. Instagram’s recovery steps include a login link sent to your email or phone, a support request, and, for accounts with photos of you, a video selfie. Our guide to recovering an Instagram account after the email was changed walks through the full sequence, and if the attacker turned on their own two-factor, see getting past a 2FA code you no longer receive.
When to get help
If you caught it early and the steps above worked, you do not need anyone. Help is worth it when you are already locked out and the identity check is not working, when the account is a business or creator account with income or ad assets attached, or when the attacker is using it for scams while you wait. Our hacked account recovery service works only through Meta’s official recovery channels and starts with a free case review. We never ask for your password, we do not “hack back”, and we cannot guarantee an outcome, because the decision is Meta’s.
Frequently asked questions
How do I know if my Instagram is hacked?
The clearest signs are a security email about a change you did not make, a device or location you do not recognize under Where you're logged in, posts, comments or messages you did not send, changes in your account history you did not make, and a linked account in Accounts Center that is not yours.
Does a password reset email mean my Instagram was hacked?
Not necessarily. Instagram says someone may have typed your email address or username by mistake, and that only people who know your password or click the link in that email can log in. Do not click the link; if you are worried, change your password from inside the app.
Can someone be logged into my Instagram without me knowing?
Yes, which is why Where you're logged in matters. It lists devices that have recently logged into your account, and you can log any of them out and tell Instagram the login was not you. Login alerts, where available, notify you of new sign-ins from an unrecognized device or browser.
What should I do first if I think my Instagram is hacked?
Change your password from inside the app, which Instagram says logs out every other device. Then log out unknown sessions, confirm your email and phone, turn on two-factor authentication, and remove linked accounts and third-party apps you do not recognize.
Need this handled?
Hacked Account Recovery
This guide connects to our hacked account recovery service. If you would rather have the process managed for you, start with a free case review.