The hacker wants money to give your Instagram back: why paying fails and what to do

If a hacker is asking for money to give your Instagram back, do not pay. A payment does not return control of the account: the person still holds the email, phone number or two-factor settings they changed, and nothing stops them from asking again. Instagram’s official recovery at instagram.com/hacked is free, Instagram’s help center tells people facing blackmail to report it and contact local law enforcement, and the FBI says it does not condone paying extortion demands.

This guide covers what to do instead: the evidence to keep, the order to recover in, where to report, and what to do if you have already paid.

The short answer

• Do not pay, not even a small “deposit” to prove good faith.
• Save everything before you block: messages, usernames, emails, payment details they gave you.
• Recover through the official route: Instagram’s security email and instagram.com/hacked.
• Report the extortion to Instagram and the police. In the US, also the FBI’s IC3 and the FTC.
• If they threaten to leak private images, treat it as sextortion, which has its own reporting routes.
• Ignore anyone who offers to “get it back” from the hacker. That is usually the next scam.

How these demands usually work

In the takeovers we work on, the demand arrives in one of four forms:

1. The ransom. “Send this amount and I will give you the login.” Usually in cryptocurrency or gift cards.
2. The countdown. “Pay by tonight or I delete the account,” or “or I post scams to your followers,” or “or I sell your username.”
3. The leak threat. “I have read your DMs. Pay or I publish them.”
4. The second character. Someone appears claiming to be a hacker or “recovery specialist” who can take the account back from the first person, for a fee.

All four rely on the same thing. The FTC’s guide on how to avoid a scam says scammers often insist you pay with cryptocurrency, a wire transfer, a payment app or a gift card, and that they “want you to act before you have time to think.” A deadline is pressure, not information.

Why paying does not get the account back

You would be buying a password, not the account. Control of an Instagram account comes from the email, the phone number and the two-factor method attached to it. If the attacker hands you a password but keeps any of those, they can reset it again whenever they like.

Nothing makes them keep their word. The person demanding money has already shown they will break the rules. In our experience, a first payment is far more often followed by a second demand than by a returned account.

The official sources say the same. In a public service announcement on extortion email schemes, the FBI says it “does not condone the payment of extortion demands as the funds will facilitate continued criminal activity,” and advises people not to communicate with the extortionist. Meta’s Stop Sextortion guidance puts it plainly: “Cooperating or paying rarely stops their threats.”

Paying marks you as a payer. Once someone knows you will send money under pressure, you become worth targeting again.

What to do instead, in order

1. Stop negotiating, but do not delete anything yet

Do not argue, plead or tell the attacker you are recovering the account. Every reply buys them time and tells them what you are doing. Meta’s sextortion guidance gives the right order: block the person, but do not delete your profile or messages.

2. Save the evidence

Before you block, take screenshots that show:

• every message with the demand, with dates and times visible;
• the username and profile of the account that contacted you, and any email address or phone number they used;
• any payment address, gift card instruction or wallet they gave you;
• Instagram’s security emails about changes to your email, phone or password.

The police, the FBI’s complaint form and Instagram’s reviewers all work from this material. Without it, the case is your word against an anonymous account.

3. Recover the account through the official route

Search the inbox that was on the account before the hack. Instagram’s page on a changed account email says it sends a message to the original address from security@mail.instagram.com, with a special link that reverses the change. Then go to instagram.com/hacked: Instagram’s hacked account page says that if someone gains access to your account or you cannot log in, that is where to secure it.

Our guide to recovering an Instagram account after the email was changed walks through the full sequence, including the identity check.

If the threat is deletion, the clock is real but not instant. Instagram’s deletion page says a profile is permanently deleted 30 days after the deletion request, and that the number of days you can cancel varies by region. Recovering quickly is what protects the account, not paying.

4. Warn your followers

The FTC’s guide to recovering a hacked social media account recommends telling friends about the hack and asking them not to click links in emails from you; on Instagram, the same goes for DMs. Use your other channels: a story on another platform, your email list, your website. Attackers who are not paid often turn the account on your followers.

5. Report the extortion

• To Instagram. Its help page on dealing with blackmail says that if someone is threatening to share private information unless you send money, you should report it, and also contact your local law enforcement.
• To the police. Extortion is a crime in its own right, separate from the hack. A police report number also helps with your bank or payment provider if money moved.
• In the US, to the FBI’s IC3. The Internet Crime Complaint Center describes itself as the central hub for reporting cyber-enabled crime, run by the FBI. Be realistic: IC3 says it cannot respond directly to every submission, and complaints may be referred to other law enforcement agencies. File it anyway; it creates a record.
• In the US, to the FTC at ReportFraud.ftc.gov.

Outside the US, your national cybercrime or fraud reporting service, or the police, is the equivalent.

If they threaten to leak private messages or images

This is the version that frightens people most, and the advice is the same: do not pay and do not send anything else. Instagram’s blackmail page says it is wrong and against its rules for someone to share, or threaten to share, your intimate images, videos or messages without your consent. Report the threat, save the evidence, then block.

If the threat involves intimate images, our guide to getting intimate images removed from Instagram and Facebook covers Meta’s priority reporting channel and the tools that stop images from being shared. If the images involve someone under 18, IC3 says crimes against children should be filed with the National Center for Missing and Exploited Children rather than through IC3.

If you have already paid

You are not the first, and it is not too late to act. The FTC’s guide on what to do if you were scammed says to contact whoever handled the payment straight away and ask them to reverse it: the card issuer, the gift card company, the wire transfer company, the payment app, or the cryptocurrency exchange or ATM operator. Then report it at ReportFraud.ftc.gov, and follow the recovery and reporting steps above.

Do not pay a second time, whatever the reason given. And expect a new wave of messages from “recovery experts” once word gets around that you lost money. Our breakdown of recovery scam messages shows the scripts they use.

When to get help

If the security email or instagram.com/hacked gets you back in, you do not need anyone, and you certainly do not need the person holding your account. Help is worth it when the identity check keeps failing, when the account is a business or creator account with income attached, or when the attacker’s activity has led Instagram to restrict or disable it. That is the work behind our hacked account recovery service. We work only through Meta’s official recovery channels, we never negotiate with or pay an attacker, we never ask for your password, and we cannot guarantee an outcome, because the decision is Meta’s. Start with a free case review.