How to Report a Hacked Instagram Account
If your Instagram account has been compromised, acting quickly can limit damage, protect your followers, and improve your chances of recovery.
This guide explains how to report a hacked Instagram account, what Instagram looks for during review, and the extra steps that help secure your identity and content.
A hacked account can be used for scams, phishing, impersonation, or spam in minutes, so the reporting process matters just as much as password recovery.
Knowing which forms to use, what evidence to gather, and how to verify your identity can make the difference between a fast resolution and a prolonged lockout.
What counts as a hacked Instagram account?
Instagram considers an account hacked when someone gains unauthorized access to your profile, changes login details, takes over your session, or posts without your permission.
Common signs include a changed email address, altered phone number, suspicious direct messages, unfamiliar posts or Reels, and login alerts from unknown locations or devices.
Sometimes the issue is not full account theft but partial compromise, such as unauthorized access to your linked email, Facebook account, or phone number.
Because Instagram accounts are often connected to Meta Accounts Center, a breach in one service can create a chain reaction across multiple profiles.
How to report a hacked Instagram account?
The main way to report a hacked Instagram account is through Instagram’s in-app recovery flow or the official account recovery page.
Instagram typically asks you to confirm ownership, verify your identity, and explain what changed on the account.
Report it from the Instagram app
- Open Instagram on the login screen.
- Tap Forgot password? or Get help logging in.
- Enter your username, email, or phone number.
- Follow the prompts for a hacked account or suspicious login.
- Choose the recovery method Instagram offers, such as email, SMS, or video selfie verification.
Use Instagram’s hacked account recovery page
- Go to Instagram’s official recovery page in a browser.
- Enter your username, email, or phone number linked to the account.
- Select the option that says you think your account has been hacked.
- Complete the identity verification steps.
- Submit the request and monitor your inbox for follow-up instructions.
If the hacker changed your email address, Instagram usually sends a message to the original email with a link to revert the change.
Check spam, promotions, and junk folders because recovery messages can be filtered automatically.
What information should you prepare before reporting?
Having the right details ready can speed up the review process.
Instagram may use this information to confirm that you are the rightful owner and that the request is legitimate.
- Your Instagram username and display name
- The original email address and phone number associated with the account
- Approximate date and time when access was lost
- Names of recent followers, posts, or DMs that seem suspicious
- Proof of identity if requested, such as a government-issued ID
- Any screenshots showing password changes, emails, or login alerts
Keep records of the original profile name, profile photo, bio, and linked websites.
These details can help support your claim if the hacker changes visible profile information.
How does Instagram verify ownership?
Instagram uses a mix of automated and manual checks to determine whether a recovery request is valid.
The platform may compare prior login behavior, the device used to submit the request, linked contact data, and any identity documents you upload.
In some cases, Instagram requests a video selfie to confirm that you are a real person and match the account’s photos.
This verification is commonly used when email and phone recovery options are no longer available or have been changed by the attacker.
If the account is linked to Meta’s ecosystem, having access to your Facebook account, email account, or phone number can improve the odds of successful recovery.
Make sure those accounts are also secured, because attackers often target them first.
What to do immediately after you report it
Reporting is only one part of the response.
You should also reduce the hacker’s ability to cause further harm while recovery is in progress.
- Change the password for your email account first.
- Enable two-factor authentication on email, Instagram, and Facebook.
- Review active sessions and log out of unfamiliar devices.
- Warn contacts not to click suspicious links sent from your account.
- Check whether your phone number or recovery email was changed.
- Remove suspicious third-party apps connected to Instagram.
If you still have partial access, remove unknown login methods and check the Account Center for connected profiles and permissions.
Attackers often add their own email, phone number, or recovery device to keep control even after the password is reset.
Should you report impersonation and scams separately?
Yes.
If the hacked account is being used to impersonate you, send scam messages, or post fraudulent content, you may need to file additional reports within Instagram.
This helps moderators identify the harm and can support faster enforcement actions.
For impersonation, ask trusted friends or followers to report the profile using Instagram’s impersonation reporting tools.
If the hacker is sending phishing links or financial scam messages, report each message thread and post that violates Meta Community Standards.
How long does Instagram recovery usually take?
Recovery times vary based on the severity of the compromise and the completeness of your evidence.
Some users regain access in hours, while others wait several days or longer if additional verification is needed.
Delays are more likely when the attacker has changed the email, phone number, password, and authentication method at the same time.
Clear documentation, rapid reporting, and consistent follow-up usually improve the process.
What if Instagram does not respond?
If you do not receive a response, resend the recovery request through the official channels and double-check that you are using the correct email address.
Also verify that no messages from Instagram are being filtered or blocked by your email provider.
You can strengthen the case by securing your email account, documenting unauthorized changes, and asking followers to report the hacked profile.
If the account is part of a business, notify collaborators and update any social links, ad accounts, or login permissions tied to the profile.
How to prevent future account takeovers
Once the account is restored, focus on reducing the risk of another attack.
Instagram security problems often begin with reused passwords, weak authentication, or phishing links disguised as verification notices.
- Use a unique password generated by a password manager.
- Turn on two-factor authentication with an authenticator app instead of SMS when possible.
- Review login activity regularly.
- Avoid logging in through suspicious third-party apps or fake support pages.
- Keep your email account locked down with strong authentication.
- Check Account Center and app permissions every few weeks.
For creators, businesses, and public figures, it also helps to maintain backup admin access, separate work email addresses, and offline records of account ownership details.
These safeguards can shorten recovery time if an incident happens again.
When should you contact additional support?
If the hacked account contains sensitive business data, payment information, or personal identity details, consider contacting your email provider, mobile carrier, and financial institutions right away.
If the attacker used your Instagram account to run scams, you may also need to preserve evidence for law enforcement or fraud reporting.
In high-risk cases, the fastest path is often parallel action: report the hacked Instagram account, secure the connected email and phone number, alert your audience, and document every unauthorized change.
That layered response improves both recovery and damage control.