Losing your Instagram is genuinely awful, especially when the person who took it also swapped out your email and phone number so none of the normal reset options reach you.
You still have real options. But speed matters more than most people realise, because stolen accounts get put to work quickly, often within a few hours, sending scam messages to your followers while you are still working out what happened.
Secure Your Email Before Anything Else
This is the step people skip, and it undoes everything that follows.
If whoever took your Instagram also has access to your email, every reset link you trigger goes straight to them. Log into your email account now, change the password, turn on two-factor authentication, and sign out all other sessions.
If you cannot get into your email either, fix that first. Our guide on what to do when Gmail asks for a recovery number you no longer own covers the awkward version of that problem.
Check for the Revert Link, Fast
When someone changes the email on an Instagram account, Instagram sends a notice to the original address saying the email was changed, with a link along the lines of “if this wasn’t you, revert this change.”
That link is the fastest way back in, and it is usually only valid for around 24 hours. Search your inbox and your spam folder for messages from Instagram, and look for anything about a changed email, a changed phone number, or a new login.
If the message is still within its window, click the link and you are most of the way there. If it has expired, move on to the next section rather than dwelling on it.
Try Logging In First
Worth thirty seconds before anything more involved. Some attackers change the contact details but not the password straight away.
Open Instagram, enter your username and your old password. Also check any device where you might still be signed in, like an old phone, a tablet or a browser on a laptop. If you find a live session, change your password from there immediately and remove every other logged-in device.
The Main Route: Video Selfie Verification
This is how most people get their accounts back when the email and phone are both gone, and it has become Instagram’s default check in these cases.
Go to instagram.com/hacked, or in the app tap through Settings and privacy, then Help, then the hacked account option.
Enter your username and any email or phone number that was ever attached to the account, even one the attacker has since removed. Instagram still routes that to a security review.
When the video selfie appears, you will be asked to face your camera, follow a moving dot, and turn your head left and right. Instagram matches that against photos already on your account, usually your profile pictures and tagged photos.
To give yourself the best chance:
- Good lighting, facing a window or a lamp rather than away from it
- No glasses, cap or anything covering your face
- Plain background, no other people in shot
- Follow the on-screen prompts exactly rather than rushing
Typical turnaround is around one to three days, though it can stretch longer when Meta is dealing with high volumes.
One limitation worth knowing: if your account never had clear photos of your face on it, there is nothing for the system to match against, and you will be pushed toward government ID instead. That route works but takes longer, usually several business days.
Friend Verification, If You See It
Some people get offered a second option instead of, or alongside, the selfie.
Instagram asks you to choose a couple of people who follow you. They each get a request to confirm you are who you say you are, and once they respond, codes are sent through them for you to enter.
It does not appear for everyone and you cannot force it to. If you see it, pick people who will actually check their notifications and respond within the hour, not the friend who opens Instagram twice a week.
Pick the Right Option in the Form
Small detail, real consequences.
If your account is still visible and active, and you are simply locked out, choose the option about not being able to reset your password rather than the one declaring the account hacked. Reporting an account as hacked can trigger a precautionary deactivation while Meta reviews it, which makes getting back in slower.
Choose the hacked option when someone else is clearly using the account, posting, or messaging your followers.
Submit Once, Then Wait
Every instinct tells you to submit again, then again from a different phone, then from your laptop.
Don’t. Repeated submissions reset your position in the review queue, and a burst of requests from several devices can get flagged as automated. One clear, complete request from one device gets handled faster than ten frantic ones.
Keep the case number or confirmation email if you get one, and check the inbox you submitted with, including spam.
If Your Account Is Linked to Facebook
Instagram and Facebook accounts are managed together through Meta’s Accounts Centre, which can give you another way in.
Log into Facebook, open Accounts Centre from settings, and see whether your Instagram profile is still listed there. If it is, you may be able to reset the Instagram password from that side.
Do not disconnect the two accounts while you are trying to recover. That link is evidence of ownership, and removing it takes away an option.
Also check Facebook and Threads for unauthorised posts. Attackers frequently spread to linked accounts, and in some cases run paid ads from them, which causes its own problems. Secure Facebook properly before assuming it is untouched.
Business and Creator Accounts
If your account is connected to Meta Business Suite, you have an escalation path most personal accounts do not, and it often moves faster.
Go to Meta’s business help centre and look for the support inbox or chat option. Explain that the account was compromised, give your username, and provide whatever ownership evidence you have, such as the business page it is linked to.
A Meta Verified subscription can open up additional support channels, though it does not guarantee recovery or a faster review, so it is not worth subscribing purely as a rescue attempt.
Tell Your Followers
While you wait, get the word out on WhatsApp, X, Facebook or a new Instagram account.
The reason stolen accounts are valuable is that people trust messages from someone they know. Your followers will be getting investment offers, crypto messages, or urgent requests for money, and they will believe them because your name is on them. Telling people early protects them and limits what the attacker gets out of it.
Ask a few friends to report the account through the app as well. It will not recover it for you, but it does add signal.
Nobody Can Recover It for a Fee
Search this topic and you will find Telegram handles, WhatsApp numbers and websites promising guaranteed recovery, often with a “free case assessment.”
There is no legitimate service that can bypass Meta’s identity checks. Nobody has a back channel. What these operations actually do is take your money, or worse, collect the personal details and ID documents you hand over in the hope of getting your account back.
Anyone advertising themselves as a hacker who can retrieve accounts is running the same scam from the other direction. Meta’s own forms are the only route, and they are free.
If Recovery Fails
Sometimes it does not work, and it is better to hear that plainly than to keep submitting forms for three months.
Start a new account and tell your circle where to find you. You will not be able to reuse your old username while the original account still exists, so pick something close and be consistent about it everywhere. Rebuild from your contacts, WhatsApp groups and other platforms.
Then lock the new one down properly from day one.
Making Your Account Much Harder to Take
Turn on two-factor authentication through an authenticator app rather than SMS, since SMS can be intercepted through a SIM swap. Aegis Authenticator is free, open source, and lets you back up your codes. Instagram also supports passkeys now, which use your fingerprint or face and remove the login code from the equation entirely.
Use a unique password generated and stored in a password manager. Bitwarden and Proton Pass both have genuinely usable free tiers, and our roundup of password managers that run well on cheap Android phones covers the options.
Keep your recovery email and phone current, and protect the email with its own strong password and 2FA. That inbox is the master key.
Be suspicious of links in DMs, especially brand collaboration offers, copyright warnings and messages saying your account will be deleted. Phishing pages that look exactly like the Instagram login are how most of these takeovers start. Check the address bar before typing a password, every time.
Check your login activity monthly under Settings, then Accounts Centre, then Password and security, then Where you’re logged in. Remove anything you do not recognise.
One more that has become relevant recently. Attackers have been feeding public profile photos into AI video generators to produce fake verification selfies and take over accounts that way. You cannot fully protect against a flaw in someone else’s system, but being thoughtful about how many clear, well-lit face photos you post publicly is a reasonable precaution, and it is another reason to keep your email and password security tight rather than relying on the account’s own defences.
A few broader phone security habits are worth building in too, particularly if your phone holds your banking apps as well.
Secure your email, check for the revert link, then go to instagram.com/hacked and complete the video selfie in good light. Submit once and let it run. Most people who get their accounts back do it exactly that way, without paying anyone a naira.
