Tutorials · 11 min read

How to Recover a Hacked Instagram Account (Even If the Email or Phone Was Changed)

Q: How do I recover my Instagram account without a phone number?

If you still have the email address on the account, tap Forgot password? and send the login link to that email. If you have neither, use instagram.com/hacked.

Q: How do I recover a hacked Instagram account without the password?

Tap Forgot password? on the login screen and request a login link to your email or phone. You don't need the old password.

The official recovery routes for every situation, from a changed password to a lost two-factor code, plus how to spot fake recovery services and lock the account down afterwards.

By AIToolBase Editorial Team · Published 2026-11-03

Instagram's dark-mode web login page with username and password fields, a Log in with Facebook link and a Forgot password? link, with a blurred phone showing the Instagram app info screen in the foreground

Short answer: To recover a hacked Instagram account, first look in your inbox for an email from security@mail.instagram.com about an email change and use its link to reverse the change and secure your account. If that does not work, tap Forgot password? on the login screen and request a login link. If the hacker changed your email or phone number so the link no longer reaches you, go to instagram.com/hacked in a browser and follow the on-screen steps, which may include a video selfie to confirm your identity.

This guide is for anyone locked out of a personal or creator account after someone else got in. Each situation has its own fix, so start with the table below. The steps come from Instagram's and Meta's help pages, checked on November 3, 2026.

Nobody outside Meta can recover an Instagram account for you. If someone asks for your password, a login code, a backup code or a fee to "get it back", they are trying to take your money, your account, or both.

Which Situation Are You In?

Your situation	What to do first	Section
You can still log in, but something is wrong	Change the password and secure the account right away	After you get back in
Password was changed, but your email/phone still work	Tap Forgot password? and request a login link	Step 2
Hacker changed the email address	Open Instagram's email from security@mail.instagram.com and use its link to reverse the change	Step 1
Hacker changed email and phone, or you no longer have either	Use instagram.com/hacked and verify your identity	Step 3
Two-factor code goes to a phone or app you can't use	Use a saved backup code; otherwise use instagram.com/hacked	Two-factor problems
Account shows as disabled	Recover access first, then request a review by logging in	Disabled account
Hacker requested deletion	Recover access before the cancellation period ends	Deleted account

If your email account was hacked too, recover it first. Instagram's security page puts it plainly: "Anyone who can read your email can probably also access your Instagram account." Our guide to recovering a hacked Gmail account covers that part. Meta also says its recovery systems recognize the devices and locations you usually use, so, in our view, try recovery from a phone or computer you have used before.

Step 1: Use Instagram's Security Email to Undo an Email Change

When an account's email changes, Instagram emails the new address to confirm and the original address so its owner can deny the change. That second message is your fastest way back.

Open the inbox of the email address that used to be on your Instagram account.
Search for security@mail.instagram.com, including spam folders.
Open the message about the email change.
Select the link to reverse the change and secure your account. Instagram's hacked-account page calls this option Secure my account.
Follow the on-screen steps.

Instagram does not state a deadline for this link, so use it as soon as you find it.

Phishing emails can imitate this message. Check that the sender is security@mail.instagram.com and the link goes to instagram.com, and never reply with your password or a code.

If the hacker also changed your password and you cannot undo the email change, move to Step 2.

Use this when the hacker changed only the password, or your email or phone still belongs to you. Instagram lists the same steps for the iPhone and Android apps, a computer and a mobile browser at instagram.com:

On the login screen, tap Forgot password? (shown as Forgotten password? in some regions).
Enter your username, email address or phone number.
Tap Send login link, complete the captcha if one appears, and tap OK.
Open the link sent by email or text message and follow the on-screen steps.

You can start with only your username, but the link goes to the email or phone currently on the account. If the hacker replaced both, it reaches them, not you. If the link doesn't work, Instagram says you may be able to request a security code or support on a mobile device, using an email address only you can access.

Step 3: When the Hacker Changed Your Email or Phone Number

This is the hardest case. The official route is instagram.com/hacked.

Open instagram.com/hacked in a phone or computer browser.
Choose the option that best describes your problem.
Enter the details it asks for, such as your username and your original contact information.
When asked for an email address to contact you, give a secure one that only you can open. If your old inbox is compromised, use a different address you fully control.
Follow the on-screen steps. Instagram will either send you a login link or code, or start an identity check.

This short walkthrough shows the flow on Instagram's own recovery pages and notes that the app often pushes you into Meta's AI support assistant instead:

How To Recover Hacked Instagram Account Without Email Or Phone Number (2026) — Trevor Nace

Instagram's help pages do list Chat with Meta AI support assistant as an official option. Meta says it can reset passwords, but that login help through it started with select cases in the US and Canada.

One honest limit: Instagram's lost-access page says that if you can't reach your registration email and never linked Facebook, it is "unable to give you access to the account" by that route. For hacked accounts, identity verification is the remaining official option, with no guarantee.

How identity verification and the video selfie work

What Instagram asks for depends on whether your account has photos of you:

Without photos of you: an automatic reply asks for the email or phone number you signed up with and the device type you used then.
With photos of you: you record a video selfie turning your head in different directions. Instagram emails your secure address afterwards, and you can submit a new video if verification fails.

Instagram says the video only confirms you are a real person and the owner, is never shown on Instagram, and is deleted within 30 days. Meta's face-recognition page adds that it may compare the selfie with your profile photos, asks for separate consent each time, and deletes the facial data as soon as the comparison ends. Without a match, or if you decline, the selfie may be reviewed manually or you may be asked to verify another way.

Two-Factor Authentication Problems

If the login code goes to a lost phone, an old number or a deleted authenticator app, use a backup code. Instagram says that if a code can't be sent, "you'll still be able to complete the process with a backup code."

Backup codes can only be viewed while logged in, so if you never saved any, use instagram.com/hacked and the identity check. The same applies if the hacker turned on two-factor authentication with their own phone: the codes go to them.

Instagram Hacked and Disabled

A hacker's spam can get an account disabled for breaking Community Standards. Instagram says "you may be able to ask us to review the decision by logging in to Instagram" and following the on-screen instructions. So regain access first, then request the review and explain that the account was taken over. Instagram gives no deadline or review time, so do it promptly, and ignore sites selling "appeal forms".

The Hacker Deleted Your Account

Deletion is not instant. Instagram says the profile is permanently deleted "after 30 days of your profile deletion request," and that the number of days you can cancel "varies by region." Recover access fast and sign in before that window ends; signing in is how a deletion request is cancelled. After that, Instagram says "you won't be able to retrieve your information." Our guide to deleting an Instagram account explains the window in detail.

Instagram Support Numbers and "Recovery Experts"

Is there an Instagram hacked support number? No. Meta's phone-support policy says it "doesn't have a general public phone number available for customer service" for Facebook and Instagram. It warns: "Phone numbers claiming to be for Meta customer support are potentially scams and should be avoided."

Meta Verified: subscribers get email and chat help from human agents, and some plans may include phone support. In our view, it mainly helps if you subscribed before the hack, since support is tied to the subscribed account.

Scams to ignore:

"This hacker recovered my account" comments: in our view, treat them as ads for scammers.
DMs offering help: Instagram has said it "will never send you a DM" about your account (2021 safety post).
Friends asking you to forward a code or link: a compromised account is usually trying to take over yours.
Paid "recovery services": our recommendation is never to pay. The official routes in this guide are free.

Report suspicious messages by pressing and holding them and choosing Report.

After You Get Back In: Lock the Account Down

Do this in one sitting. Most steps come from Instagram's hacked-account page and match our hacked-account checklist.

Change your password to a strong one you use nowhere else.
Log out other sessions. In Accounts Center → Password and security → Where you're logged in, select your account, choose Select devices to log out, pick any device you don't recognize and tap Log out. If you don't see this, Instagram's fallback is Settings → Login activity, where you can mark logins as This wasn't me.
Check your email and phone number and remove anything the hacker added.
Remove unknown linked accounts in Accounts Center.
Revoke suspicious third-party apps and websites.
Turn on two-factor authentication. Go to Accounts Center → Password and security → Two-factor authentication, select the account and choose a method. Instagram recommends an authentication app such as Google Authenticator or Duo Mobile (set up in the iPhone or Android app).
Save backup codes from Additional methods → Backup codes somewhere you can reach without your phone.
Check posts, Stories and DMs, delete anything the hacker posted, and warn friends they messaged.

Some people see Meta Account settings instead of Accounts Center.

How to Prevent Another Hack

Instagram calls two-factor authentication "the single most effective step to protect your account from hackers." When attackers abused Meta's AI-assisted recovery in 2026, Meta said accounts without it could be logged into after the fraudulent reset.

Use an authenticator app, not only SMS, and keep backup codes offline.
Secure your email with its own strong password and two-step verification.
Use a password manager so every password is unique.
Never share codes or reset links, even with friends.
Log out on shared devices and connect only apps you trust.

For more, browse our security tools category.

Frequently Asked Questions

How do I recover my Instagram account without email and phone number?

Use instagram.com/hacked with a secure email only you control. Instagram may ask for a video selfie, or for your sign-up email or phone and device.

How do I recover my Instagram account without a phone number?

If you still have the email address on the account, tap Forgot password? and send the login link to that email. If you have neither, use instagram.com/hacked.

Can I recover my Instagram account with only my username?

You can start the login-link flow with it, but the link goes to the email or phone on file. If the hacker changed those, use instagram.com/hacked.

What do I do if Instagram was hacked and the email was changed?

Use the link in the security@mail.instagram.com email in your original inbox to reverse the change. If that fails, use instagram.com/hacked.

How do I recover my Instagram account without backup codes or my authenticator?

If you never saved backup codes, use instagram.com/hacked and the identity check; there is no official shortcut around two-factor authentication.

Can I recover my Instagram account with face recognition?

Possibly. With your consent, Meta may compare a video selfie with your profile photos, then delete the facial data after the comparison.

My Instagram was hacked and disabled. What should I do?

Recover access first, then log in and follow Instagram's on-screen option to request a review, explaining that the account was taken over.

Can I recover my Instagram account after the hacker deleted it?

Only if you regain access and log in before the cancellation period ends. Instagram says the period is 30 days but varies by region; after that, the account can't be retrieved.

Is there an Instagram hacked support number?

No. Meta has no general public phone number for Instagram and warns that numbers claiming to be Meta support are potentially scams.

How do I recover a hacked Instagram account without the password?

Tap Forgot password? on the login screen and request a login link to your email or phone. You don't need the old password.

Sources

Reviewed on November 3, 2026, against Instagram's and Meta's help pages. Meta changes recovery flows, Accounts Center labels and its AI support assistant often, and the deletion cancellation period varies by region, so follow the screens you actually see.