Instagram hacked and then disabled?

First secure your email, then use Instagram's hacked account help at instagram.com/hacked. Once Instagram can see the account is yours, disagree with the disabled decision and say clearly that someone else took over the account. Keep every security email as proof. Do not pay anyone who offers to "recover" it.

What usually happened

Someone got into your account, often through a fake login page, a reused password or a message that looked like it came from Instagram. They then changed your email or password, posted spam or scams, or sent messages to your followers. Instagram judged the account on what it did, and disabled it.

Two problems are now stacked on top of each other: you have lost the login, and the account is disabled. You need to solve them in that order.

Hacked, disabled, or both?

Instagram's help pages give a simple test. A disabled account shows a message when you try to log in. If you see no such message but still cannot get in, someone may have taken over the login. If the account was deleted, by you or by someone with your password, Instagram says there is no way to restore it. So act while it is only disabled.

Step 1: lock the doors

1. Secure your email account first. Change its password and turn on two-factor authentication. Attackers often keep coming back through your email.
2. Look for an email from [email protected] saying your email address was changed. Instagram's help pages say you may be able to undo the change with the "secure my account" link in that email. Check that it really comes from that address.
3. Change the password everywhere you used the same one.

Step 2: get Instagram to see it is yours

1. Go to instagram.com/hacked in a browser and follow the steps.
2. Request a login link from the login screen if you still know the username, email or phone number.
3. Do the identity check if asked. For accounts with photos of you, Instagram may ask for a video selfie. Instagram says it is never shown on the platform and is deleted within 30 days. For other accounts it may ask for the email or phone you signed up with and the type of device you used.

Meta's account integrity policy says it may ask for more information about accounts that look compromised. Answer every request quickly and from a secure email address.

Step 3: appeal the disabled decision

Log in and follow the on-screen instructions to ask for a review. In the text, keep it short and factual:

• the date you lost access
• what the attacker changed (email, password, username, posts)
• that the content or messages that broke the rules were not yours
• what you have done since (new passwords, two-factor authentication)

Attach or keep screenshots of the security emails, login alerts and messages from friends who received spam from you. Then switch on two-factor authentication on Instagram as soon as you are back in. More on proving a mistake in Instagram banned you by mistake, and on the disabled process in Instagram account disabled.

The EU route

If you live in the EU, the Digital Services Act (DSA) gives you a clear statement of reasons, a free internal complaint for at least six months, and the right to a certified dispute body. Note that Appeals Centre Europe says it does not take cases about hacked accounts. User Rights and Platform Control list Instagram and take account suspensions; ask them whether your case fits. You can also ask Meta for a free copy of your personal data under the GDPR, answered within one month. It can show logins you did not make. The courts stay open too. Outside the EU, Instagram's own hacked account and review steps are your main route. All options are on the Instagram page.

Watch out for "recovery" scams

After a hack, fake "recovery experts" appear in comments and DMs. They ask for money, your password or a login code. Never pay, never share a code, and only use Instagram's own pages.

Checked against: help.instagram.com, help.instagram.com, transparency.meta.com, appealscentre.eu