Someone got into my Instagram: what to do, step by step

The typical sequence runs like this: somebody gets your password, logs in, changes the email on the account and turns on their own two-factor. Within minutes the account has stopped being yours in any practical sense, even though the profile picture is still you.

What you do in the first few minutes matters more than everything else combined.

If you can still get in

Work in this exact order:

1. Change the password. Genuinely new, not a variation on the old one. How to build one that holds is in how to create a secure password.
2. Log out everywhere else. In Instagram: Settings → Accounts Centre → Password and security → Where you’re logged in. End every session you do not recognise. Without this step, changing the password does not evict whoever is already inside.
3. Check the email and phone attached to the account. If they were changed, put yours back.
4. Turn on two-factor using an authenticator app, not SMS.
5. Review connected apps and revoke anything you do not use.
6. Check your email account for a forwarding rule they may have left behind. That is the trick that lets them back in later.

If you are already locked out

First: search your email for the Instagram notice. When someone changes the address on an account, Instagram emails the old address along the lines of “if this wasn’t you, reverse the change”. That link is the fastest route there is. Search for “Instagram” in your inbox, and in the bin and spam folders too.

Second: the compromised-account form. On the login screen, Forgotten password? leads to the recovery options. If none of them work, there is a “Need more help” route that opens the compromised-account process.

There, Instagram may ask for two things:

• A code sent to the email or phone the account originally had.
• A video selfie, turning your head, to compare against your profile photos. It is awkward, but it is the method that works best once you control neither the email nor the phone.

Third: patience and consistency. Reply to every automated email that arrives, and do not open ten parallel requests — that tends to slow the process rather than speed it up.

Be careful what surfaces when you search for help. Profiles and adverts promising to “recover your account in 24 hours” for a fee are, in virtually every case, a second scam stacked on the first. Instagram has no intermediaries.

Warn your contacts

Do it straight away, through another channel: a WhatsApp group, a phone call, another network.

Whoever controls the account will use it to message your contacts asking for money, a verification code, or an urgent favour. And it works, because the message arrives from your real account. A timely warning is what stops someone close to you losing money.

How they got in, almost certainly

Three causes cover the vast majority:

A reused password. It was in a breach at another service and someone tried it here. Textbook credential stuffing. Check it with the leaked password checker.

Phishing. A link imitating Instagram — a supposed copyright notice, a verification, a prize — and a fake login screen. The tells are in how to spot a phishing email.

The gifted code. Someone messaged you posing as a friend or as support and asked you to pass on the code you had just received. No service ever asks for that code. None.

Making sure it does not happen again

• A unique password for Instagram, different from your email password.
• Two-factor with an authenticator app. SMS beats nothing, but it is the weak link, as explained in two-factor authentication explained.
• Store the recovery codes somewhere other than the phone itself. If you lose it, they are what save you: you lost the phone with your two-factor codes.
• Protect the email first. If they get into your email, the Instagram account follows regardless.

The short version

• Still logged in: new password, end all sessions, restore email and phone, enable two-factor.
• Locked out: find the email-change notice first, it is the fastest route.
• The video selfie is the mechanism that works when you control nothing else.
• Nobody charging a fee can recover your account. That is a second scam.
• No service ever asks you to pass on a verification code.