How to Recover a Hacked or Disabled Instagram Account (2026 Guide)
Losing access to your Instagram account is a horrible feeling. One minute you are scrolling, the next you cannot log in, your password does not work, or friends are messaging you about strange posts you never made. Take a breath. In most cases you can get your account back if you act quickly and follow the right steps in the right order.
This guide walks you through the full recovery process for 2026, including the harder cases where the hacker has already changed your email, phone number, or turned on two-factor authentication. It also covers what to do if your account was disabled, not just hacked, because the fix is completely different. And it warns you about the recovery scams that target people in exactly your situation.
First, work out what actually happened
Before you try to fix anything, figure out which problem you have. People waste hours on the wrong solution because they assume “hacked” when it is something else.
Hacked: Someone else has control of your account. You cannot log in, your password or email was changed, or there are posts, messages, or follows you did not make.
Disabled or suspended: Your account is gone, and you may see a message saying it was disabled or suspended for breaking Instagram’s rules. This often happens after a hacker posts scam content and Instagram removes the account. This needs an appeal, not a password reset.
Deactivated: The account is temporarily switched off. Usually the user did this themselves, or it is a temporary block. This is the least serious case.
If you cannot log in and your details were changed, you are dealing with a hack. If the account has vanished after suspicious activity, it may be disabled. Read the matching section below.
Do these things in the first five minutes
Speed matters at the start, because some recovery options have a short time window.
Check your email inbox. Look for a message from security@mail.instagram.com. If it tells you your email was changed, it usually contains a “secure my account” or “revert this change” link. Clicking it can undo the change and lock the hacker out, but this window is short, so do it immediately.
Try logging in normally. Sometimes a hacker changes only one small detail, or your session is still active on another device. It is worth a quick attempt before assuming the worst.
Secure your email account first. This is the single most missed step. If the hacker also controls the email linked to your Instagram, they can simply reset your account again after you recover it. Change your email password and secure that inbox before you go further.
Do not pay the hacker and do not negotiate. If someone is demanding money to return your account, there is no guarantee they will, and you will just lose the money too.
The official recovery steps, in the right order
Instagram has a specific recovery flow. Doing these steps out of order, or hammering the system from several devices at once, can get you flagged as suspicious and extend your lockout. Go through them calmly, one at a time.
- On the login screen, tap “Forgot password?” and request a login link or reset code to your email or phone number.
- If that does not work, tap “Get more help” (or “Need more help?”) below the login fields, then choose “My account was hacked.” This path is built specifically for compromised accounts.
- When asked, enter a secure email address that only you can access. This is where Instagram sends your next steps, so do not use an inbox you think might be compromised.
- Complete the identity verification if Instagram asks for it.
- If your account has photos of you, Instagram may ask for a short video selfie, where you turn your head in different directions so it can confirm you are a real person and match you to the account. This video is never shown publicly and is deleted within 30 days.
For many people, this flow restores access within a few days.
If the hacker changed your email and phone number
This is the hardest and most searched situation, and it is still recoverable.
Even when both your email and phone have been changed, the “My account was hacked” form routes your case to a security review. The key is identity verification. Instagram will use the video selfie, or a government-issued ID, to confirm you are the real owner.
Be patient here. Timelines vary from around a day to a couple of weeks depending on the case. The biggest mistake is submitting the same request over and over from different phones and browsers. Instagram reads that as suspicious behaviour, which slows everything down. Submit one clean request, then wait for the reply before trying again.
If the hacker turned on two-factor authentication
If a hacker enabled their own two-factor authentication, you will hit a verification screen you cannot pass. On that screen, look for a “Need more help?” or “Get more help?” link. This routes you to identity verification instead, which is the path around attacker-set 2FA.
If you set up two-factor authentication yourself before the hack and saved backup codes, use those. If the account was compromised before you ever set up 2FA, those codes will not help, so go straight to the identity verification route.
If your account was disabled or suspended
In a lot of hacks, the attacker posts scam content and Instagram automatically disables the account for breaking its rules. Now you have two problems at once: you need to recover access, and you need to appeal the disable. These are separate processes. Recovering your login does not undo a disable, and appealing a disable does not hand you back control if the hacker still has the password. Handle both.
For the appeal itself, you have two routes, one free and one paid.
The free route: appeal through Instagram’s support tools. When you try to open a disabled account, Instagram usually shows you whether you can appeal and gives you a form. In 2026, Meta’s in-app AI support assistant has become the preferred appeal route, and it generally gets reviewed faster than the older email appeals. Keep your appeal calm and factual. Include your username and account details, acknowledge the issue professionally if you know what triggered it, briefly explain why the account matters, and offer to verify your identity. Avoid angry or emotional appeals, and do not spam resubmissions. Wait a couple of days between attempts, since many accounts come back on the second or third try, not the first.
The paid route: Meta Verified for faster support. One tactic that genuinely helps with disabled accounts is subscribing to Meta Verified, which includes a live support channel. Reaching an actual person is the hardest part of a disabled-account case, and this is one of the few reliable ways to do it. If your main account is the one that is disabled, you can subscribe on another account you own, or a new one, then contact support through that subscribed account and ask about your case. Many people have used exactly this method to get a disabled account looked at when the standard forms went nowhere.
Be clear on what it does and does not do. It gets you a faster, real conversation with Meta support, which on its own is a big advantage. It does not guarantee your account comes back, since that still depends on why it was disabled in the first place. And it is completely different from paying a third-party “recovery agent.” Paying Meta directly for their own support is legitimate. Paying a stranger who promises to recover your account for you is almost always a scam.
Try recovering through Facebook or Meta Account Center
If your Instagram is linked to a Facebook account through Meta Account Center, and you still control that Facebook account, you may be able to recover Instagram through there. On the login screen, the “Log in with Facebook” option can sometimes bypass the hacker’s password entirely. You can also start from Meta’s Account Recovery Hub, which handles Facebook, Instagram, and Threads in one place.
If both your Facebook and Instagram were hacked, secure and recover the Facebook account first, then use it to pull Instagram back.
Watch out for recovery scams
This part matters as much as the steps above, because people searching for help are exactly who scammers target.
Real help from Meta only comes through official channels: the Instagram Help Center, instagram.com/hacked, the Account Recovery Hub, and the Meta Verified support channel if you subscribe. Keep these rules in mind:
- Instagram will never contact you through a direct message about account security. Anyone who DMs you offering to “restore” your account is a scammer.
- Fake “Instagram support” phone numbers appear in Google and YouTube ads. The FTC warns that recovery and refund scams like these are among the most common ways people lose money after a hack. Instagram does not offer phone support for this.
- Ignore the “$9.99 recovery playbooks,” AI “appeal generators,” and Telegram agents that flood these search results. Anyone promising guaranteed recovery within an hour for a fee is lying. No service can jump ahead of Meta’s own review queue.
When you are stressed and locked out, a confident stranger promising a quick fix is tempting. Do not fall for it. Stick to the official routes above.
Once you are back in, lock it down
Getting back in is only half the job. Secure the account properly so it does not happen again the same day.
- Set a new, strong password that you do not use anywhere else.
- Log out of all unknown sessions or devices in your security settings.
- Turn on two-factor authentication, and use an authenticator app rather than SMS where possible.
- Check which third-party apps have access and remove anything you do not recognise.
- Confirm your recovery email and phone number are yours and correct.
How to avoid getting hacked again
Most Instagram hacks come from a few predictable sources, and knowing them protects you.
Phishing is the biggest one. Watch for fake emails claiming a copyright violation on your post, or offering a verification badge, both designed to steal your login when you click through. Instagram will not ask for your password by email.
Password reuse is the next. If you use the same password on Instagram and on a site that later gets breached, attackers run those leaked details across other platforms until one works. Use a unique password for Instagram.
For businesses, this risk is higher, because a hacked account can mean lost customers and scam messages sent to your followers. If you run active business accounts and want them managed and kept secure properly, that is part of what our social media team handles for clients in Oman.
FAQ
Can I recover my Instagram account if the hacker changed my email?
Yes, in many cases. First check for a security email from Instagram with a link to reverse the change. If that window has passed, use the “My account was hacked” flow, which still routes to a security review and identity verification even when your email was changed.
How long does Instagram account recovery take?
It varies. Simple cases where you still have your email or phone can resolve in minutes to a couple of days. Harder cases needing identity verification usually take anywhere from a day to a couple of weeks.
Can I recover a hacked account with no access to my email or phone?
Yes, through identity verification. If your account has photos of you, the video selfie is usually the fastest route. Otherwise Instagram may ask for a government-issued ID.
Does Meta Verified help recover a disabled account?
It can help you reach support faster, since it comes with a live support channel, and reaching a human is the hardest part. You can subscribe on another account to contact support about your disabled one. It does not guarantee recovery, since that depends on why the account was disabled, but it is a legitimate route, unlike paying a third-party agent.
Should I pay a recovery service to get my account back?
Paying Meta directly through Meta Verified for their own support is fine. Paying a random third-party service or agent is not. Most “guaranteed recovery” services are scams. Never trust anyone who DMs you or promises instant results for a fee.
What if my account was deleted, not just hacked?
If the account was disabled by Instagram, appeal through the official process, which is separate from password recovery. If it was fully deleted, recovery may not be possible, but it is still worth going through the official flow before giving up.
The bottom line
A hacked or disabled Instagram account feels like an emergency, and it is stressful, but the path back is usually clear. Secure your email first, use only Instagram’s official recovery and appeal routes, work through the steps in order, and never trust a stranger promising a shortcut. Once you are back in, lock the account down properly so it does not happen again.
