If you can't log in, or posts you didn't write are appearing from your account, don't panic. We've put the steps from the official Instagram and TikTok help pages into a simple order.
- Check your inbox first: an email from security@mail.instagram.com may let you undo an email address change.
- If you can't get in, use instagram.com/hacked; options include a login link, a security code and, if needed, identity verification with a video selfie.
- After you get the account back, change your password, turn on two-factor authentication, and check linked accounts and third-party apps.
Stay calm and go step by step
If you can't log in, your password doesn't work, or posts, comments or messages you didn't send are coming from your account, it may have been taken over. Instagram says there are several actions you may be able to take through the website or the app. Not all of them apply to every account type, but the official page recommends trying them all.
The steps below rely on the Instagram and TikTok help pages as read on October 31, 2026 and re-read in English on November 3, 2026. No step promises a certain result, and menu names can change with the app version.
Checklist for the first 10 minutes
If you are short on time, start in this order. If you can still log in, you can skip straight to the security steps further down.
If your email address or phone number was changed
When the email address on a profile is changed, Instagram sends two emails: one to the original address to deny the change and one to the new address to allow it. If you didn't make the change, you can reverse it using the special link in the email from security@mail.instagram.com sent to the original email address.
If other information, such as your password, was also changed and you can't change back your email address, the official page suggests requesting a login link or a security code. If that doesn't work either, you may be able to request support from Instagram on a mobile device: from the login link screen, tap Can't Reset Your Password? below Send login link, choose your email address or phone number, and tap Send security code; if you don't receive one, tap I can't access this email or phone number. Enter only a secure email address that only you can access; once you've submitted the request, you should receive an email from Instagram with next steps.
Identity verification and the video selfie
If you submitted a support request for an account without photos of you, you should receive an automated email from the Support Team at Meta. It asks you to verify your identity by providing the email address or phone number you signed up with and the type of device you used at sign-up (for example iPhone, Android or iPad).
If the account has photos of you, you'll be asked to take a video selfie of you turning your head in different directions. According to Instagram, the video is used to check that you're a real person and confirm your identity; it will never be visible on Instagram and will be deleted within 30 days. If your identity can't be confirmed, you can submit a new video.
The official page does not state how long the outcome takes, so we can't promise a date.
After you get the account back, or if you can still log in
Instagram's help pages list these steps for when you can log in. Menu names can vary by app version; Instagram is gradually updating people to Meta Accounts, so you may see either Accounts Center or Meta Account settings as the place to manage your account settings.
Warn your friends
Whoever takes over an account can message people in your name and ask your contacts for money, codes or personal information. Instagram's scam page says scammers may compromise existing social media accounts to try to deceive or defraud you or your friends, and it advises caution with urgent messages that ask for money or information.
So tell your contacts through another channel (phone, a messaging app) that your account was taken over, and not to respond to messages that seem to come from you asking for money or codes. You can also tell them to report suspicious messages to Instagram.
To avoid a repeat: watch for phishing messages
According to Instagram's help page, phishing is when someone tries to get access to your account by sending a suspicious message or link that asks for your personal information. These messages often claim your account will be banned or deleted. The official pages advise: don't trust messages demanding money, offering gifts or threatening to delete or ban your account; don't click suspicious links or attachments; and don't answer messages asking for your password or payment information.
Instagram also says it will never send you direct messages about your account in the Instagram app. You can view official Instagram emails sent within the last 14 days in your Instagram Settings. Accounts that claim to be from the Instagram security team and ask for account information, or offer verification badges, are among the warning signs listed in an older Instagram blog post (January 12, 2021). You can report a suspicious email to phish@instagram.com.
If your TikTok account was hacked
According to TikTok, these signs may mean your account has been hacked: your account password or phone number was changed, your username or nickname was changed, your videos were deleted or posted without your permission, or messages you did not write were sent from your account. If you can still get into your account, do the following:
Frequently Asked Questions
What should I do first if I can't log in at all?
First check your email for a message from security@mail.instagram.com. Then request a login link with Forgot password? or use instagram.com/hacked. We can't guarantee that any of these will work; Instagram also says some recovery steps may not be available depending on the type of account.
Why is a video selfie requested, and is it stored?
According to Instagram, the video is requested to confirm that you are a real person and the owner of the account. It will never be visible on Instagram and will be deleted within 30 days.
What happens to my other devices when I change my password?
Instagram says that when you change your password, any devices logged into your account are automatically logged out and you'll need to sign in again. TikTok likewise says you'll be logged out of all other devices once you update your password.
Will Instagram send me a DM with a warning about my account?
Instagram says it will never send you direct messages about your account in the Instagram app. You can check official emails from the last 14 days in your Instagram Settings. If a suspicious message arrives, don't click the link; report it.
What should I check after recovering the account?
Change your password, turn on two-factor authentication, confirm the email address and phone number in your settings, check linked accounts in Accounts Center and third-party app access, and review your sessions and log out of devices you don't recognize.
Sources and review method
The official help pages of Instagram and TikTok were read on October 31, 2026 and re-read in their English versions on November 3, 2026; menu names and steps can change with the app version, and no step guarantees a result. Translated and adapted for an international audience on 2026-11-03.
- Instagram Help Center: If you think your Instagram profile has been hacked — Security email, login link, support request, identity verification, video selfie (30 days) and the steps to take while you can still log in.
- Instagram Help Center: Hacked Instagram Account — instagram.com/hacked as the address for securing your account.
- Instagram: instagram.com/hacked — The find-your-account screen (by username, phone number or email).
- Instagram Help Center: What to do if the email for your Instagram account was changed — Two emails are sent when an email address is changed; reversing it through the security@mail.instagram.com link.
- Instagram Help Center: What to do if your Instagram profile posts unauthorized content — Changing your password, devices being logged out, third-party apps, two-factor authentication, Accounts Center and the move to Meta Accounts.
- Instagram Help Center: Secure your Instagram account — Two-factor authentication as the most effective step, email account security and strong password advice.
- Instagram Help Center: Protect yourself from phishing on Instagram — What phishing is, the ban-threat pattern, not clicking suspicious links, and phish@instagram.com.
- Instagram Help Center: Avoid getting scammed on Instagram — Instagram not sending DMs about your account, the 14-day official email list, login alerts, reviewing sessions, and compromised accounts being used to defraud friends.
- About Instagram: How to protect yourself from phishing and hacking on Instagram (January 12, 2021) — Warning list for fake accounts that offer verification badges or warn of account removal; an older blog post.
- TikTok Support: My account has been hacked — Signs of a hacked account; steps to reset your password, link a phone number and remove suspicious devices.
- TikTok Support: Account safety — Security checkup, 2-step verification, device management, sessions ending after a password change, and recovery with friends verification (at least 2 friends).
Last checked: November 3, 2026. If you spot a mistake, report a correction.