Instagram "Challenge Required" Error: How to Get Back In

You type your password, Instagram flashes "challenge required" (some people see it written as "challenge_required"), and you land back on the login screen. You reset the password, log in with the new one, and get the same message. After the fourth loop it feels as if the account is gone.

It usually is not. In most cases the message means Instagram wants one extra check on this particular login attempt, and the app is failing to show it to you. The fix is to let Instagram run that check properly: from a familiar device, through a login link or security code, or by confirming the login from a device where you are still signed in.

This guide explains what the message usually points to, how to read each screen around it, the order to try the official routes in, and the mistakes that turn a short lockout into a long one. It is written for account owners, not for people running automation tools.

Last checked: 29 September 2026.

#What Does "Challenge Required" Mean on Instagram?

A challenge is an extra security check Instagram puts in front of a login it is not sure about, such as a captcha, a code sent to your email or phone, a login request to approve, or an identity check. No Instagram help page quotes the words "challenge required", so this is our reading of the checks its help pages do describe. The wording varies by app version and region. A password reset rarely clears it because the check is about the login attempt (device, network, app), not the password. The way out is to complete the check through Instagram's own screens; nobody outside Meta can switch it off for you.

#Why a Password Reset Does Not Stop the Loop

A new password proves you can read your email. The challenge is asking something else: whether this login, from this phone, on this network, looks like you. If the answer still looks uncertain, Instagram asks again, and the loop continues with the new password.

Instagram does not list the triggers for this message. From the situations people describe, it tends to follow one of these:

• A new or reset phone, or the app reinstalled after a long break.
• A VPN, a work or hotel network, or frequent switching between networks and countries.
• Many failed login attempts in a short time, including your own retries.
• An old version of the Instagram app that cannot display the newer check.
• A follower, analytics or scheduling app that was given your username and password.
• Someone else trying to log in with your details at the same time.

The third-party app point has official backing. Instagram's page on accounts restricted for data scraping says its systems may flag suspicious behaviour when you have given your username and password to a third-party app or website, such as apps that offer likes or followers. Its third-party apps page puts it plainly: never share your login information with any person or app you do not trust.

#What Each Screen Around the Loop Is Telling You

The loop rarely comes alone. The screens and emails around it tell you which route to take.

If you see "Your account has been disabled" or "We suspended your account" instead, that is not a challenge. Our guide to a disabled or suspended Instagram account covers the appeal.

#The Order to Try: A Troubleshooting Flow

Work down this list and stop at the first step that gets you in. Each step is gentler than the one after it, and skipping ahead tends to trigger more checks, not fewer.

1. Stop retrying for a while. Every failed attempt gives Instagram another reason to be cautious.
2. Update the app, switch off any VPN, and use the phone and connection you normally use.
3. Are you still logged in anywhere, such as an old phone, a tablet or a laptop browser? If yes, go to step 4. If no, go to step 5.
4. On that device, check for a login request and tap Approve. Or open Login activity, find the new attempt, tap "This Was Me" and then Confirm. Then try the new device again.
5. Try instagram.com in your phone's browser instead of the app. A browser sometimes shows the check that the app cannot.
6. On the login screen, tap "Forgot password?", enter your username, email or phone, tap "Send login link", complete the captcha, and open the link from your email or SMS.
7. If the login link does not get you in, request a security code or support from Instagram on a mobile device, and give an email address that only you can read.
8. Complete any identity check Instagram then asks for, as described in the next section.
9. If you think someone else is involved, or none of this works, start again at instagram.com/hacked and pick the option that fits.

Steps 4, 6 and 7 come from Instagram's own pages. Its page on login requests covers approving a login and "This Was Me". Its page on recent login activity shows the newer route through Accounts Center, Password and security, then "Where you're logged in", and notes that not everyone sees these menus yet. The hacked account page describes the login link, captcha and security code request.

#When Instagram Asks You to Prove It Is You

If the login link and code do not work, Instagram may move you to an identity check. According to its hacked account help page, there are two versions:

• For an account without photos of you, an email from Meta's support team asks for the email address or phone number you signed up with, and the type of device you used at sign-up (for example iPhone, Android or iPad).
• For an account with photos of you, you record a video selfie turning your head in different directions. Instagram says the video is never shown on Instagram and is deleted within 30 days.
• If Instagram cannot confirm you from the video, the same page says you can submit a new one for another review.

Instagram's announcement of instagram.com/hacked says the page lets you choose between being hacked, a forgotten password, lost two-factor authentication and a disabled account, and then walks you through steps for that case. If the loop started after you lost the phone with your authenticator app, our guide to recovering accounts after losing your email, phone or 2FA is the better next read.

#If the Code or Login Link Never Arrives

A missing email feeds the loop, because you keep asking for another. Instagram's page on password reset emails that do not arrive gives the likely causes and fixes:

• Check the spam or junk folder, and the promotions tab if your mail app has one.
• If your Instagram and Facebook accounts are linked, Instagram says you can reset through Facebook instead.
• Ask your email provider whether it is blocking mail from the @instagram.com domain.
• Check the address itself. Instagram says that if the email was mistyped when the account was created, it cannot give you access through it.

SMS codes are a separate issue. If your phone suddenly shows no service and codes stop arriving at the same time, call your mobile carrier straight away and ask whether your SIM has been replaced or moved. A SIM swap lets someone else receive your SMS codes, and only your carrier can reverse it.

#Is It a Challenge, or Is Someone Else in Your Account?

Sometimes the loop is a symptom of a takeover: the attacker changed the password or email, and every login from your side looks suspicious. Check three things.

1. Search your inbox for an email from [email protected] about a changed email address. Instagram's page on a changed account email says it sends a message to the original address with a link to reverse the change.
2. If you are still logged in on any device, open Recent emails. Instagram's page on reviewing recent emails says you can see official emails from the last 14 days, split into Security and Other, and lists the domains its security emails come from, including @mail.instagram.com and @support.instagram.com.
3. Look at Login activity for devices or places you do not recognise, tap "This Wasn't Me" and follow the steps to reset the password.

If any of these point to someone else, move to the hacked-account route and act quickly. Our walkthrough of the first hour after an Instagram hack puts the steps in order.

#Mistakes That Keep You Stuck in the Loop

Most long lockouts we see come from what happens around the loop, not the loop itself. Avoid these:

• Retrying the password dozens of times in an hour, which gives Instagram more reason to keep checking.
• Hopping between VPN locations or phones to find one that works.
• Logging in through an unofficial app, a follower tool or a so-called unlock tool. These need your password, and Instagram treats that as a warning sign.
• Typing codes or passwords into a page that a message linked you to, instead of opening Instagram yourself.
• Paying someone who promises to clear the challenge or unban the account for you.
• Sending your password, login link, security code or backup codes to anyone, for any reason.

The Government of Malaysia's NSRC 997 page says the line runs 24 hours and asks victims to call within 24 hours of discovering the scam, so banks can block transactions. For a phishing link or a fake login page with no money lost, CyberSecurity Malaysia's Cyber999 service takes incident reports by online form, email, phone or its mobile app. Our breakdown of fake Meta support accounts shows what the scam messages look like.

#Once You Are Back In: Stop It Happening Again

Getting in is half the job. These steps, drawn from Instagram's own security advice, make the next login less likely to trip a check:

• Change your password if anything looked suspicious. Instagram's scraping page says changing it logs you out of all devices, including logins you do not recognise.
• Remove third-party apps and websites you no longer use or do not recognise.
• Turn on two-factor authentication, save the backup codes somewhere offline, and turn on login requests so you can approve new devices yourself.
• Confirm the email and phone number on the account are current and belong to you.
• Update the app regularly and avoid logging in through a VPN you do not need.

#When Expert Recovery Help Makes Sense

Most people clear this loop on their own. A second opinion helps when the account carries your income, when the loop sits on top of a suspected hack, or when the identity check keeps failing. SocialSafe by AwareXone, our recovery service, looks at what you have already tried and tells you honestly whether an official route is still open. We work only through Instagram's own forms and checks. Our Instagram account recovery service explains the review, and our Trust Center lists what we will never ask you for, starting with your password and login codes.

#Frequently Asked Questions