Instagram "Confirm It's You" Check: How to Log Back In

You open Instagram on your phone and, instead of your feed, you get "Confirm it's you to log in" or "Help us confirm it's you". Some people see "Confirm you're human to use your account", or a notice saying they must confirm their identity before they can send messages. Your password is right, yet the app will not let you in.

This is a security checkpoint, not a ban. Instagram wants proof that a real person, and the real owner, is at the keyboard. Pass the check it shows you, inside the app, and give it an email address only you can read. Most of the work is getting the photo, code or email right the first time.

This guide explains each type of check, what to do when one fails or never arrives, how to tell a real prompt from a phishing copy, and when a Malaysian user should involve NSRC, the police or Cyber999.

Last checked: 29 September 2026.

#What Does "Confirm It's You" Mean on Instagram?

It means Instagram has paused access until you prove you are a real person and the account holder. Depending on the account, it may ask you to solve a captcha, enter a code sent to your email or phone, record a short video selfie turning your head, or upload a photo of your ID. Complete only the check shown inside the Instagram app or on instagram.com, and use a secure email address that only you can access, because Instagram sends the outcome there. The wording varies by app version and region, but the route is the same. Nobody outside Meta, including AwareXone, can pass the check for you.

#Which Check Are You Being Asked For?

Match what you see to a row below. Each check has its own fix.

#If Instagram Asks for a Captcha or a Code

These are the quickest checks to pass. Instagram's hacked account help page describes the login link route: tap "Forgot password?", enter your username, email or phone, complete the captcha "to confirm that you are a real human", then open the link sent by email or SMS.

• Request one code, then wait. Each new request can make the earlier code useless, so type only the most recent one.
• Check the exact email or number Instagram shows on screen. It may be an old address you forgot you used.
• If the code goes to a Malaysian mobile number you no longer have, ask your telco about a replacement SIM for that number. That usually means visiting a branch with your MyKad.
• If two-factor authentication is on and you have lost the phone, Instagram's two-factor authentication page says a saved backup code will let you log in.

If codes are simply not arriving, our guide to Instagram security codes that never turn up goes through the causes one by one.

#If Instagram Asks for a Video Selfie

Instagram's page on why it asks for a video selfie says it uses selfies because photos and IDs can be digitally modified, and that turning your head in different directions shows you are a real person. The same page sets out what happens next:

• While Instagram reviews the video, you will not have access to the account.
• If you pass, you may receive an email at the secure address you gave, with a link to reset your password.
• If you do not pass, you receive an email and may be able to resubmit the selfie in the Instagram app.
• If you choose not to record the selfie, you may not be able to log back in.

The hacked account page adds two points that often worry people. The video is never visible on Instagram and is deleted within 30 days. And the selfie applies to accounts with photos of you; for an account without photos of you, Meta's support team instead emails you to ask for the email or phone you signed up with and the type of device you used at the time.

#If Instagram Asks for Your ID

Instagram's page on why you may be asked to upload an ID lists four reasons: to confirm the account belongs to you, to confirm or edit your age, to process payments, and to help prevent scams or phishing. It says that in most cases you get at least two attempts, that you may temporarily lose access during review, and that in some cases a failed review can lead to the account being disabled.

Its list of accepted ID types includes a passport and a national ID card, so a MyKad fits. Instagram asks for your full name and photo, does not accept photos digitally modified to hide details, and asks you to physically cover information it does not need before taking the picture. It also says sending more documents than required may delay the review.

#Was It Really Instagram? Checking Before You Act

Scammers copy these screens. Before you enter a code or record a video, check the source.

• Instagram's page on reviewing recent emails says you can see official security emails from the last 14 days under Accounts Center, Password and security, Recent emails. If a message is not listed there, treat it as suspect.
• The same page says Instagram will never contact you about account security through Direct Messages, and lists its official sending domains, including @mail.instagram.com and @support.instagram.com.
• Instagram's phishing guidance warns against messages threatening to delete or ban your account, and gives [email protected] for reporting strange emails.
• In Malaysia, fake notices often arrive in BM or Chinese, warning that the account will be "disekat" or "dipadam" unless you verify through a link. The real check lives in the app.

Our walkthrough of fake Meta support messages shows what the common copies look like.

#If You Can Log In but Must Confirm Before Messaging

At the time of writing, some people can use Instagram normally but get a prompt to confirm their identity before they can send DMs. Instagram has no help page quoting that exact prompt, so treat it as a feature limit. Instagram's Account Status page says "Features you can't use" lists what is blocked and lets you take action to resolve it. Open Settings, then Account Status, and follow the step offered there.

#If the Check Keeps Failing or Loops: A Decision Path

Work through these in order.

1. Is the prompt inside the Instagram app or on instagram.com? If it came from a DM, text or unlisted email, stop and check Recent emails first.
2. Can you still receive codes at the email or number shown? If yes, request one fresh code and enter it. If no, recover that inbox or SIM first, because Instagram keeps sending codes there.
3. Did a selfie fail? Wait for the result email, then resubmit once in the app in better light, with glasses and hat off, after updating the app.
4. Did an ID fail? Use a sharper photo of a real document whose name matches the account, with non-essential numbers covered by hand, not edited out.
5. Does the screen say someone changed your email or password? Look for the email from [email protected] and use its "secure my account" option, then use instagram.com/hacked.
6. Were you shown a login you do not recognise? Instagram's login activity page says to tap "This Wasn't Me" and follow the steps to reset your password. Our guide to suspicious login alerts covers that screen.
7. Still stuck? Stop retrying for a day; the result email may be on its way.

#What to Have Ready Before You Start

A check goes faster when you are not hunting for details halfway through. Gather these first.

• A secure email address that only you can open, with a password you have changed recently.
• The username, and if you know them, the email and phone number the account was created with.
• The make and model of the phone you used when you opened the account.
• A valid MyKad or passport showing the name you use on Instagram.
• Screenshots of the prompt and any emails, with the date and time visible.
• Your saved backup codes, if two-factor authentication was on.

Our longer guide to proving you own a social media account explains what else Meta may accept and how to present it.

#Mistakes That Make a Check Fail

• Recording the selfie in a dark room, with a face mask, hat or sunglasses, or moving faster than the prompts.
• Uploading an ID photo with numbers blurred or cropped out in an editing app, which Instagram says it does not accept.
• Giving an email address a family member or former staff member can also read.
• Opening a new account while the old one is under review.
• Paying an "unlock" seller, or handing a login code to someone who says they work with Meta.

#When Should You Report to NSRC, the Police or Cyber999?

A plain identity check needs no report. It becomes a matter for Malaysian authorities when someone tricked you into sharing a code or password, or when money moved.

• If you lost money, the government's NSRC 997 page says to call 997, which runs 24 hours, within 24 hours of discovering the scam, contact your bank, and make a police report at the nearest station.
• If you shared a login code or entered your password on a fake page, CyberSecurity Malaysia's Cyber999 service takes incident reports through its online form, email, phone and mobile app.
• Keep the screenshots, sender addresses and times. Both routes will ask for them.

#When Expert Recovery Help Makes Sense

Most people can clear an identity check on their own with the steps above. A second opinion is worth having when the account carries your business, when a selfie or ID has failed more than once, or when the check started after a hack you are still untangling. SocialSafe by AwareXone, our recovery service, reviews what happened, tells you honestly whether an official route is still open, and helps you prepare accurate details for it. We work only through Instagram's own processes. Our Instagram account recovery service explains how a review works, and our Trust Center lists what we will never ask you for.

#Frequently Asked Questions