Hacker Changed My Instagram Email and Phone: What Now

An email arrives saying the email address on your Instagram was changed. You did not change it. You try to log in and the password no longer works, and the reset goes to an address you have never seen. Sometimes the phone number is gone too.

The short answer: look in your original inbox for the message from [email protected] and use its link to reverse the change. If that fails, secure the mailbox, then request a login link or go to instagram.com/hacked. Do this soon, and do it only through Instagram's own screens.

This guide explains why Instagram sends two emails, what to do when the reverse link does not work, how to tell a real notice from a fake one, and where the official routes end.

Last checked: 29 September 2026.

#What Should You Do If a Hacker Changed Your Instagram Email and Phone?

Open the inbox that used to be on the account and find the email change notice from [email protected]. Instagram's hacked profile help page says you may be able to undo the change by selecting "secure my account" in that message. If the attacker also changed the password and the reverse link does not get you back in, request a login link from the login screen, or visit instagram.com/hacked and follow the on-screen instructions. Before either, change the password on the email account itself. Nobody outside Instagram, including AwareXone, can move the account back to you.

#Why Instagram Sends Two Emails When the Email Changes

Instagram builds in a safety net for exactly this situation. Its page on what to do if your email was changed says that when the profile email changes, it sends two messages: one to the new address to allow the change, and one to the original address to deny it. The second one is yours. It comes from [email protected] and carries a special link that reverses the change.

Instagram also says it only starts this process after an email is changed from the profile page. So a real notice means someone was logged in to your account and edited it.

The wording of the notice varies by app version, language and region. People search for it as "Your email address was changed", "revert this change" or, in Malaysia, "email instagram ditukar" and "IG被盗 邮箱手机号被改". Match on the sender and the meaning, not the exact words.

#Step One: Take Back the Original Mailbox

Your email is the master key. Instagram's account security page puts it plainly: anyone who can read your email can probably also access your Instagram account. If the attacker still has your inbox, they can reset Instagram again the moment you reverse the change.

1. Log in to the email account from a device you trust and change its password to one you have never used anywhere else.
2. Sign out of every other session in the email settings.
3. Check forwarding rules, filters and the recovery phone and address. Remove anything you did not set.
4. Turn on two-step verification for the email account.
5. If you cannot log in to the mailbox at all, use your provider's own recovery page, often labelled "Forgot password?" or "Trouble signing in?".

Instagram's page on lost access to your email or phone says it cannot help you get back into an email account. That part is between you and your email provider.

#Step Two: Use the Reverse Link, Safely

Once the mailbox is yours again, open the notice from [email protected] and select the option to secure the account. Instagram's hacked profile page says this may undo the email change. Then follow the prompts to set a new password.

Check the message is real before you click. Instagram's page on reviewing recent emails says official security emails only come from addresses ending in @mail.instagram.com, @support.instagram.com, @support.facebook.com, @facebookmail.com or @global.metamail.com. The same page says you can see official emails from the last 14 days under Accounts Center, then "Password and security", then "Recent emails", but that only helps if you can still log in. If you are locked out, read the sender address character by character, and when in doubt type the Instagram address into your browser yourself.

#When the Reverse Link Does Not Work

The link often fails because the attacker changed more than the email. Work down this tree and stop at the first branch that gets you in.

• Did the reverse link restore your email but not your login? Instagram says that if other details such as the password were changed too, request a login link or security code. On the login screen, tap "Forgot password?", enter your username, email or phone, then tap "Send login link" and complete the captcha.
• Does the login link go to the attacker's email or phone instead of yours? Instagram's hacked page says that if you no longer have the username, email or phone on the account, visit its recovery page and follow the on-screen instructions. That page is instagram.com/hacked, which Instagram's hacked account hub points every takeover victim to.
• Still no link that reaches you? Instagram says you may be able to request support on a mobile device. Enter a secure email address that only you can access. Instagram says you should then receive an email with next steps.
• Were two-factor codes turned on by the attacker? That needs its own route. Our guide to a hacker switching on two-factor authentication covers it.

After a support request, Instagram asks you to prove the account is yours. According to its hacked profile page, an account with photos of you usually needs a video selfie of you turning your head in different directions. For an account without photos of you, Instagram asks for the email or phone number you signed up with and the type of device you used at sign up, such as iPhone or Android. Instagram says the video is never shown on Instagram and is deleted within 30 days, and that you can submit a new video if the first one was not accepted.

#What About the Phone Number?

The Instagram help pages we read describe the two-email reversal only for email changes. They do not document a matching reverse link for a phone number change, so do not wait for one. Treat a changed phone number as part of the same takeover and follow the email and login link steps above.

If your own phone suddenly shows "No service" at the same time, the problem may be your SIM. Call your carrier from another phone and ask whether a replacement SIM was issued. Until that is fixed, SMS codes for Instagram, your bank and your email may be going to someone else.

#Where the Official Routes End

Be ready for a hard limit. Instagram's lost access page says that if you cannot get into the email account you registered with, and you did not link Instagram and Facebook, it is unable to give you access to the account. Recovering the original mailbox is therefore often the whole case.

If you simply lost the old inbox or number, without a hacker involved, the steps are different. Our guide to getting back in without the old email, phone or 2FA covers that path.

#Evidence to Gather Before You Request Support

• The email change notice itself, with the full sender address and the time it arrived. Do not delete it.
• Screenshots of any other notices, login alerts or password reset emails, with dates.
• Your username, and the email or phone number you originally signed up with.
• The type of device you used when you created the account.
• The date and time you last had normal access.
• A secure email address that only you control.

#Mistakes That Hand the Account Back to the Attacker

• Reversing the email change before securing the mailbox, so the attacker simply resets it again.
• Clicking a "your email was changed" link from an address that does not end in an official Instagram or Meta domain.
• Giving a stranger the six-digit code Instagram sent you. That code is the key to the account.
• Using the attacker's new email address in a support request instead of a secure one only you control.
• Paying someone in the comments who says they can recover accounts.
• Stopping after the first failed attempt. Instagram says you can submit a new video if it could not confirm your identity.

#Once You Are Back In: Lock It Down

The attacker may still have a session open or a linked app. Instagram's hacked profile page lists these steps:

1. Change your password to a new, unique one.
2. Check that the email and phone number in your account settings are yours.
3. Open "Where you're logged in" under "Password and security" and log out of every device you do not own, as Instagram's login activity page describes.
4. Check Accounts Center and remove any linked accounts you do not recognise.
5. Revoke access for third-party apps you do not trust.
6. Turn on two-factor authentication. Instagram recommends an authentication app over text messages.
7. Save your backup codes somewhere offline, so a lost phone or a SIM problem does not lock you out again.

If the attacker posted or sent messages as you, tell your followers from a channel you control. Our first-hour playbook for a hacked Instagram covers warning contacts while you work.

#If You Paid Someone or Shared a Code in Malaysia

Handle the money first. The NSRC's FAQ on the NFCC website says to contact your bank's 24-hour hotline or the NSRC on 997 as soon as you notice an unauthorised transaction. It lists 997 hours as 8.00am to 8.00pm every day, including public holidays, and says to use the bank hotline outside those hours. Then make a police report at the nearest station within 24 hours. The same FAQ says NSRC, PDRM, MCMC, BNM and banks will never ask for your password, PIN, TAC or OTP.

A fake Instagram login page or a phishing email can be reported to CyberSecurity Malaysia's Cyber999 incident response centre, which takes reports by online form, email, phone and its mobile app. Keep the email headers, the link and timed screenshots. Scams that follow a takeover often start in the victim's own DMs, so our explainer on fake Meta support messages is worth reading before you reply to anyone.

#When a Case Review Makes Sense

Many people recover with the steps above, and Instagram alone decides the outcome. A second pair of eyes helps when the original mailbox is gone too, when several video selfies have been rejected, or when the account runs a business and every day offline costs sales. SocialSafe by AwareXone, our recovery service, reviews the case first and tells you honestly whether an official route is still open; sometimes the answer is that you already have what you need. You can read how we approach Instagram account recovery, and our Trust Center explains what we will never ask for, starting with your password and codes.

#Frequently Asked Questions