Instagram Hacked? What to Do in the First Hour

It is 11pm and your phone buzzes twice. The first email says the email address on your Instagram was changed. The second says the password was changed too. You open the app and it asks you to log in. Then a cousin messages you on another app: "Is this really you asking to borrow money until Friday?"

This is stressful, and the next hour matters. The person who took the account is usually still inside it, changing the email, the phone number and the security settings one at a time. Each change you undo early is one less wall between you and your account. The order is simple: secure your email and phone first, use Instagram's official recovery second, warn people third, and lock everything down the moment you are back in.

This guide covers only the first 60 minutes, in time blocks. For the longer recovery journey, read our Instagram account recovery guide for Malaysia. If Instagram shows a disabled or suspended screen rather than a login problem, our guide to disabled Instagram accounts is the better starting point.

Last checked: 28 September 2026.

#What Should You Do in the First Hour After Instagram Is Hacked?

In the first five minutes, secure the email account and phone number linked to your Instagram, then look for an email from [email protected] about a change you did not make and select "secure my account" in it. If that does not work, go to instagram.com/hacked by typing it into your browser and follow the login link, security code or support request it offers. Next, warn your followers and customers from a channel you still control, and screenshot everything. Once you are back in, change the password, log out unknown devices, check the email and phone on the account, turn on two-factor authentication, and remove linked accounts and apps you do not recognise. If money was lost in Malaysia, call your bank's hotline or the National Scam Response Centre on 997 immediately. Only Meta can restore the account.

#The First 60 Minutes at a Glance

Use this table as your timeline. The time windows are a guide, not a rule: if the security email arrives in minute one, act on it in minute one.

#Minutes 0 to 5: Secure Your Email and Phone, Then Check for Instagram's Email

Start with the inbox, not Instagram. If the attacker can still read your email, every reset link Instagram sends goes to them as well, and they can take the account back as soon as you recover it.

1. Sign in to your email from a phone or computer you trust, and change the password to one you have never used anywhere else.
2. Sign out every device or session you do not recognise. Gmail users can follow Google's steps to secure a hacked Google Account.
3. Remove forwarding rules and filters you did not set up. Google lists both as settings to correct immediately after a compromise.
4. Check the recovery phone number and recovery email on the inbox itself, and remove any you did not add.
5. Turn on two-step verification for the email account if it is not already on.
6. Check your phone. If it suddenly shows "No service" or "SOS only" where it normally works, call your telco from another phone and ask whether your SIM was replaced.

Now search the inbox, including spam, for mail from Instagram. Instagram's help centre says that if you received an email from [email protected] letting you know your email address was changed, you may be able to undo the change by selecting "secure my account" in that message. When the email on a profile changes, Instagram sends two emails: one to the new address to allow the change, and one to the original address with a link to reverse it. The second one is the email you are looking for.

If other details were also changed, such as your password, and you cannot switch the email back, Instagram says to request a login link or security code instead. That is the next time block.

#Minutes 5 to 15: Use instagram.com/hacked If the Email Link Did Not Work

instagram.com/hacked is Instagram's official starting point when you cannot log in. When Instagram announced the page in December 2022, it said you could choose whether you think you were hacked, forgot your password, lost access to two-factor authentication or had your account disabled, then follow the steps for that situation. At the time of writing, Instagram's hacked account help page sets out these routes:

1. Request a login link. On the login screen, tap "Forgot password?", enter the username, email address or phone number on the account, then tap "Send login link". Complete the captcha and open the link from your email or text message.
2. Request support. If the login link does not work, Instagram says you may be able to request support on a mobile device. Enter a secure email address that only you can access, because Instagram sends the next steps there.
3. Verify your identity for an account without photos of you. Meta's support team asks for the email address or phone number you signed up with and the type of device you used at sign-up, such as an iPhone or Android phone.
4. Verify your identity for an account with photos of you. Instagram asks for a video selfie of you turning your head in different directions.

Instagram says some of these steps may not be available for your type of account, but recommends trying them all. It also says the video selfie is never visible on Instagram and is deleted within 30 days, and that you can submit a new video if the first one is not accepted.

If the attacker has already changed both the email and the phone, or you have lost your two-factor authentication method, our guide to recovering an account after losing your email, phone or 2FA covers those dead ends in more depth.

#Minutes 15 to 30: Warn Your Followers and Save the Evidence

Tell people now, from channels you still control, because a hijacked account is most useful to the attacker in its first hours. Instagram's scam guidance lists people claiming to be a friend in an emergency, and people asking you to move a conversation off Instagram, among the common signs of a scam. Your contacts trust messages from your account, and that is what the attacker is counting on.

• Post a short warning on your other social accounts, your WhatsApp status or wherever your audience already follows you.
• Message close friends and family directly. They are usually targeted first, because the attacker can read your DMs.
• Ask people to report the account to Instagram and not to reply, send money, click links or share any code.
• If you sell through Instagram, tell customers not to pay or place orders through the account until you confirm it is back, and pin the same notice on your website, Facebook Page or marketplace store.

A plain warning works best. For example: "My Instagram account was hacked tonight. Any message from it asking for money, a code, a vote or a login is not from me. Please report it and do not reply."

Then capture evidence while it still exists. Instagram's support team, your bank and the police all work better with specifics, and the attacker may delete messages or change the profile again.

• Screenshots of every email from Instagram, with the sender address, date and time visible.
• Your username, profile URL and the email address and phone number that were on the account before the hack.
• The type of device you used when you created the account, and roughly when you created it.
• The message, email or link that led to the hack, including the sender's profile.
• Screenshots from friends of messages the attacker sent them.
• Receipts for ads, boosts or subscriptions billed to the account.

Keep everything in one folder. If the case drags on, our guide to proving you own a social media account explains which records carry the most weight.

#Minutes 30 to 60: Lock the Account Down Once You Are Back In

The moment you get back in, remove everything the attacker left behind, in this order. If you never lost access and only suspect someone else is logged in, start here straight away. At the time of writing, most of these settings sit in Accounts Centre, under Password and security; Instagram notes that some people see Meta Account settings instead.

1. Change your password to a strong, unique one. Instagram says that whenever you change your password, any device logged in to your account is logged out automatically.
2. Open Where you're logged in, choose your account and use "Select devices to log out" for anything you do not recognise. Instagram's login activity page describes the steps.
3. Check the email address and phone number on the account. Remove any the attacker added and restore your own.
4. Turn on two-factor authentication under Password and security. Instagram recommends an authentication app. Check which methods are switched on, remove any you did not set up, and save your backup codes somewhere offline.
5. Check Accounts Centre for linked accounts you do not recognise and remove them. If your Facebook shares the same Accounts Centre, secure it as well.
6. Revoke access for any third-party app you do not recognise, using Instagram's app access page.
7. Open Recent emails under Password and security. Instagram says it keeps official emails from the last 14 days there, which shows what was changed and when.
8. Check your name, bio, profile link, posts, stories and sent messages for anything the attacker added, and remove it.

Our two-factor authentication setup guide walks through choosing a method and storing backup codes so the next phone change does not lock you out.

Professional accounts have one extra check. Instagram's help centre says that if you can log in but a hacker is still taking actions on a professional account, you should look in Meta Business Suite for business portfolios you do not recognise. Its suggested fix is to switch the account back to a personal account, which removes the unauthorised business, then switch to professional again. Instagram warns that you lose access to tools such as Meta Business Suite and Ads Manager while personal, and that insights data is kept for 90 days. If the attacker reached your wider Meta business setup, follow our guide to a hacked Business Manager in Malaysia.

#If Money or a Business Was Involved: Reporting in Malaysia

Instagram deals with the account; Malaysian authorities deal with the fraud. If anyone lost money, you or the people the attacker messaged, report it within the hour.

• Money transferred or card charges you did not make: call your bank's fraud hotline or the National Scam Response Centre (NSRC) on 997 immediately. The NSRC coordinates a rapid response to online financial fraud with the police, Bank Negara Malaysia, MCMC, banks and telcos. It also states there is no guarantee you will get your money back.
• Then make a police report at the nearest police station, and bring the evidence folder.
• A card saved for ads or subscriptions on the account: ask your bank to block it.
• Help with a compromised phone, laptop or email: CyberSecurity Malaysia's Cyber999 takes incident reports.

Expect copycats. AFP Fact Check reported on 5 February 2026 that scammers in Malaysia pose as police and anti-scam staff to sell fake money recovery services, and that authorities say they do not use personal WhatsApp accounts or ask victims for payment to investigate.

#What Not to Do in the First Hour

Panic makes people take shortcuts, and scammers watch for hacked-account posts. Avoid these:

• Do not pay "recovery hackers" who reply to your posts, comment under them or message you. In April 2026, Bukit Aman's Commercial Crime Investigation Department warned about a "double scam" in which fake recovery services take upfront payments from people who have already been scammed.
• Do not send your password, login codes, backup codes or a WhatsApp verification code to anyone, even a friend. A message from a friend asking for a code may come from another hacked account.
• Do not tap links in DMs, SMS or emails that claim to be from Instagram or Meta Support. Our guide to fake Meta Support messages shows the common versions.
• Do not install remote-access apps or "recovery tools" because a stranger asked you to.
• Do not delete the phishing message, the emails or the chat history. They are your evidence.
• Do not give Instagram false or inconsistent information. Answer its questions accurately, the same way each time.

#What If You Are Still Locked Out After the First Hour?

Many recoveries take longer than an hour, and that alone does not mean the account is lost. Keep checking the secure email you gave Instagram, submit a new video selfie if the first one was not accepted, and keep your evidence folder up to date. Some accounts come back the same day, some take weeks, and some are not restored. Instagram makes that call.

Outside help makes sense when Instagram's own routes have stopped offering options, when the account carries a business or real income, or when an impersonator starts using your name at the same time. SocialSafe by AwareXone is AwareXone's social media recovery service. We look at your case first and tell you honestly whether the official routes still have a chance, then help you prepare the evidence Instagram asks for. You can see how SocialSafe handles Instagram cases and read how we work. We use the same official processes available to you, and only Meta can restore the account.

#Your First-Hour Checklist

• Email password changed, unknown sessions signed out, forwarding rules and filters checked.
• Phone and SIM working normally, or the telco called.
• Inbox searched for [email protected] and "secure my account" used if the email is genuine.
• instagram.com/hacked typed in by hand and every offered route tried.
• A secure email that only you can access entered in any support request.
• Followers, family and customers warned from another channel.
• Emails, messages, account details and receipts saved in one folder.
• Once back in: new password, unknown devices logged out, email and phone restored.
• Two-factor authentication on, with backup codes stored offline.
• Accounts Centre, linked accounts and third-party apps cleaned up.
• Bank hotline or NSRC 997 called, and a police report made, if money was lost.
• No codes shared and no "recovery hacker" paid.

#Frequently Asked Questions