Instagram Hacked and Email and Password Changed? How to Recover

Instagram Hacked and Email and Password Changed? How to Recover

Quick Answer: When a hacker changes your Instagram email and password, you have a narrow recovery window using Instagram’s “Secure Your Account” or “Get More Help” flow. The key tool is the verification email Instagram sends to the ORIGINAL email when security changes are made — this email contains an option to reverse the changes. If that window has passed, recovery requires identity verification through selfie video or government-issued ID. Key points in this article:
  • The 24-hour critical window: The reversal email that most people miss.
  • Recovery after the window closes: Identity verification methods.
  • If the selfie verification fails: Advanced recovery options.
  • Securing the account after recovery: Making sure it can’t happen again.

The Critical First Step: Check Your Original Email

When a hacker changes your Instagram email, Instagram automatically sends a security notification to your ORIGINAL email address. This email includes a link to reverse the change — this is your fastest recovery path.
  1. Check your original email inbox for a message from Instagram saying “We noticed a change to your Instagram account.”
  2. Click “Revert this change” in that email — this immediately resets the email back to yours.
  3. Then change your password immediately.
This link is only valid for a limited time — typically 24 hours. If you missed it, proceed to the next steps.

Recovery After the Window Closes

  1. On the Instagram login page, tap “Forgot Password?”
  2. Enter your username, phone number, or original email.
  3. If you can’t receive the reset link (because the email was changed), tap “Need more help?”
  4. Instagram will ask you to take a selfie video — a slow-motion video of your face turning side to side.
  5. The system compares this to photos in your account. If matched, you’ll receive a recovery link at a new email you provide.

If the Selfie Verification Fails

The selfie verification fails when: the account has few photos of you, the hacker has deleted your photos, or the AI can’t confidently match your selfie. In this case:
  • Submit a government-issued ID through the identity verification flow
  • Provide as many account ownership proofs as possible: username, account creation date, devices used, linked Facebook account
  • Consider professional assistance — a cybersecurity expert can compile the specific forensic evidence package that gives Instagram the confidence to restore access

Securing the Account After Recovery

  1. Enable Two-Factor Authentication: Settings → Security → Two-Factor Authentication. Use an authenticator app, not just SMS.
  2. Add a strong, unique password that you don’t use anywhere else.
  3. Review and remove all third-party apps that have access to your account: Settings → Security → Apps and Websites.
  4. Check active sessions: Settings → Security → Login Activity — remove any unrecognized sessions.
Instagram hacked and email and password changed? Time is critical — the recovery window is closing.

Related Articles

Submit Your Case for Review

Related Articles

Crypto Exchange Locked? Recovery Guide

Crypto Exchange Account Locked? Recovery Guide

Losing access to a crypto exchange account can mean losing thousands of dollars. Unlike social media platforms, crypto exchanges require regulated identity verification (KYC). This makes recovery both harder and more reliable — if you have your documents. Coinbase Recovery

Read more »
Session Cookie Theft How Hackers Bypass 2FA

Session Cookie Theft: How Hackers Bypass 2FA

Two-factor authentication is the single best account security improvement. But session cookie theft is the one attack vector that completely bypasses 2FA. This guide explains how it works and how to defend yourself. What Is a Session Cookie? When you

Read more »
Discord Account Hacked? Recovery Plan

Discord Account Hacked? Recovery Steps

Discord hacks usually happen through one of three vectors: stolen authentication tokens (the most common), phishing links in DMs, or weak passwords. Recovery requires understanding which method was used. Method 1: Token Theft Recovery If a malicious app stole your

Read more »

Accessibility Toolbar