Access recovery consulting for a hijacked Instagram account.

My Instagram account was hijacked: what should I do in the first hours?

Hijacked account consulting is a service that guides the owner of an Instagram account whose password, email address or phone number was changed without permission in applying Meta's official recovery flows in the right order. The aim is first to regain access, then to clean up the traces the attacker left and make the account safe against being hijacked again. Logins are always done by the account owner.

How do you know the account has been hijacked?

The clearest sign is an email from Instagram notifying a change you did not make: a new email address, a removed phone number or a changed password. Besides this, the following signs also deserve attention:

• Your session suddenly closing and your password no longer being accepted.
• Your profile photo, username or bio changing.
• Your followers mentioning money or investment messages that appear to come from you.
• Login alerts from locations you do not recognize.

When you notice one of these signs and can still get into your account, changing your password right away and logging out of sessions you do not recognize may stop the attacker from going further. If you cannot get into the account at all, it is wiser to follow the order below rather than trying random steps in a panic.

What to do in the first hours

1. Do not delete emails from Instagram; the option to revert the change is usually found in these emails.
2. Change the password of the email account linked to the account and turn on two-factor authentication there too. The attacker often reaches the email first.
3. Try the help options on the login screen calmly, one time each; repeating the same step back to back may lead to temporary restrictions.
4. Tell your close circle through another channel that you do not have your account.
5. If it is a business account, check the spending and payment methods in the linked ad account.

There are also mistakes to avoid in these hours:

• Accepting the attacker's offer of money; after payment, the account is mostly not returned.
• Sending an ID photo or verification code to "rescuers" who write by DM.
• Changing only the Instagram password without securing the email account.
• Not checking foreign sessions and added verification methods once access returns.

What recovery routes are there?

The routes open to you depend on what the attacker changed. If you can still access your registered email, you can proceed with a login link or code. If the email and phone were changed, Instagram's flow for reporting that an account was hijacked comes into play. If there are photos of you on your profile, identity verification with a video selfie may be requested; for business accounts, verification options using the business's details may appear. Meta determines which option appears, and we guide you according to the option that comes up on your screen.

Each of these routes has a different waiting time. The link to revert the change is often the fastest, but it may be valid for a limited time. In the hacked-account flow, Instagram may offer to send the code to an email address or number that is not registered; here it is important to give only an address that is under your control and that you will use for a long time. The result of identity verification can be expected to be notified by email within a few days. Restarting the same flow many times while waiting usually prolongs the process.

For your followers and circle

Hijacked accounts are mostly used to defraud your circle. A short, calm and clear notice protects your followers and makes it easier to rebuild trust once the account is back. It is enough to say what happened, that no one should send money or codes, and what your official communication channel is. Detailed accusations or wording addressed to the attacker draw unnecessary attention.

For business accounts, the notice also needs to be made through channels such as the website, WhatsApp line or other social media accounts, because your customers cannot know who holds the account on Instagram. If there are people who lost money because of messages sent from your account, it is also useful to remind them of the official complaint routes and suggest they keep screenshots of the messages.

Online and on-site support

Because speed matters in hijack cases, we usually provide the first response online: by message, phone or screen sharing, we explain what to do at each step. If you are in Sakarya and the surrounding area, you can also get on-site support; this means sitting side by side at your own phone or computer and applying the steps together. The device stays in your hands, and we never need to type in any information. For the initial assessment, it is enough to send images of the emails and screens you received; you do not need to share any login details of your account.

After access is back

Change the password to a new one that you do not use anywhere else, turn on two-factor authentication with an authenticator app and save the backup codes. Review the sessions in Accounts Center, remove app permissions the attacker added and delete suspicious posts that were made from your account.

If you have a Facebook account linked to Accounts Center, do the same checks there; attackers sometimes leave one of the linked accounts as a back door. For business accounts, remove strangers added to the Meta Business Portfolio, pause campaigns you do not recognize in the ad account and check your payment methods. Finally, think about how the attack began: was a link clicked, was the password also used on another site? Knowing the cause is the shortest way to prevent a repeat. After completing these final checks, you can announce to your followers with a short post that the account is back with you.