How to Get Back a Disabled or Hacked Instagram Account (2026)

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Use the route that matches the message you see. If your account was hacked or you are locked out, start at instagram.com/hacked. If Instagram explicitly says your account was disabled, log in through the Instagram app and follow the on-screen review or appeal instructions. If there is no disabled message, treat the problem as a login or account-takeover issue—not automatically as a ban.

What happened	First action
You were hacked, or your password, email, phone number, or username changed	Use Instagram’s hacked-account recovery page.
You see an explicit disabled-account message	Log in through the Instagram app and request a review using the displayed instructions.
You cannot log in but see no disabled message	Use the password-reset or hacked-account flow; do not assume the account was banned.
You temporarily deactivated the account	Log in again to reactivate it.
The account was permanently deleted	Instagram says it cannot be restored after deletion, subject to any applicable cancellation period.

First, identify exactly what happened

Before repeatedly trying passwords or submitting forms, save the exact message shown by Instagram. Take screenshots of the error, any stated reason, the account username, and the profile URL. Also record when access disappeared and save recent Instagram emails or text alerts.

If an attacker used the account, preserve evidence of unauthorized posts, messages, profile edits, advertising, payment activity, or changes to the email address and phone number. The exact login message matters because Instagram uses different processes for hacked accounts, disabled accounts, temporary deactivation, and deletion. Instagram also says that some recovery options are not available to every account. See its official hacked-account guidance.

The four account states are different

• Hacked or taken over: Someone else changed access details or is using the account without permission. Use the hacked-account route.
• Disabled: Instagram has restricted the account, usually with an explicit message at login. Use the in-app review route.
• Temporarily deactivated: The owner chose to hide the account. Logging in normally reactivates it.
• Deleted: The account was removed by the owner or someone with the password. Instagram says the old account cannot be restored.

If you can still log in: contain the takeover immediately

This is the best-case scenario. Do the following from a trusted device, and secure your email account before relying on it for future recovery.

1. Change the Instagram password. In the app, open your profile, open the menu, go to Accounts Centre, choose Password and security, select Change password, choose the Instagram account, and create a new password. Instagram’s help page describes a minimum of six numbers, letters, and punctuation marks, but use a much longer, unique password generated by a password manager instead. Never reuse the Instagram password for email or another service. See Instagram’s password instructions.
2. Secure the email account. Change its password, enable two-factor authentication, review recovery addresses and forwarding rules, and sign out unfamiliar sessions. Anyone who can read the email account may be able to reset Instagram. Instagram explains this risk in its account-security guidance.
3. Terminate unfamiliar Instagram sessions. Go to Accounts Centre > Password and security > Where you’re logged in, select the Instagram account, and log out devices you do not recognize. Some versions label this area Login activity, and Instagram says the same setting may not be available to every account. Do not rely only on the displayed location: mobile networks, VPNs, and IP geolocation can make a legitimate session appear to be somewhere else. Compare the device, time, and your own activity. See Instagram’s login-activity instructions.
4. Check the email address and phone number. Confirm that both belong to you and that the attacker has not added a recovery address or number. Instagram says an email change generates messages to both the original and new email addresses; check the original inbox for a reversal message.
5. Remove linked accounts you do not recognize. Review Accounts Centre for unfamiliar Facebook or other Meta accounts. A connected account controlled by an attacker can provide another way back into Instagram.
6. Revoke suspicious third-party apps. Remove follower, verification, giveaway, analytics, scheduling, or browser-extension services that you did not authorize. Instagram specifically recommends checking linked accounts and third-party apps after a takeover.
7. Enable two-factor authentication. Go to Accounts Centre > Password and security > Two-factor authentication, select the Instagram account, and choose an authentication app, SMS, or another method offered to you. An authenticator app is generally preferable where practical. Instagram documents authentication-app setup and other two-factor options.
8. Save backup codes. While logged in, go to Accounts Centre > Password and security > Two-factor authentication > [your Instagram account] > Additional methods > Backup codes. Store them in a password manager or another secure place. Instagram says you must already be logged in to retrieve or regenerate them; see its backup-code instructions.

Enabling two-factor authentication does not automatically remove an attacker who is already signed in. Change the password and end unknown sessions, remove unauthorized apps, and secure the email account.

If your Instagram account was hacked

Use the official hacked-account page or the recovery option on Instagram’s login screen. Instagram may offer a login link, security code, support request, video selfie, or identity verification depending on the signals available for your account.

When a login link still works

1. At the Instagram login screen, select Forgot password?
2. Enter the username, email address, or phone number associated with the account.
3. Select Send login link.
4. Complete any CAPTCHA or security check.
5. Open the link sent by Instagram through email or SMS and follow the reset instructions.

Try the username as well as the email address. An attacker may have changed the email while leaving the username unchanged. Instagram documents this process at Recover your Instagram password.

If the message does not arrive, check spam, junk, promotions, filtered folders, and your email search. Confirm that you entered the correct account identifier and avoid using a link sent by somebody in a Direct Message. Instagram does not publish a universal delivery time for reset messages, so do not interpret a short delay as proof that the account is permanently lost.

When the attacker changed your email address

Search the original email inbox for a security message from Instagram. Instagram says that when the profile email changes, the original address receives a link to reverse the change and secure the account. Use the message from the original inbox, verify that it is an official Instagram email, and remember that an old link may have expired. The relevant help page is Changed Instagram email.

Reversing the email change may not undo a changed password, phone number, two-factor method, linked account, or active session. After regaining access, complete the entire security checklist above.

When the login link fails or you lost the recovery channels

Continue through instagram.com/hacked and choose the support or alternative-verification option offered. Instagram says that if a login link does not work, you may request support from a mobile device and provide a secure email address that only you control.

A secure email address can be a newly protected inbox; it does not have to be the old address. Change its password, enable two-factor authentication, and do not share it with a supposed recovery agent.

When Instagram asks for a video selfie

For accounts containing photos of you, Instagram may ask for a video selfie in which you turn your head in different directions. According to Instagram, this is used to check that you are a real person authorized to access the account. Instagram says the video is not visible on Instagram and is deleted within 30 days. Its help page says this particular review process may take up to two business days; that is not a universal response time for every hacked-account request or disabled-account appeal. See Instagram’s video-selfie information.

If the first video is rejected, Instagram says you may be able to submit another through the app. Follow the movement instructions exactly, use good lighting, clean the camera lens, and remove filters, sunglasses, hats, or anything that obscures your face. Submit another video only through the official app or recovery message—not to someone who contacts you privately.

When Instagram asks for an ID

Instagram may request identification to verify identity, age, or account information. Its accepted-ID guidance says the document generally needs a full name and photo or a full name and age, and advises submitting only the documents requested.

You may physically cover nonessential sensitive information before photographing the document, but do not digitally alter the document to conceal information. Never send government ID to a person claiming to be Instagram staff in a DM, Telegram chat, WhatsApp conversation, or unofficial website.

When the account has no photos of you

Instagram may instead ask for the original signup email or phone number, the type of device used when the account was created—such as an iPhone, Android phone, or iPad—and other information in its support email. Gather old usernames, the original signup details, approximate account-creation information, and devices previously used with the account. With fewer personal photos, these historical account signals may become more important.

If Instagram disabled your account

An explicit disabled message means you should use Instagram’s in-app review process:

1. Open the official Instagram app.
2. Enter the disabled account’s username and password.
3. Follow the on-screen instructions to request a review if you believe the decision was a mistake.
4. Complete any identity or security check that Instagram presents.

Instagram says accounts that do not follow its Community Standards may be disabled, and that people who believe the decision was made in error may request a review. Read the current instructions at Disabled Instagram account.

What to write in the review request

Keep the appeal factual and concise. For example:

I believe the account @username was disabled by mistake. I am the account owner. The account was hacked or accessed without authorization before the disablement, and I did not authorize the posts, messages, profile changes, or other activity that may have triggered enforcement. The original signup email or phone was [identifier]. I can verify my identity and request a review of the account.

Adapt the wording to the facts. Identify unauthorized activity by date or type, explain the takeover if one occurred, and state what you can verify. Do not threaten staff, guess at a policy violation, claim facts you cannot support, or promise that a particular form will restore the account. Instagram provides an option to request review; it does not promise restoration, a human review for every request, or a universal response time.

Keep screenshots, confirmation screens, case numbers, and copies of what you submitted. Do not send more documents than Instagram asks for. Duplicate submissions can make it harder to track the request, but the official pages reviewed do not establish that submitting more than one request automatically causes a permanent penalty.

Check Account Status if you can still access the account

Account Status can show removed posts, stories, or comments; feature restrictions; some enforcement actions; and available review options. Menu names vary by device and account, so search the app’s settings for Account Status. Instagram describes the feature at Account Status.

Do not confuse a normal content review with an account-disablement appeal. The content-review process covers removed posts, comments, stories, and similar decisions; it is not automatically a way to restore a disabled account. Instagram documents the separate content-review process and disabled-account login route.

Why the Oversight Board is usually not the answer

The Oversight Board is not a general Instagram account-recovery or ban-removal service. Instagram says it handles certain content decisions after a user has requested review. The Board’s FAQ says the account must not be disabled and the person must be able to log in to submit an appeal. Therefore, a disabled Instagram account generally cannot use the Oversight Board as a substitute for the in-app disabled-account appeal. See Instagram’s explanation of Oversight Board appeals.

If the account was hacked and then disabled

This is a two-track problem. Instagram’s public help pages do not promise a special combined hacked-and-disabled form. The practical sequence below uses the separate official recovery and review routes:

1. Secure the email and phone account first. Otherwise an attacker may intercept reset links or continue changing the Instagram password.
2. Secure the device and browser. If phishing, malware, a stolen browser session, or a malicious extension may be involved, use a trusted device, remove suspicious software, and change important passwords from a clean environment.
3. Use instagram.com/hacked. Establish that the account was taken over and complete the login-link, security-code, video-selfie, or ID process Instagram offers.
4. Use the disabled-account review prompt in the Instagram app. Explain that the activity leading to enforcement was unauthorized and occurred after the takeover.
5. After restoration, harden the account again. Change the Instagram password, end every unfamiliar session, check linked accounts and apps, enable two-factor authentication, regenerate backup codes, and inspect recent account activity.

This sequence is a recommended way to handle two separate processes, not a guarantee that Instagram will restore the account.

Evidence to gather

• Current and previous usernames.
• The original signup email address and phone number.
• The approximate account-creation date.
• Devices previously used to log in.
• Instagram alerts about email, password, phone, or profile changes.
• Screenshots or copies of unauthorized posts and messages.
• Dates and approximate times of suspicious activity.
• The original profile URL.
• Confirmation that the email and phone account are now secure.
• Support case or appeal reference numbers.

If you temporarily deactivated the account

Temporary deactivation is reversible. Instagram says it hides the profile, photos, comments, and likes until the owner logs in again. Open Instagram and log in normally. This is different from a disabled account, where Instagram took enforcement action, and from deletion, where the account was removed. See Instagram’s temporary-deactivation guidance.

If the account was deleted

Instagram says an account deleted by the owner or by someone who had the password cannot be restored. You may create a new account with the old email address, but the old username may no longer be available. See Instagram’s account-status guidance.

Instagram’s deletion information says an owner-requested deletion normally has a 30-day cancellation period, although the available number of days can vary by region. After that period, the account and information are permanently deleted; the broader deletion process may take up to 90 days. If an attacker requested deletion, immediately use the hacked-account route and state clearly that the deletion was unauthorized. Do not assume that recovery during a deletion window is guaranteed. See Instagram’s deletion information.

Fixes for common recovery failures

The reset link goes to the hacker

The attacker may still control the account’s email or phone, the recovery flow may be identifying the wrong account, the message may be obsolete, or another recovery method may have been added. Try the username instead of the email, check the original inbox for the email-change reversal message, and use the try another way or support option if Instagram offers it. Then use instagram.com/hacked and provide a newly secured email address.

You receive no reset email

• Check spam, junk, promotions, and filtered folders.
• Search for Instagram messages rather than relying only on the inbox view.
• Try the username, original email, and phone number separately.
• Use the official hacked-account page from a browser.
• Do not click links sent by supposed support agents.

The video selfie was rejected

Instagram says you may be able to submit another video through the app. Follow the exact prompts, use a well-lit uncluttered setting, clean the lens, remove filters and face coverings, and make sure the secure email address is correct. A better submission may help the verification process, but approval is not guaranteed.

You lost access to both the old email and phone

Try recovering the email account or phone number through the relevant provider first. Instagram says that if you cannot access the registered email and did not link Instagram and Facebook, it may be unable to provide access to the Instagram account. This is a significant limitation, not merely a missing form. Read Instagram’s lost-email and phone guidance.

The app says disabled but the profile is still visible

A public profile URL can remain visible while login enforcement is being applied. Do not treat a visible profile as proof that the account is recoverable or that it was not disabled. Use the message shown at login and the official review route.

There is no disabled message

Instagram specifically distinguishes a login problem from a disabled account. Try password recovery, a login link, and the hacked-account process. Review I Can’t Log In if the app does not identify a disablement.

The hacker keeps posting after you change the password

Changing the password alone may leave an attacker’s session, linked account, third-party app, compromised email account, or stolen browser session active. Secure the email account, change the Instagram password from a trusted device, log out unknown sessions, remove linked accounts and apps, enable two-factor authentication, regenerate backup codes, and check recent emails and account changes. Warn followers about fraudulent posts or messages.

The menus do not match these instructions

Instagram’s labels and paths vary across iPhone, Android, iPad, mobile browser, desktop, country, language, and account type. For example, login activity may appear under Where you’re logged in in Accounts Centre or under Login activity. Prioritize the direct hacked-account page, the exact on-screen prompt, and the current Help and Accounts Centre areas instead of relying on an old screenshot.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Support options in 2026

Meta AI support assistant

Meta announced in March 2026 that a Meta AI support assistant was rolling out in countries and territories where Meta AI was available in the Instagram and Facebook apps and in the desktop Help Center. It can assist with issues such as password resets and profile settings. Meta said login help initially began with selected cases in the United States and Canada and would expand. Availability and the actions it can offer vary by country, platform, account, and security state. See Meta’s announcement.

Do not treat the assistant as a guaranteed human escalation path or as proof that a recovery request will succeed. Also be cautious with older articles that tell users to persuade a support bot to change an account email.

Important warning about an AI-assisted recovery incident

A notification filed with the Nebraska attorney general on June 5, 2026 says Meta discovered on May 31, 2026 that a vulnerability in an AI-assisted Instagram recovery system called High Touch Support allowed unauthorized parties to request password resets using an email address that was not associated with the target account. The notification says Meta disabled the vulnerable path, invalidated existing reset links, and placed potentially affected accounts behind a security checkpoint. It identifies 37 potentially affected Nebraska users—an upper-bound estimate for that jurisdiction, not a verified global total. Read the state breach notification.

Use only the official Instagram app, Help Center, and recovery pages. Do not assume an AI-generated recovery message is sufficient proof of ownership, and verify unexpected security messages in Instagram’s Recent emails area.

Meta Verified support

Active Meta Verified creator subscribers may have access to support for account and subscription issues. Instagram says support may be available through chat and email, with chat available through the mobile app rather than desktop. See Meta Verified support.

Meta Verified is not a guaranteed recovery service and does not guarantee that a disabled account will be restored. Do not buy verification from someone claiming to be an Instagram employee. If you already have an active subscription and lost access, use the official support path connected to that subscription; buying a subscription after a takeover may not be possible or useful.

Avoid Instagram recovery scams

People locked out of social accounts are prime targets for impersonators. Instagram says it will not send account-security messages through Instagram Direct Messages, and that official Instagram emails from the previous 14 days can be checked in settings. It lists official domains including @support.facebook.com, @support.instagram.com, @facebookmail.com, @mail.instagram.com, and @global.metamail.com. These domains should still be checked through Instagram’s own message history rather than trusted blindly. See Recent Instagram emails and Instagram’s scam warnings.

Navigate manually to instagram.com/hacked. If a security message seems unexpected, open Instagram’s Recent emails setting and compare it there. Account-security communications should not arrive through Direct Messages.

After you recover the account

• Set a long, unique Instagram password.
• Use a different strong password for the email account.
• Enable two-factor authentication, preferably with an authenticator app where practical.
• Store backup codes securely and never post or message them.
• Terminate every unfamiliar Instagram session.
• Review the email address, phone number, username, linked Meta accounts, and other personal information.
• Remove suspicious third-party apps, browser extensions, and social-media tools.
• Check recent emails, Account Status, posts, stories, messages, advertisements, and payment activity.
• Delete unauthorized content where appropriate and warn followers that fraudulent messages may have been sent.
• Keep screenshots and support references until access is stable.

Frequently Asked Questions

Can Instagram recover a permanently deleted account?

Usually not. Instagram says an account deleted by the owner or someone who had the password cannot be restored. An owner-requested deletion may have a cancellation period—normally 30 days, with regional variation—but restoration is not guaranteed. See Instagram’s deletion guidance.

Can I recover Instagram without the old email or phone number?

You may be able to use the hacked-account recovery flow and provide a secure email address, video selfie, ID, or original signup details. However, Instagram says it may be unable to provide access if you cannot access the registered email and did not link Instagram and Facebook. Try recovering the email or phone account through its provider first.

What if a hacker changed my Instagram email?

Check the original email inbox for Instagram’s email-change reversal message, then use instagram.com/hacked. Reversing the email change may not undo a changed password, phone number, two-factor method, or active session, so complete the full security cleanup after recovery.

How long does Instagram video-selfie verification take?

Instagram says the particular video-selfie review process may take up to two business days. That estimate does not apply universally to every hacked-account recovery request or disabled-account appeal. Instagram also says the submitted video is deleted within 30 days.

Does Meta Verified guarantee that Instagram will restore my account?

No. Active Meta Verified creator subscribers may receive chat or email support for account and subscription issues, but Meta Verified does not guarantee account restoration or reversal of a disablement.

Can the Oversight Board restore my disabled Instagram account?

The Oversight Board is not a general account-recovery route. Its FAQ says the account must not be disabled and the person must be able to log in to submit an appeal. Use the disabled-account review prompt in the Instagram app first.

Is there an Instagram customer-service phone number?

There is no universal official Instagram customer-service phone number or guaranteed unlock line. Use the in-app prompt, the Help Center, or instagram.com/hacked. Treat phone numbers posted in ads, comments, videos, and forums as potential scams.

Should I send my ID to someone claiming to be Instagram support?

No. Submit an ID only through an official Instagram app or recovery flow when Instagram requests it. Never send it to a person contacting you by Direct Message, Telegram, WhatsApp, email, or an unofficial website.

What if my account was disabled because of posts made by the hacker?

Use the hacked-account recovery flow and the disabled-account review prompt. Explain that the account was compromised before the activity and identify the unauthorized posts or messages. Instagram does not publish a guaranteed combined hacked-and-disabled recovery route.

Can I reuse my old Instagram username on a new account?

Instagram says you may create a new account with the old email address after deletion, but the old username may not be available. A username can also remain unavailable because another account has claimed it or because Instagram has not released it.

The Bottom Line

Start with the exact login message: instagram.com/hacked for a takeover, the Instagram app’s review prompt for an explicit disablement, a normal login for temporary deactivation, and no false hope after permanent deletion. Secure your email account and device before requesting more recovery links, verify messages through Instagram’s Recent emails area, and never pay or share credentials with a supposed recovery agent. Recovery is possible in some cases, but Instagram does not guarantee restoration.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.