Instagram Account Hacked? How to Get Your Business Account Back

For many Indian businesses, Instagram is the shop window: years of posts, thousands of followers and a steady flow of enquiries in the DMs. So it is a nightmare when you suddenly cannot log in, the email and phone number on the account have been changed, and your followers start receiving crypto "investment" offers or fake giveaways from your name. If you have just found your Instagram account hacked, act quickly and in the right order – the first hour matters most. This guide walks you through recovering the account using Instagram's official tools, cleaning up after the hacker and making sure it does not happen again.

Why was my Instagram account hacked?

Knowing how it happened helps you close the door afterwards. When a business finds its Instagram account hacked, it is almost always one of these:

• Fake "copyright" or "verification" messages in DMs or email that link to a page asking you to log in. These look like Meta but are not.
• Someone asking for an OTP or code – "I sent you a code by mistake, please send it back". That code was your password reset code.
• Reused passwords. The same password used on another website that was leaked.
• Old agencies, freelancers or employees who still have the password or access through Meta Business Suite.
• Third-party apps for followers, likes or scheduling that were given access to the account.

Step 1: Check your email inbox first – right now

When someone changes the email address on your account, Instagram sends a message to the old email address. That message usually has a link like "revert this change" or "secure your account".

1. Search your email for messages from Instagram sent in the last few days, including the spam folder.
2. Open the one about an email or phone change and use the link to undo it and reset the password.
3. Do this as early as possible – these links stop working after some time.

Be careful: hackers also send fake "Instagram" emails. Only trust links from messages you can match in the app under Settings → Accounts Center → Password and security → Emails from Instagram (once you are back in), and never enter your password on a page you reached from a DM.

Step 2: Use Instagram's official recovery page

If the email link did not work, use Instagram's own recovery flow:

1. Open the Instagram app (not a browser on a shared computer), tap Forgot password? or Get help logging in, and enter your username, email or phone number.
2. If you no longer have access to the email or phone on the account, choose the option for help with my account was hacked or I can't access this email or phone number. You can also start at instagram.com/hacked.
3. Instagram may send a security code to an email address or phone number you provide. Use an email that the hacker does not know.

Use the device and Wi-Fi network you normally use for Instagram. Instagram recognises familiar devices, which makes recovery more likely.

Step 3: Verify your identity

For many hacked accounts, Instagram asks you to prove the account is yours:

• Video selfie verification: if the account has photos of you, you may be asked to record a short video turning your head in different directions. Instagram compares it with photos on the profile. The video is used for verification only.
• Business details: for brand accounts without your face, Instagram may ask for information such as the email or phone number used to create the account, or the type of device you used.

Answer exactly and honestly. Reviews usually take from a few days to a couple of weeks. Do not submit many requests at once – it can slow things down.

If you subscribe to Meta Verified, you can also use its account support to contact a person at Meta about the hacked account.

Step 4: Warn your customers and followers

While you work on recovery, the hacker may still be posting or messaging people from your account. Protect your customers and your reputation:

• Post a short message on your other channels – Facebook, WhatsApp status, Google Business Profile and website – saying the Instagram account was hacked and asking people not to send money or click links from it.
• Ask friends and loyal followers to report the account as hacked from inside the app. This can speed up action from Instagram.
• If customers paid money to the hacker, advise them to report it at cybercrime.gov.in or call the 1930 cyber fraud helpline as quickly as possible.

Step 5: Once you are back in – lock it down

Getting the password back is only half the job. Before you do anything else:

1. Change the password to a new, long one you have never used anywhere else.
2. Turn on two-factor authentication in Accounts Center → Password and security → Two-factor authentication. Use an authenticator app rather than SMS if you can.
3. Check the email address and phone number on the account and remove anything the hacker added.
4. Log out unknown devices under Where you're logged in.
5. Remove apps and websites you do not recognise from the account's connected apps.
6. Check posts, stories, highlights, bio link and DMs for anything the hacker added, and delete it.
7. Download your data (Accounts Center → Your information and permissions) so you have a backup of photos and posts.

Step 6: Check Facebook, ads and Meta Business Suite

Hackers often target business accounts because of the linked ad account. Check these immediately:

• Meta Business Suite / Business Manager → People and Partners: remove anyone you do not recognise, especially new admins.
• Ads Manager: pause or delete ads you did not create, and check the billing and payment methods for unknown charges. Contact your bank if your card was used.
• Linked Facebook Page: check page roles and recent posts.

If unknown ads were run on your card, report it through Meta's ads support and keep screenshots of the charges.

If you cannot get the account back

Sometimes recovery fails, or the hacker deletes or renames the account. Then:

• Keep trying the official flow from your usual device for a few weeks – some accounts are recovered late.
• Create a new account with a slightly different handle, verify it with your website and other channels, and tell customers about the change.
• Ask Instagram to remove the hacked account if it is being used to scam people, by reporting it as impersonating your business.

This is also a reminder not to depend on one platform. A business website, a Google Business Profile and your own customer list keep you reachable even if a social account is lost – our social media marketing guide and WhatsApp marketing guide explain how to build those channels together.

How to avoid getting hacked again

Frequently asked questions

What should I do first if my Instagram account is hacked?

Check the email inbox linked to the account for a message from Instagram about an email or password change, and use its link to revert the change. If that is not possible, start the official recovery from the Instagram app using Forgot password or Get help logging in.

How long does it take to recover a hacked Instagram account?

If you can use the email link, often within minutes. If you need identity verification, it usually takes a few days to a couple of weeks, depending on how quickly Instagram reviews your request.

Can I recover my Instagram account if the hacker changed my email and phone number?

Often yes. Use the option for a hacked account or for when you cannot access your email or phone, and complete the identity verification, such as a video selfie or details about how the account was created.

Should I pay someone who promises to recover my Instagram account?

No. People who offer paid recovery on Instagram, Telegram or websites are very often scammers, and some ask for your new login details. Use only Instagram's official tools and Meta Verified support.

How can I protect my business Instagram account?

Use a unique password, turn on two-factor authentication, never share login codes, give your team and agencies access through Meta Business Suite instead of the password, and regularly remove unknown devices and apps.

Summary

A hacked Instagram account can be recovered in most cases if you act quickly: use the change-revert email first, then Instagram's official recovery and identity verification, warn your customers on other channels, and lock the account down with a new password and two-factor authentication once you are back in. Finally, check your ad account and Meta Business Suite for intruders and unknown charges.

Need help managing and securing your brand's social media? Our social media management service sets up secure access for your team, and our digital marketing team can keep your enquiries flowing from Google and your website. Contact us and we will help you get back on track.