Hacked Instagram or Facebook Account? The Complete Recovery Guide

You open Instagram and your password does not work. Or a friend messages asking why you are promoting a crypto giveaway. Or you get an email saying your Facebook email address was changed — to something you have never seen.

A hijacked social account is not just an inconvenience. For a lot of people it holds years of photos, business enquiries, a customer base, and the phone numbers of everyone they know. Attackers know this, which is why recovery is deliberately made harder for them and, unfortunately, harder for you too.

The first hour matters more than the next week. Here is what to do, in order.

How Accounts Get Taken in the First Place

Almost none of these involve breaking encryption. The realistic routes are:

• Phishing login pages. A DM from a friend saying "is this you in this video?" leads to a perfect replica of the Instagram login screen. You type your password and your 2FA code into the attacker's page, and they use both in real time.
• Password reuse. Your password leaked in an unrelated breach years ago and was tried against every major platform automatically.
• Session cookie theft. Malware, or a malicious browser extension, steals the token that keeps you logged in. This bypasses your password and your 2FA entirely, because the attacker never has to log in — they inherit a session that is already authenticated.
• SIM swap. Your phone number is ported to the attacker's SIM, and every SMS code goes to them.
• Fake verification and sponsorship offers. A "brand partnership" or "blue tick application" that asks you to log in through their portal, or to install a "media kit" app.
• Fake copyright strikes. An email that appears to come from Meta warning your account will be deleted in 24 hours unless you "appeal" — the appeal form harvests your credentials.

Warning Signs of a Compromise in Progress

• Login alerts from unfamiliar locations or devices.
• Emails about a changed email address, phone number, or password that you did not initiate.
• Posts, stories, or DMs you did not send — often crypto, weight loss, or "I made $5,000 this week" content.
• Friends following accounts you did not follow, or your account following hundreds of new ones.
• Two-factor authentication suddenly disabled, or a new authenticator added.
• Your profile picture, name or username changed.
• You have been logged out on all devices at once.

A note on the email alerts: when an attacker changes the email address, the platform's warning goes to your old address. Search your mail — including spam and trash — for messages from the platform. The "revert this change" link inside is often the fastest route back in, and it expires.

What to Do Immediately

Step 1 — Secure your email first

Do not start with the social account. Your email is the recovery mechanism for everything; if it is also compromised, recovering Instagram just hands it back. Change the email password, check for forwarding rules and filters that auto-delete platform notifications, review connected apps, remove unknown recovery addresses and phone numbers, and sign out of all sessions.

Step 2 — Check for the "revert this change" email

If the platform emailed your original address about the change, that link reverses the email swap and locks the attacker out. This is by far the easiest path and it is time-limited, so check before doing anything else.

Step 3 — Change the password and end all sessions

If you still have access, change the password and then use the platform's "log out of all devices" function. The order matters: changing the password alone does not always kill existing sessions, and a stolen session cookie will survive if you skip this.

• Instagram: Settings → Accounts Centre → Password and security → Where you're logged in.
• Facebook: Settings → Accounts Centre → Password and security → Where you're logged in.
• X/Twitter: Settings → Security and account access → Apps and sessions.
• TikTok: Settings → Security → Manage devices.

Step 4 — Use the official recovery flow if you are locked out

For Instagram and Facebook, the correct entry points are instagram.com/hacked and facebook.com/hacked. Meta's video selfie verification is genuinely effective if your account has photos of your face — it usually resolves within a few days. Submit the request from a device and network you have used with the account before, which helps the trust signals line up.

For X, use the "My account is compromised" support form. For TikTok, use the in-app report or the support form with your registered email and phone.

Step 5 — Warn your contacts

Post from another channel — a story on a different platform, a group message, an email — telling people not to click anything sent from your account. The attacker's main goal is often to phish your friends using your credibility.

What Not to Do

• Do not pay a "recovery service." The accounts advertising "I can get your Instagram back in 24 hours" in comments and DMs are, without exception, scams. There is no back channel. They will take your money and often your remaining credentials.
• Do not create a duplicate account and abandon the original until recovery has definitively failed. It weakens your case with support.
• Do not reuse the old password anywhere, and do not use a variation of it.

If It Already Happened — The Cleanup

Getting back in is not the end. Once you have control:

1. Audit every security setting — email, phone number, connected accounts, login alerts. Attackers leave backdoors: a secondary email, a linked account, or an authenticator they control.
2. Revoke third-party app access. Anything you do not actively use, remove.
3. Turn on app-based or hardware 2FA, not SMS. SMS is defeated by SIM swap; an authenticator app or a passkey is not.
4. Save your backup codes somewhere offline. Most people never do this and it is the reason recovery becomes impossible.
5. Scan your devices for malware if session theft is plausible — particularly if 2FA was bypassed without you approving anything. Remove unknown browser extensions.
6. Delete any content the attacker posted, and check your DM history for messages sent to your contacts.
7. Check linked payment methods and ad accounts. Business and creator accounts are frequently hijacked specifically to run fraudulent ads on a saved card. Review billing immediately and dispute anything unfamiliar.
8. Change passwords anywhere you reused that one, and check haveibeenpwned.com for your email address.
9. Report the fraud if money was lost — your bank first, then your national cybercrime reporting body.

How to Make This Much Harder Next Time

• A password manager with unique passwords everywhere. This single change eliminates the credential-stuffing route entirely.
• Passkeys where available. Meta, Google and X now support them. A passkey cannot be phished, because it will not authenticate to a lookalike domain.
• A dedicated email address for important accounts that you never post publicly and never use for newsletters.
• A carrier port-out PIN to block SIM swaps.
• Never log in from a link. Open the app or type the domain yourself. Every phishing kit in existence depends on you clicking through.
• Treat "verification," "copyright strike" and "brand deal" messages as hostile by default, and check for the notice inside the app rather than in the email.

The Bottom Line

Recovery success comes down to two things: how fast you move, and whether your email was secured before you started. Check your inbox for a reversal link, lock down email, kill every session, then work the official recovery flow — and ignore every stranger offering to help.

Afterwards, the fix is unglamorous but permanent: unique passwords, app-based or passkey 2FA, backup codes stored offline, and a habit of never entering credentials on a page you arrived at by clicking a link. Accounts protected that way are not worth an attacker's time, and they will move on to an easier one.