Instagram Account Hacked? How to Get It Back

The Common Instagram Account Takeover Trick

Many Instagram account takeovers begin with a social engineering trick. You might receive a message, often from a friend's already compromised account, asking you to vote in a competition or click a suspicious link. This link leads to a fake login page designed to steal your credentials.

Once they have your username and password, scammers quickly log into your account. Their next move is crucial: they access your 'Security' settings and often try to change the associated email address and phone number to one under their control. They might use a legitimate-looking process, even sending a code to your phone, which they then trick you into revealing back to them, to authorise these changes. This effectively locks you out by removing your recovery options.

Act Quickly: The First Steps to Recovery

Time is of the essence when your account is compromised. The faster you act, the better your chances of recovery. Instagram has specific processes for hijacked accounts, but you might need to try a few approaches.

Your priority is to regain access and remove the scammer. If you receive an email from Instagram about a change you didn't make (like a new email address being added), there's usually a 'revert this change' option. Click it immediately if it's still available.

Essential immediate actions:

• Check your email for messages from Instagram (check spam/junk folders too) regarding password changes or new associated emails. Look for a link to 'revert this change' or 'secure your account'.
• If you can still log in (even if temporarily), change your password immediately to something strong and unique, and enable two-factor authentication (2FA) if you haven't already.
• Inform friends and family through other channels (SMS, another social media platform) that your Instagram account has been compromised and to ignore any suspicious messages from it.

Using Instagram's Official Recovery Tools

If you're completely locked out, you'll need to use Instagram's recovery process. This usually involves proving your identity. The most common method is the 'Login Help' link on the login screen.

When prompted for your username, email, or phone number, enter the details you know are associated with your account. Instagram will then guide you through options to send a login link or security code to your registered email or phone number. If the scammer has changed these, you may need to select a different option, such as 'Try another way' or 'I can't access this email or phone number'. This often leads to a video selfie verification process, where you record a short video of yourself turning your head in different directions to confirm you are the owner of the account shown in your profile pictures.

Beyond Recovery: Securing Your Digital Footprint

Once you've regained access, immediately change your password and enable or strengthen your 2FA. Review your 'Authorised Apps' in Instagram settings and remove anything you don't recognise. Scammers sometimes link third-party apps to maintain access.

It's also wise to check for any posts or direct messages the scammer sent from your account and delete them. Inform anyone who might have been affected by messages sent from your account. This incident should also prompt a review of other online accounts where you might have used similar passwords.

If you're overwhelmed or unsure about the recovery process, or if this incident has wider implications like potential identity theft, remember that KNOMI can provide expert guidance. We understand these situations are stressful and can help you navigate the complexities of digital incident response, ensuring your security measures are robust across all your online platforms.

Reporting and Further Actions

Even after recovery, it's important to report the incident to Instagram. This helps them track scam tactics and improve security. If you lost money or believe your personal information is at risk, consider reporting the incident to ReportCyber (acsc.gov.au/report) or Scamwatch (scamwatch.gov.au).

If this hack is part of a broader pattern of identity theft, or if you're concerned about your overall digital security, consulting with organisations like IDCARE (idcare.org) can provide invaluable support and guidance. They offer free services to help Australians affected by identity crime. Remember, managing cyber incidents can be complex, and KNOMI is always ready to assist when you need a cyber first-responder.

Frequently asked questions