I got my Instagram back from a hacker in 47 minutes (here's exactly what I did)

At 11:13pm my Instagram login stopped working. By midnight, someone else’s face was where mine used to be.

Recovering a hacked Instagram account is supposed to take days of shouting into a support form. It took me 47 minutes, and most of that time went into one step nobody tells you to do first. Here’s the whole timeline, because the order is what actually mattered.

Minute 0–4: check your email before you touch Instagram

The first thing I did was not open Instagram. It was open my email and search for messages from Instagram’s security team.

That’s where the answer usually already is. When someone changes the email address on an account, Instagram sends a notice to the old address — and that notice carries a link to reverse the change. Mine was sitting there, eleven minutes old, filed under a Costco receipt.

If that email exists and the link still works, you’re four minutes from done instead of four days. Check before you do anything more dramatic. Mine didn’t work by the time I found it — the attacker had already swapped the recovery email too — so I moved on to the slower route.

Minute 4–11: lock down email first, because it’s the master key

Before touching Instagram at all, I changed my email password and turned on two-factor authentication there. Email is the reset path for almost every account you own, Instagram included, so an attacker who still has your inbox can quietly undo whatever you do to Instagram next.

This is also where I found the actual damage: a filter routing anything containing the word “Instagram” straight to Trash. Tidy work — that filter is the entire reason the security notice looked, for eleven minutes, like it had never arrived at all. I deleted it and checked for the rest of the usual kit: forwarding rules, an added recovery number, connected apps. Clean, this time.

If your password turned up in a breach months ago and you reused it somewhere, this is usually how it starts. Not a clever hack — just a login and password pair that already existed on some other, forgotten site.

Minute 11–19: recovering a hacked Instagram account from the login screen

Good news if you’re locked out completely, with no live session anywhere: Instagram’s hacked-account flow is built for exactly that. It lives at instagram.com/hacked, and you can also reach it straight from the login screen via “Get help logging in” → “Need more help?” — no active session required.

A device you’re still signed into is a shortcut, not a prerequisite. Sessions live in cookies, not in open browser tabs, so an old tablet in a drawer may well still be authenticated even though you haven’t touched it in months. Worth thirty seconds of checking before you commit to the slower route. I didn’t have one, so I went in through the front door.

Minute 19–34: identity verification, and why the video selfie is the fast lane

This is the part that eats the most time, and where “47 minutes” either holds or falls apart. Instagram asks you to prove you’re you, and the fastest version — if your account had photos of your face on it — is a short video selfie, matched against your existing profile pictures.

It’s an odd thing to do at midnight and it’s fast: mine cleared in about four minutes. Without profile photos to match against, you get routed to email or ID verification instead, which can run considerably longer than an evening. If you have any recognisable photos of yourself on the account at all, the video selfie is the path to take.

Minute 34–47: evict them properly

Getting a hacked Instagram account back is not the same as being alone in it again. Three things, in order, once access is restored.

Sign out of every session — Accounts Center → Password and security → Where you’re logged in — so anything the attacker still holds dies along with the rest.

Then check the two-factor authentication settings specifically. A competent attacker turns 2FA on, using their own authenticator app or phone number, which quietly locks you back out the moment you think you’ve won. Remove anything that isn’t yours, and regenerate the backup codes while you’re in there — stale codes are a spare key you didn’t know still existed.

Then linked accounts and third-party apps, and revoke anything you don’t recognise. Thirteen of my 47 minutes went here, and they were the thirteen that made the recovery stick rather than quietly reverse itself the next morning.

How they probably got in in the first place

I never found out for certain, and neither will most people — Instagram doesn’t hand you a forensic report along with the account back. But the two most common entry points here aren’t exotic. Either a password I’d used somewhere else showed up in an unrelated breach and got tried here automatically — the same mechanics behind that 2am “your password was found in a data breach” email — or I clicked a login page that looked close enough to Instagram’s own to fool a tired thumb at 11pm.

Neither one requires the attacker to be particularly skilled. Both just require the account to have had exactly one thing standing between it and a stranger: a single password, reused or handed over, with nothing else backing it up.

The one thing to do before you close this tab

Not a checklist. One thing: put a unique, generated password on your email — the account that made all forty-seven minutes of this possible in the first place, in both directions.

A manager like Bitwarden does it in about ninety seconds, and can hold your 2FA codes alongside it too — our walkthrough on setting that up without breaking your workflow covers the order to do it in. If you’re not sure what a password manager actually does day to day, here’s the full case for one.

Forty-seven minutes felt like forever. Ninety seconds tonight is the version where you never find out how long it would have taken you.