The worst part is not even losing access. It’s seeing your own Instagram ask for a code sent to a phone number you don’t know. Some random number. Your stomach drops a little because the hacker has done the one thing that makes recovery feel blocked.
But don’t keep guessing passwords for one hour. That just burns you out and sometimes locks things further. Start with the recovery path Instagram already gives, then tighten everything around it.
Stop Trying the Same Login Again
If your Instagram account was hacked and the phone number changed, the hacker probably wants you to panic. They may have changed the number to receive security codes. They may also change the email. So treat this like account recovery, not a normal login problem.
Open Instagram and tap “Forgot password?” or “Get help logging in.” Use your username if your phone number is gone. Try your email too, especially the one that was originally linked to the account.
Check Your Email Before Anything Else
Instagram usually sends a security email when the phone number or email is changed. Search your inbox for “Instagram” and “security.” Also check spam, because of course the important email always hides in the dumbest place.
If you find an email saying your phone number was changed, look for the option that says you can secure your account or reverse the change. Use that link fast. It feels quicker because you’re not trying to convince the app from scratch.
• The old email matters here, even if the hacker changed the phone number later
• If you still have access to your email, protect it first. Change that password before you fight Instagram
• No email from Instagram? Fine. Annoying, but not the end of the road
Use Instagram’s Hacked Account Recovery
Go to Instagram’s hacked account help flow from the app or browser. Pick the option that says your account was hacked. Instagram may ask for your username, old email, old phone number, or a selfie video if the account has photos of you.
The selfie video feels strange. I get it. But for personal accounts, it works well because Instagram is trying to check if the real person matches the account photos. For business pages, recovery can be slower because there may not be a clear face to compare.
Don’t Message the Hacker
This is where people mess up. They message the hacker from another account and start negotiating. Bad idea. It gives the hacker attention and sometimes pushes them to delete posts or demand money.
Meera had this happen while she was sitting with a half-finished cutting chai near her laptop. She stopped reopening the same five tabs every morning and followed the hacked account form properly. Boring, yes. But it finally moved.
Lock Down the Accounts Around Instagram
Your Instagram may not be the only weak spot. If the hacker got in through your email, your Facebook login, or a reused password, they can come back even after recovery. I’m strongly against reused passwords. It’s lazy in a way that punishes you later.
• Change your email password, then turn on two-factor authentication there first
• Remove unknown devices from your email account. That hidden login is the sneaky one
• Check Facebook if it’s linked, because Meta accounts love dragging each other into the mess
Once you get back in, remove the hacker’s phone number. Add your own number again. Then add an authenticator app instead of only SMS. SMS is okay, but an authenticator app is harder for someone else to hijack.
Save Backup Codes Somewhere Sensible
Instagram gives backup codes when two-factor authentication is on. Keep them in a password manager or somewhere private that isn’t your camera roll. Screenshots float around too easily.
What If Instagram Still Sends Codes to the Wrong Number?
Then you keep using username-based recovery and the hacked account form. Don’t select the changed phone number as your only path. Try from a device you used before, because Instagram sometimes trusts familiar devices more than a new browser.
Also report the hacked account from another profile. Ask one or two close friends to report it too if the hacker is posting scams. Don’t make a whole public drama out of it. That usually creates more screenshots than help.