Act as soon as you suspect a takeover -- don't wait
The window to recover an account is easiest to use before an attacker changes every piece of contact information tied to it. If you notice anything off -- an unfamiliar login alert, a changed profile detail -- start the recovery process immediately rather than waiting to see if it resolves itself.
Recovery is only half the job -- lock the account back down
Regaining access without changing your password and reviewing connected apps and sessions leaves the same vulnerability open. Treat the moment you regain access as the real starting point for securing the account, not the finish line.
Frequently Asked Questions
What if I no longer have access to the email or phone number linked to my account?
Instagram's recovery flow will typically offer an alternative identity verification method, such as submitting a video selfie or photo ID, when the original contact methods aren't available.
How can I prevent this from happening again?
Turn on two-factor authentication, use a strong unique password, and avoid clicking suspicious login links sent in messages -- these three habits address the most common ways accounts get compromised.