Instagram account takeovers are more common than most people realize. A hacked account can mean losing years of content, your follower base, and — if it's a business account — your livelihood. The good news is that most takeovers are preventable with a handful of security steps that take less than 10 minutes to set up.
Step 1: Enable two-factor authentication (2FA)
This single step prevents the vast majority of unauthorized account access. With 2FA enabled, logging in from a new device requires both your password and a time-sensitive code — so even if someone steals your password, they can't get in.
Go to Settings → Security → Two-factor authentication. Use an authenticator app (Google Authenticator or Authy) rather than SMS — SIM-swapping attacks can intercept text messages, but they can't access your authenticator app.
When you enable 2FA, Instagram gives you backup codes. Save these somewhere safe (not just in your phone's photos — use a password manager or print them). If you lose access to your authenticator app, backup codes are the only way to recover your account.
Step 2: Review apps with access to your account
Every time you've signed in to a third-party app with Instagram, you granted that app some level of access to your account. Go to Settings → Security → Apps and websites. Revoke access to anything you don't actively use, anything you don't recognize, and especially any "follower checker" or "mass unfollow" app — these are the highest-risk category.
Step 3: Check your login activity
Instagram shows you every device and location that has accessed your account. Go to Settings → Security → Login activity. If you see a device or location you don't recognize, tap it and select "This wasn't me" immediately. This will log out that session and trigger a security review.
Step 4: Use a strong, unique password
Your Instagram password should be at least 16 characters, random, and used nowhere else. A password manager (Bitwarden, 1Password, or similar) makes this trivially easy — you only need to remember one master password, and the manager generates and stores a unique password for every site.
Never use the same password on multiple sites. A data breach at any one service immediately exposes every other account that shares that password.
Step 5: Secure your email account first
Your email account is the master key to your Instagram. If someone gains access to your email, they can reset your Instagram password. Make sure your email account has 2FA enabled with an authenticator app — not just SMS — and that its password is equally strong and unique.
Step 6: Be skeptical of DMs and emails claiming to be from Instagram
Phishing is the most common vector for account takeovers. The attack looks like this: you receive a DM or email saying your account will be disabled unless you verify it by clicking a link. The link takes you to a convincing fake Instagram login page that captures your credentials.
Instagram never asks for your password via DM or email. Any urgent message claiming your account is at risk should be treated as a phishing attempt. Always go directly to instagram.com rather than clicking links in messages.
2FA with authenticator app ✓ · Strong unique password ✓ · Email account secured ✓ · Old apps revoked ✓ · Login activity reviewed ✓
What to do if your account is already compromised
Act immediately. Go to instagram.com/hacked and follow the account recovery flow. If the hacker has already changed your email and phone number, you'll need to use Instagram's identity verification process, which may require a government ID. The sooner you act, the better your chances of recovery.