Instagram Hacked? How to Get Your Account Back — Even From Abroad

Why an Instagram hack is worse abroad

Instagram is a prime target because a real account with genuine followers is valuable — attackers use it to run crypto and investment scams on people who trust you, or to hold a large following for ransom. When it happens while you're travelling, the timing is cruel: the security codes you'd use to recover go to a home phone with no roaming signal, you're in the wrong time zone for support, and your audience is watching scam Stories go out in your name in real time.

We help digital nomads and expats through exactly this, so the steps below assume you're recovering the account from another country on imperfect WiFi.

Signs your account was taken over

• You're logged out and the password no longer works.
• An email from Instagram says your email, phone, or password was changed.
• Your profile photo, name, or username was changed without you.
• Scam Stories or DMs (crypto, fake giveaways) are posted in your name.
• Followers report phishing messages coming from your account.

Recover it step by step

Go in order and don't keep retrying the password — repeated failures harden the lock.

1. Start at instagram.com/hacked

Or in the app: "Can't log in?" → "Get help logging in". Choose "My account was hacked" and request a login link or a security code sent to your email or phone.

2. If your email was changed, revert it

Instagram emails your old address with a "your email was changed" notice and a "revert this change" / secure-account link. Tap it immediately to take the account back before the attacker finishes locking you out.

3. Use video-selfie verification

For an account containing photos of you, Instagram can ask for a short selfie video (you turn your head) to confirm your identity. Once it passes, Instagram emails a support code or recovery link — often the most reliable route for personal and creator accounts.

4. Once you're back in, lock it down

• Change to a strong, unique password.
• Fix the linked email and phone — remove the attacker's, restore yours.
• Remove unknown devices: Settings → Account Center / Security → where you're logged in.
• Revoke unknown third-party apps and linked accounts.
• Check your Stories, DMs, and bio for what the attacker posted, and warn your followers.

The abroad problem: the code you can never receive

Many travel lockouts aren't the hack itself — it's that Instagram texts a code to a home number with no roaming. Make the second factor work anywhere:

1. Use an authenticator app (Authy, Google Authenticator, or your password manager's TOTP) — codes generate offline, no signal needed.
2. Save backup codes offline for Instagram and your email.
3. Keep a reachable recovery email you can open from abroad.
4. Keep your home SIM reachable briefly via roaming, dual-SIM, or forwarding for verification.

Because reset links flow through email, our email & Microsoft 365 team often restores the email first, then the Instagram account.

Pro & creator accounts linked to Facebook

Business and creator accounts are frequently linked to a Facebook Page through the Meta Accounts Center. If you still control the admin Facebook account, you can often restore Instagram access there and remove unknown connections. If the same attacker hit both, recover the Facebook side too and review all linked sessions.

Lock it down before you fly (10 minutes)

• Switch SMS 2FA to an authenticator app on Instagram and your email.
• Save offline backup codes.
• Use a unique password via a password manager.
• Be ruthless with phishing DMs — fake "paid collaboration" and "your account violated our rules" messages are the #1 way creators get hacked. Never enter your login outside the official app.

This is the same checklist we set up for every remote worker and creator we onboard.

Real example: an Instagram takeover mid-trip

A typical case: you're abroad and get a polished DM from a "brand" offering a paid collaboration, or a message from "Instagram" warning your account violated copyright and faces deletion. The link opens a fake login page; you enter your details. The attacker signs in, changes your email and phone, turns on their own 2FA, and swaps your profile photo and username to slow you down — all while your followers watch scam Stories go out in your name. And the security code Instagram would text you lands on a home SIM with no signal.

The fix is the sequence above: open your email first to catch the "your email was changed" revert link; otherwise use "Get help logging in" and, for accounts with your photos, video-selfie verification. Set up an authenticator app before you travel and this becomes a ten-minute fix instead of a multi-day ordeal.

Video-selfie verification, in detail

For personal and creator accounts containing photos of you, the selfie video is the most reliable path — and travelers often fumble it on bad WiFi. To pass first time: find good lighting with your face clear (no sunglasses or hat), follow the head-turn motion exactly, use a device Instagram recognises if you can, and then wait — Instagram emails a support code or recovery link, usually within a few hours to a few days. Don't fire off ten requests; it slows the review.

Recovering a pro account linked to Facebook

Many business and creator accounts are tied to a Facebook Page through the Meta Accounts Center. If you still hold the admin Facebook account, that's frequently the fastest route from abroad: open Accounts Center, find the Instagram link, and use the security and login options from the Facebook side, removing any unknown connections. If the same attacker hit both, recover Facebook first and Instagram often follows.

Crypto scams, impersonation, and warning your followers

Stolen Instagram accounts are almost always used for investment scams pushed to followers who trust you. Once you're back in: post a Story and a feed post stating the account was hacked and no investment messages came from you, delete the scam Stories and DMs, tell anyone who replied not to send money, and report the lookalike "copycat" accounts that often spring up impersonating you after a theft.