Getting a notification that someone logged into your Instagram account from an unknown location is unsettling. Whether it's a city two time zones away or an entirely different country, that alert means an unauthorized person bypassed your credentials or exploited an active session. Immediate action prevents data theft, spam distribution to your followers, and permanent account lockouts.
When this happens, your first move isn't panicking—it's locking down your active sessions and securing your login credentials. Instagram provides built-in tools to inspect where your account is logged in and kick out intruders instantly. This guide breaks down the exact sequence of steps required to reclaim your profile, secure your settings, and prevent future breaches.
Verify the Security Alert and Check Active Sessions
Before you assume the worst, verify whether the login notification is legitimate or a phishing attempt. Look closely at the email sender address. Real Instagram security emails always come from security@mail.instagram.com. If the message came from a random Gmail or Outlook address, it's a phishing trick designed to make you click a fake login link.
If the warning is real, check your active login sessions immediately through the mobile app.
- Open Instagram and go to your profile page.
- Tap the three horizontal lines in the top-right corner to open the menu.
- Select Settings and privacy, then tap Account center.
- Tap Password and security, followed by Where you're logged in.
- Choose your Instagram account to view every device currently holding an active session.
Review the list of cities, devices, and timestamps. If you spot a device or location you don't recognize, tap Select devices to log out, check the suspicious session, and tap Log out. This immediately terminates the intruder's access, even if they currently have your password.
Change Your Password and Secure Your Email
Kicking an intruder out of active sessions buys you time, but they can log right back in if they know your current password. You need to change your password immediately, and you must secure the email address tied to your account first.
Hackers often gain access to an Instagram account by first breaking into the user's primary email. If your email account is compromised, the intruder can easily request a password reset and lock you out permanently.
- Go to your email provider (such as Gmail, Apple, or Outlook) and check your account security settings. Enable two-factor authentication on your email and sign out of all unknown devices.
- Return to Instagram's Account center, select Password and security, and tap Change password.
- Enter your current password, then create a strong, unique new password that you don't use on any other website or app.
Avoid using predictable patterns, personal dates, or words found in the dictionary. A strong password combines uppercase letters, lowercase letters, numbers, and symbols, or consists of a random passphrase of four or more unconnected words.
Enable Two-Factor Authentication
If you didn't have two-factor authentication turned on before the breach, turn it on right now. Two-factor authentication adds a vital secondary defense layer, requiring a unique login code sent to your phone or generated by an authenticator app whenever someone tries to log in from a new device.
- In Instagram's Account center, go to Password and security.
- Tap Two-factor authentication and select your Instagram account.
- Choose your preferred security method. Authentication apps (like Google Authenticator, Duo, or 1Password) offer the strongest security because they aren't vulnerable to SIM-swapping attacks. Alternatively, you can use text message (SMS) codes.
- Save your backup codes in a secure password manager in case you lose access to your phone.
Using an authenticator app prevents attackers from intercepting verification codes via mobile carrier vulnerabilities, keeping your account secure even if your phone number is targeted.
Review Account Details and Remove Unauthorized Changes
Intruders often alter account details to make recovery harder or to redirect traffic to scam links. Once your account is secure, check every corner of your profile settings to undo any unauthorized modifications.
- Phone number and email: Verify that the recovery email and phone number listed in your Personal Details section still belong to you. If a hacker swapped them out, change them back immediately.
- Linked accounts: Check the Sharing across apps and Accounts sections in the Account center. If you see an unfamiliar Facebook page, TikTok, or Twitter account linked to your profile, unlink it right away.
- Authorized apps: Go to Apps and websites in your settings and remove any third-party scheduling tools, follower trackers, or games that you don't recognize or no longer use.
Check your recent posts, archived stories, direct messages, and comment history. Attackers frequently use compromised accounts to send direct message spam promoting cryptocurrency scams or phishing links to all your followers. Delete any posts or messages you didn't authorize so your friends know your account was temporarily compromised.
What to Do If You Are Locked Out Completely
If the intruder changed your password and email address before you could intervene, standard login attempts will fail. You can still recover your account using Instagram's built-in support tools.
- Open the Instagram login screen on your phone.
- Tap Get help logging in (on Android) or Forgot password? (on iOS).
- Enter your original username, email, or phone number.
- Instead of requesting a reset link sent to a hacker's changed email, tap Need more help? at the bottom of the screen.
- Follow the on-screen prompts to submit an account recovery request. Instagram will typically ask you to verify your identity by submitting a video selfie where you turn your head in various directions, or by providing the original email address and phone number you used when creating the account.
Once Instagram verifies your identity, they will send secure recovery instructions to a safe email address you provide.
Common Mistakes to Avoid After a Breach
When dealing with an account compromise, small errors can leave your profile vulnerable to secondary attacks. Avoid these common missteps:
- Reusing old passwords: Don't swap your compromised password for an older password you used six months ago. Create something entirely fresh.
- Ignoring auxiliary accounts: If your Instagram was breached, assume your Facebook, email, and LinkedIn accounts might also be at risk, especially if you reused login credentials across platforms.
- Falling for recovery scams: Be wary of accounts on Instagram claiming they can "hacker-for-hire" recover your account for a fee. These are always scammers looking to steal more money from you. Only use official support channels within the app.
For additional guidance on digital safety, review the Federal Trade Commission online security guide or official advice from Meta Privacy Center.
Frequently Asked Questions
Why did I get an Instagram login alert from a city I've never visited?
This usually happens for three reasons: your internet service provider routes your mobile or home data through a server in a neighboring city, you connected to a public Wi-Fi network that masks your physical location, or an unauthorized person successfully accessed your credentials from that specific region.
Can someone hack my Instagram if I have two-factor authentication enabled?
It is extremely difficult, but not entirely impossible. Attackers can bypass SMS-based two-factor authentication through SIM-swapping or sophisticated phishing pages that capture real-time session tokens. Using an authenticator app significantly reduces this risk.
How long does Instagram take to respond to a hacked account recovery request?
Review times vary depending on the volume of requests and the clarity of your verification materials. Video selfie verifications are often processed within 24 to 48 hours, though complex cases can take longer.
Should I delete my Instagram account after a breach?
No. Once you have logged out all active sessions, changed your password, enabled two-factor authentication, and removed unauthorized third-party apps, your account is safe to continue using normally. There is no need to abandon your profile.
