My business's Instagram got hacked: what to do in the first few hours

Losing your business's Instagram isn't just losing followers: it's losing the channel your orders come in through, and handing a stranger an account with your name on it to scam your customers. What you do in the first few hours makes a big difference.

Step 1: check what you can still do

• Can you still log in? Change your password right away, from Configuración → Centro de cuentas → Contraseña y seguridad (Settings → Accounts Center → Password and security), and log out of any sessions you don't recognize in Dónde iniciaste sesión (Where you're logged in).
• Did they lock you out? Look in your email for a message from Instagram saying your email or password was changed. Those messages usually include a link to reverse the change: use it as soon as possible.
• Don't have any of that? Go to Instagram's official recovery at instagram.com/hacked, from the app or the browser. Instagram may ask you for a video selfie to confirm your identity: it's part of the official process.

Step 2: watch out for people who "help you"

As soon as they find out you've been hacked, accounts show up offering to recover your profile in exchange for a payment. They're scams. Recovery is done only through Instagram's official channels and it's free.

The same goes for emails: Instagram lets you see the real emails it has sent you in Configuración → Centro de cuentas → Contraseña y seguridad → Emails recientes (Recent emails). If an email that claims to be from Instagram doesn't appear there, it's fake.

Step 3: let your customers know

While you're recovering the account, the intruder may be posting fake offers or asking for bank transfers. Warn people through the other channels you have (WhatsApp, Facebook, your online store, a WhatsApp status):

“

Our Instagram account has been hacked. Don't reply to messages or make payments requested from that account until we let you know we've recovered it.

It's uncomfortable, but it protects your customers and your reputation.

Step 4: once you've recovered it

1. 1
   A new, unique password, one you don't use anywhere else.
2. 2
   Two-step authentication with an authentication app (Google Authenticator, Microsoft Authenticator or similar) instead of SMS whenever possible.
3. 3
   Save the recovery codes Instagram gives you when you turn on two-step authentication, in a safe place outside your phone.
4. 4
   Check the email and phone number on the account: make sure they're yours.
5. 5
   Check connected apps and third-party access (agencies, post-scheduling tools) and remove the ones you don't use.
6. 6
   If the business uses a Meta business portfolio, check who has access and with what permissions.

How it usually starts

Most of the account thefts we see start the same way: a direct message saying you've infringed copyright, that your account is going to be verified or that you've won something, with a link to a page that asks for your password. Instagram will not ask you for your password by direct message.

With a unique password, two-step authentication turned on and a well-protected email, the vast majority of these attacks go nowhere.

Do you manage several business accounts and aren't quite sure who has access to what? We'll help you sort it out and leave everything protected.