When a social media account has been hacked, the first hours count. If you secure access quickly, warn your contacts and use the platform support at the same time, you usually limit the damage considerably. This guide sets out the order of steps, the routes to support and what to do after recovery.
Short answer: With a hacked social media account, first secure access, then inform your contacts and use the platform support. The Verbraucherzentrale recommends using several routes at the same time for a hacked account (page status: 30.03.2026). On Instagram the support form at instagram.com/hacked is the central entry point. If you can no longer open the account, the route via help with logging in applies.
The most important points at a glance
- Act quickly, because the longer access stays open, the more damage can occur.
- Use several routes at once: the support form, help with logging in and, if needed, a fallback by email.
- If you cannot open the account because the password has been changed, start with “get help logging in”.
- The email address the account was created with is often the key to recovery.
- Warn your contacts so that nobody opens links in messages that supposedly come from you.
How do you recognise a hacked account?
Typical signs include logins from devices you do not know, changed login details, posts or messages you did not write, or contacts asking about unusual messages. If you suddenly cannot log in although your password is correct, this also points to a takeover. Then act at once rather than the next day.
What do you do in the first hours?
The order of the first steps often decides the outcome. Access to your email address is usually more important than access to the account itself, because password resets run through it. Secure the email account first and then the affected social media profile. The German Federal Office for Information Security (BSI) advises on its page on hacked social media accounts (page date 19 February 2025, retrieved on 2 November 2026, in German) to change the credentials as quickly as possible, end running sessions on other devices and, if the same password is used, change the email password as well. If unauthorised persons have changed the password, you report the account to the platform and ask for a reset. According to the BSI you warn your contacts by message or, best of all, in person, and you file a report through the online police station of the competent state police.
- Change the password of the email account linked to the social media account and check any forwarding rules.
- Log out of the hacked account if that is still possible, and review the list of active sessions.
- Use the platform support form and describe the incident briefly and clearly.
- Inform your contacts about the takeover so that they do not open links sent in your name.
- Save screenshots of suspicious messages and posts before they are deleted.
Which routes to support exist?
The Verbraucherzentrale describes several routes for Instagram that complement each other. The table below shows when each one fits.
| Route | When it makes sense | Note |
|---|---|---|
| Support form at instagram.com/hacked | If you believe your account has been hacked | The central entry point, where the Verbraucherzentrale also describes which details to enter |
| Help with logging in | If the password has been changed and you can no longer open the account | Remove the entry via the three dots and “Log out”, then choose “Get help logging in” |
| Entering the email address of the account | If the login details are unknown | According to the Verbraucherzentrale, the details have then probably been changed |
| Fallback by email | If the form does not respond | The address is in the imprint; according to the Verbraucherzentrale it is not specifically intended for support requests |
The Verbraucherzentrale points out that a hacked account calls for quick action. It is therefore important not to wait for a single answer but to use the routes in parallel. A reply can take days, so clear documentation of your steps helps.
What do you do after recovery?
Once access is back, prevention matters. Use a new, long password for the account that you do not use anywhere else. Check whether you used the old password for other services and change it there too. Also enable two-factor authentication if the platform offers it. The BSI names it as a protective measure that makes it harder for attackers to hack an account. The platform help pages describe the steps after an account takeover in detail, so a look there is worthwhile.
Afterwards check linked apps, browser sessions and forwarding rules. Remove unknown applications that have access to your profile. If payment details are stored in the account, also review your bank statements for unusual entries.
Why a hacked account is more than a profile
Social media accounts are often linked to names, photos, circles of friends and sometimes payment methods. If an attacker gains access, they can exploit trust built within your circle of friends. Messages with a link or a request for a short-term transfer then seem credible, even when they are obviously not typical for you.
The same password is also often used for several services. Access to one profile can therefore put other accounts at risk. After an incident, the concern is not only that one profile but every service where you used the same login details.
Frequently asked questions
Do I have to change the password if I can still log in?
Yes, that should be your first step if you can still log in. A new password generally ends the attacker access once the old sessions have been closed. Then log in again on all devices and check the list of active sessions.
What about messages sent in my name?
Inform your contacts, ideally with a short message through another channel such as email or phone. Ask them not to open links and not to make payments requested in the messages. Document the messages before you delete them.
What if my email address itself has been hacked?
Then the attacker has gained the most important access, and the email account takes priority. Change the password there, check forwarding rules and recovery addresses, and enable two-factor authentication. Only then work through the linked accounts one after another.
Can I report fraud to the police?
If the access has caused damage, for example through payment fraud or extortion, you can file a report with the police. Secure the evidence for this, such as screenshots, times and messages, and include it in the report.
When should you get additional help?
If money has already left your account, payment data has been misused or extortion is threatened, the platform support alone is not enough. Then involve your bank and the police. If accounts do not come back or you cannot reconstruct what happened, advice is worthwhile, for example from a consumer advice centre. The sooner you secure records, the easier the clarification later.
What to do now
- Change the password of your email account first and check the recovery addresses.
- Use the support form and, if needed, help with logging in.
- Warn your contacts and save the suspicious messages as screenshots.
- Change the password at other services where you used the same one.
- Enable two-factor authentication and check active sessions regularly.
Related guides
- Identity theft among students: protection and immediate steps
- Phishing at the university: how to check emails properly
- Phishing email from the bank: how to recognise it
- Parcel phishing: how to recognise fake delivery notifications
- Consumer rights in everyday life: protection against fraud and unfair contracts
Sources: Verbraucherzentrale: contacting Instagram support, how it works (page status: 30.03.2026)
Last updated: November 2026. This guide is general information, not individual advice.
