Business Instagram Account Hacked? How to Recover It, Warn Customers and Prevent It Happening Again

Quick answer: Check your email for a message from Instagram about the change and use its "secure your account" link to reverse it. If that doesn't work, go to instagram.com/hacked (or "Need more help?" on the login screen) and follow the recovery steps — you may be asked for a video selfie or a login code. Warn customers immediately on WhatsApp, Google posts and Facebook not to send money or respond to offers from the account. Never pay the hacker or "recovery agents" who message you. Once recovered, change passwords, turn on two-factor authentication with an authenticator app and remove unknown devices and linked apps.

For Instagram-first businesses — boutiques, home bakers, makeup artists, cafés — a hacked account means lost orders and customers at risk of being scammed in your name (Instagram-only business).

Signs of a hack

• You're logged out and your password doesn't work.
• Email or phone on the account changed.
• Strange posts, stories or DMs offering investment, crypto or giveaways.
• Followers report messages asking for money.
• Your username changed.

Step 1: check your email

Instagram emails you when the email address is changed. Open the email "Your Instagram email has been changed" and tap "revert this change" or "secure your account". Do this quickly.

Step 2: use Instagram's recovery flow

1. On the login screen, tap "Forgot password" or "Need more help?".
2. Or visit instagram.com/hacked from a browser.
3. Choose "My account was hacked".
4. Follow prompts: Instagram may send a code to your original email or phone, or ask for a video selfie turning your head, if the account has photos of you.
5. For business accounts without your face, you may need to provide business details.

Recovery can take from minutes to several days.

Step 3: if linked to Facebook or Meta Business

If the account is linked to a Facebook Page or Meta Business Suite, check whether you still have access there. You may be able to remove the hacker or reset access through Meta's help centre and Accounts Center.

Step 4: warn customers

The hacker may scam your followers. Immediately:

• WhatsApp broadcast and status: "Our Instagram has been hacked. Please don't send money or reply to any offers from it. Contact us only on [number]."
• Google Business Profile post with the same message (posts guide).
• Ask friends and loyal customers to report the account as hacked.

Step 5: don't pay anyone

• The hacker may demand money to return the account. Paying rarely works.
• "Recovery experts" who DM you are almost always scammers.
• Only use Instagram's official help pages.

If threatened or extorted, report at cybercrime.gov.in or call 1930 (UPI fraud tips).

Step 6: once recovered

• Change your password to a long, unique one.
• Turn on two-factor authentication using an authenticator app rather than SMS.
• Check login activity and log out unknown devices.
• Remove unknown linked apps and third-party tools.
• Update the email and phone to ones only you control.
• Delete scam posts and stories, and post an update explaining what happened.
• Review account-level admins on linked Pages and business tools.

If recovery fails

If you can't recover the account after trying everything:

• Create a new account with a similar but clear name ("[brand].official").
• Announce it everywhere: Google, WhatsApp, website, packaging.
• Report the old account as impersonation once your new one is set up.
• Ask followers to follow the new account and report the old one.

Why it's important to have Google and a website too

During the hack, customers who search your name on Google should still find your real phone, WhatsApp and website. A strong Google Business Profile and website protect your business from depending on one app (Instagram vs Google).

Prevention

• Unique strong password, stored in a password manager.
• Two-factor authentication with an authenticator app.
• Don't click "copyright violation" or "verification badge" DMs and emails — common phishing tricks.
• Limit who has the password; use proper roles in Meta Business tools.
• Remove ex-staff and old agencies (ex-employee access).
• Keep your account email secure with its own two-factor login.

Example: a boutique

A boutique's Instagram was hacked through a fake "copyright violation" email. The hacker posted crypto offers. The owner used the email revert link within an hour, turned on authenticator-based two-factor login, and warned customers on WhatsApp. No customers lost money.

Example: a home bakery

A home baker lost access when the email was changed. She used the video selfie flow, recovered the account in two days, and meanwhile took orders through WhatsApp and her Google profile.

Checklist

• Use the email revert link
• Follow instagram.com/hacked
• Warn customers on WhatsApp and Google
• Don't pay hackers or "recovery agents"
• Turn on authenticator 2FA
• Remove unknown devices and apps
• Keep Google and website up to date

Key takeaways

• Act within the first hour — the email revert link is fastest.
• Warn customers before scams spread.
• Two-factor authentication prevents most hacks.

Sources and further reading

• Instagram Help Center — hacked accounts: help.instagram.com
• National Cyber Crime Reporting Portal: cybercrime.gov.in

Make an emergency plan today

Write down what you'll do if any account is hacked: who to call, which customers to warn first, where to post updates and which backup number to share. Keep the account email, phone and backup codes for two-factor login somewhere safe and offline. Five minutes of planning saves hours of panic.

Frequently asked questions

How do I recover a hacked Instagram?

Use the email revert link or instagram.com/hacked.

What is video selfie verification?

A short video Instagram uses to confirm you're the account owner.

Should I pay the hacker?

No.

Are recovery services real?

Most that DM you are scams.

How do I warn customers?

WhatsApp, Google posts and your other social channels.

How do I prevent it?

Strong password, authenticator 2FA and caution with phishing messages.