How to Recover Your Instagram Account When the Email and Phone Number Have Been Changed

I know because I’ve been through it. This summer it took 18 days, 50+ emails, more than ten different support agents and about eight scheduled phone calls that never happened to get one of our clients back into their business Instagram account.

This guide covers both routes: the self-service steps to try first, and what to do when you’re stuck with Meta’s support team.

Instagram hacked and email changed? Start here

Try these in order. Most people get their account back at step 1 or 2.

1. Look for the “secure your account” email

When the email on an Instagram account changes, Instagram sends a message to the old address from security@mail.instagram.com. It contains a link to reverse the change and secure your account. Search your inbox and spam folder for it, and act quickly, because the link doesn’t last forever.

Check the sender carefully before you click anything. Fake “Instagram” emails are common.

2. Use instagram.com/hacked

Go to instagram.com/hacked in a browser, or tap Forgot password? on the app’s login screen. Enter your username, email address or phone number, and ask for a login link or security code.

Try every detail you have. Whoever changed the email may not have changed the username or the phone number.

3. Verify your identity with a video selfie

If you can’t get a code, Instagram may ask for a short video selfie, turning your head as directed. This only works if the account has photos of you. For accounts without your face, such as most business accounts, Instagram may ask for the email or phone number you signed up with and the type of device you used.

4. Don’t pay a “recovery service”

Anyone offering to recover your Instagram account for a fee is almost certainly a scammer. Official recovery is free and happens only through Instagram and Meta.

When self-service fails: business accounts and former employees

The steps above are built for one person getting their own account back. They work far less well for business accounts. If a former employee, freelancer or agency changed the login details and won’t hand them back, there’s often no selfie to verify and no original email you can reach.

That’s what happened to Davlav, a UK portable toilet hire company and a long-standing Locals Talk client. Someone who used to run their Instagram had changed the recovery email and phone number to their own, then left the business. Nobody could reach them.

We still had access to @davlavuk through Davlav’s Meta business portfolio, so it looked simple. Here’s how it went:

• Day 1. Meta’s first reply asked me to “elaborate more about your concern”. It didn’t say what information it needed.
• Days 2 and 3. Automated emails said Meta was “waiting on additional information” from me, still without saying what. When I asked directly, I got a list of documents.
• Day 6. I sent everything: a signed statement from the director, his photo ID, Companies House records and Meta invoices billed to the company.
• Day 7. An agent asked whether we’d tried getting access back from the previous owner. We had, for months.
• Days 7 to 16. Meta offered a phone call. Agent after agent asked for “three preferred time slots”. I gave time windows, then whole days, then sent a Google Meet link. Nobody called, about eight times over. In the end I told them I was free from “9:30 am today to midnight 31 December 2075”.
• Day 17. Meta asked for the signed statement again, eleven days after I’d sent it.
• Day 18. An agent writing under a different case number changed the account email and sent a password reset in a single message. We were back in within the hour.

How to get through Meta Pro Team support

If your case reaches a human, it will most likely be the Meta Pro Team, Meta’s email support for businesses and advertisers. Here’s what I’d do differently, and now do for every client.

Send the full evidence pack in your first message. Don’t wait to be asked, because the requests come slowly and in pieces. For a business account access dispute, Meta eventually wanted all of this, in PDF:

• A signed statement from someone with authority. It should cover the account handle and link, your relationship to the account, the current admin’s name and original role, and confirmation that their working relationship with you has ended.
• The email address for the new admin. It must not be linked to any other Instagram account.
• This exact sentence: “I declare under penalty of perjury that the information provided is true and accurate.”
• Government photo ID for the person who signed.
• Business documents: your Companies House certificate, the director’s appointment, Meta invoices billed to the company and screenshots of your business portfolio.

Write the outcome you want in one sentence, and repeat it every time. For example: “Restore login access to @yourhandle, or update the recovery details so the business can manage it.” A clear ask is harder to answer with a template.

Reply to every automated email. A “waiting on additional information” email is a countdown to your case closing. Reply every time, even if it’s just “Still unresolved, please keep this case open.” Ask them in writing not to mark the case resolved until you’re actually back in.

Don’t wait for the phone call. Calls get scheduled and missed. Give one wide availability window, then keep the email thread moving as if the call will never happen.

Open a second, clean case. Our fix arrived under a different case number while the first case was still going round in circles. I can’t prove that’s why it worked, but a second case with the full pack and a one-line ask takes ten minutes.

Ask for escalation, in those words. “Please escalate this to a specialist team” gets a different response from “any update?”.

In live chat, never go quiet. Agents close chats after a few seconds of silence. Paste a prepared message the moment the chat opens, and type “Still here” if you need time to read.

Is the Meta Pro Team real?

Yes. Every email in our case came from a support.facebook.com address, which Meta lists as an official domain. Scammers copy Meta’s branding too, though, so check the full sender address before you reply, click a link or share documents. Meta won’t ask for your password, and it doesn’t contact you about account security by DM.

Back in? Lock it down straight away

Getting back in isn’t the end of it. When we recovered Davlav’s account, the former employee was still logged in on several devices. Once you’re back in:

• In Accounts Centre, go to Password and security, then Where you’re logged in, and log out every device you don’t recognise.
• Change the password, and turn on two-factor authentication with an authenticator app.
• Save your backup codes somewhere safe.
• Check the email address and phone number on the account belong to the business.
• Remove anyone who no longer needs access.

How businesses can avoid losing an Instagram account

The best way to deal with Meta support is never to need it. Most business lockouts I see come down to one person holding the keys. For every account, check these:

• The business owns its accounts. Pages, Instagram accounts and ad accounts sit in the company’s own Meta business portfolio, not a freelancer’s or an agency’s.
• There are at least two admins with full control, both people who still work there.
• The recovery details belong to the business. Use a shared address like marketing@ for the login, not a personal Gmail or a staff member’s mobile.
• Leaving includes Meta. When someone leaves, remove their access, change the passwords, check the recovery email and phone, and log out their devices, all on their last day.
• Payment methods are kept up to date. An expired card on a forgotten account can trigger restrictions that follow you for years.

That’s half an hour of admin. Davlav’s recovery took 18 days.

My own Meta case: 17 months “in review”

I’m writing this partly because of my own experience today. Locals Talk’s own Meta business portfolio has been restricted from advertising for years. As far as I can piece together, it goes back to an expired card on my personal profile from my days in Pakistan, when I occasionally boosted posts.

My personal profile is fine, and I run Meta ads for clients every week. But my company Page is linked to the restricted portfolio, so I can’t advertise my own business.

I asked Meta to review the restriction on 23 June 2025, and was promised a decision within 48 hours. Seventeen months later, it still says “Request in review”. Today a live chat agent closed my case because I took a few seconds to read their reply. I’ve reopened it, and I’m following my own advice above. I’ll update this post when something happens.

If you work at Meta and you’re reading this, case #1488206213210211 would love to hear from a human.