Challenges we faced
- The attacker changed the password, email, phone number, and backup codes in one sweep Every standard recovery link was routed to the attacker's details.
- The account supported a business, so downtime affected leads and customers.
- The attacker used direct messages to pressure the owner into paying.
- No backup codes were stored and no authenticator app was set up.
- There was no record of which staff had access to the account
Our solution
-
Collected evidence
Captured screenshots of every notification, error, and attacker message with timestamps
-
Secured the recovery email
Changed its password, enabled 2FA, and reviewed forwarding rules and filters
-
Used the official recovery flow
Submitted the request at instagram.com/hacked with ownership details and completed video verification
-
Escalated with proof
Submitted a Meta support request with the timeline and evidence where the automated flow stalled
-
Refused payment and warned followers
Paid nothing, shared no codes, and posted a fraud warning from a verified second channel
-
Reported to authorities
Filed a complaint on cybercrime.gov.in with the extortion messages and attacker details
-
Secured the account
Set a unique password, signed out other sessions, removed unknown apps, enabled authenticator 2FA, and stored new backup codes offline
Outcome
Access to the account was restored on 2 days after the takeover. The owner paid nothing to the attacker. The account now uses authenticator-app 2FA, offline backup codes, and a reviewed list of admins and staff access.
Tech & tools used
- Instagram Accounts Center
- Meta Business Suite
- Google Account Security
- Authenticator App
- cybercrime.gov.in