Reverting the email change from the automatic alert Instagram sends when someone modifies the address on an account looks like a minor formality, and it is the one that decides whether you get your business profile back the same afternoon or enter weeks of forms with Meta. If your Instagram account has been hacked, try to recover it from that email or through the official hacked-account process, keep every alert and screenshot before touching anything and report it to the police, because entering your account without permission is an offence under article 197 bis of the Spanish Criminal Code and demanding money to give it back is extortion under article 243. Do not pay the ransom and do not hire anyone who promises to recover it for a fee, because that offer is usually the second stage of the same scam.
My Instagram account was hacked and the email changed, what to do before asking for help
The intruder changes the email address first, then the phone number and the password, and Instagram sends the old address an alert that your email has changed, with a link to revert it that works for a limited time. If it still responds, use it, change the password and switch on two-step verification with an authenticator app, not SMS. If the link has expired or the intruder has already set up their own verification, what remains is the official hacked-account process Meta offers from the login screen, which confirms your identity from a device you have used before, with a code to the original email or, when the account has photos of your face, with a video selfie. Business accounts with no face are the ones that get stuck there.
Before starting any of that, secure the evidence, because every attempt generates new emails and the intruder deletes what they can. Keep, without deleting, Instagram’s alerts about changes of email, phone and password, with their date and time. Take screenshots of the posts, stories and messages sent from your account, with the URL visible, and of any demand for money, including the cryptocurrency wallet address. If you clicked a link that arrived by email or direct message, keep that message. Do not reset the phone or log out of sessions blindly until you have the screenshots.
In parallel, change the password of the email you created the account with and the Facebook password, because with Meta’s Accounts Center a single entry opens both networks, and review the apps with permission over your profile. Tell customers and followers through another channel, your website, WhatsApp Business or your Google listing, that the account is in someone else’s hands and that any offer, giveaway or investment coming from it is fake, and keep a dated copy of that notice. Do not reply to the intruder or pay, and distrust anyone who writes offering to recover the account for an upfront payment.
I think my Instagram account has been hacked, the signs and how they got in
The signs are an Instagram email about a change you did not request, a login alert from a city you are not in, a password that stops working, posts or stories that are not yours, a bio rewritten with cryptocurrency promises, a changed username and followers phoning to ask whether you really sell bitcoin. If all you have received is a message claiming to have hacked you and asking for money, with none of the above happening, it is most likely a bluff sent to thousands of addresses, and the account’s login activity confirms it.
The most common way in is an email or direct message imitating Meta, with a copyright infringement notice, a blue badge verification or a threat to delete the account within twenty-four hours, and a link to a fake login page that captures the password and the code. Next come messages from already hijacked accounts of people you know, asking for a vote in a contest or for a code “to recover mine”, a password reused on another service that suffered a leak, third-party apps with access to the profile, the employee or agency that still holds the credentials and a duplicated SIM card when verification arrives by SMS. The same mechanics drive the bank impersonation scams I have written about. Knowing how they got in matters, because the report changes with each case and because a preserved phishing email is evidence.
Accessing your account is an offence under article 197 bis and demanding money to return it is extortion
Article 197 bis of the Spanish Criminal Code punishes anyone who, without authorisation and breaching security measures, accesses an information system or remains in it against the will of the person entitled to exclude them, with six months to two years in prison. Your password-protected Instagram account is that system. If the intruder also took your private messages or those of your customers, the offence of discovery of secrets under article 197.1 is added, with one to four years in prison and a fine.
The demand for money to return the account, with the threat of deleting it, selling it or publishing what is inside, is extortion under article 243, compelling another person through intimidation and for profit to perform an act to the detriment of their assets, punished with one to five years in prison. When the court finds the facts fit better under conditional threats in articles 169 and 171, the penalty is lower. What the intruder deletes or disables, posts, catalogue, your own access, is computer damage under articles 264 and 264 bis, and if they use your account to sell non-existent products or push cryptocurrency investments on your followers, they commit fraud under article 248 against each of them.
| Intruder’s conduct | Criminal Code article | Penalty |
|---|---|---|
| Entering the account without authorisation | 197 bis | 6 months to 2 years in prison |
| Taking your private messages | 197.1 | 1 to 4 years in prison and a fine |
| Demanding money under threat to return it | 243 | 1 to 5 years in prison |
| Deleting content or disabling the account | 264 and 264 bis | 6 months to 3 years in prison |
| Defrauding your followers from the account | 248 and 249 | 6 months to 3 years in prison above 400 euros, a fine of 1 to 3 months below that |
| Fully impersonating a natural person | 401 | 6 months to 3 years in prison |
These offences are tried in the same proceedings, and the legal classification proposed in the first filing weighs on what the court investigates and on the compensation that can be claimed. Article 401, usurpation of civil status, only reaches a fake profile that completely impersonates a natural person, and does not protect the business as such, whose defence against a cloned account runs through the fraud on buyers and through trademark law. At the firm we act as prosecuting party in these matters, draft the police report or the formal complaint with the evidence in order and ask the court for what has to be requested from Meta, as I explain on the cybercrime page.
My Instagram account was hacked and they want bitcoin, why paying makes your position worse
The message arrives by email, through another network or from your own hijacked account, sets a price in bitcoin or a stablecoin, starts a countdown and promises to return the account once the transfer is confirmed. Paying gives you nothing enforceable, because a cryptocurrency payment cannot be reversed, the intruder keeps the access they already have and the account becomes worth more to them, so a second demand is common. If you have already paid, the offence is aggravated because the perpetrator achieved their purpose, and the transaction leaves a trail, the transaction identifier and the destination wallet, which the police cross-check against other reports and which the court can follow to the platform where it is converted into euros.
Meanwhile, the account is used for what pays most, posting stories in which you, with your face and your brand, say you have made money with a cryptocurrency investment and encourage your followers to write to a contact. Those victims are your customers and they will come back to you. Keep every message from the extortionist with the wallet address and the username it comes from, do not block before capturing it and take all of it to the police report. The answer here is the same as with any threat, document and report without negotiating.
If your account is used to defraud your followers or a fake profile appears with your name
You are not criminally liable for what the intruder does with your account, because there is no intent or participation, but you may face claims from customers who paid believing they were buying from the business, often by instant transfer, as happens in the Bizum scams I have described. The dated police report and the public notice you sent prove when you lost control and that you acted with diligence.
If orders, addresses, phone numbers or payment details passed through the account’s messages, your business is the controller of that data and the intruder’s access is a personal data breach. The General Data Protection Regulation requires it to be notified to the Spanish Data Protection Agency within seventy-two hours when it poses a risk to those affected and the customers themselves to be informed when the risk is high, and Organic Law 3/2018 completes that regime. It is an obligation that tends to be overlooked and the first thing an injured customer’s lawyer looks at.
As for the fake profile created with your name, logo and photos, usually while the original is hijacked, article 16 of Regulation (EU) 2022/2065 on digital services requires Meta to provide a mechanism for notifying illegal content and to handle those notices diligently, and from the moment it has actual knowledge it answers for what it keeps online. That notice, with its date on record, is a piece of the later claim.
Reporting that my Instagram account was hacked, where, with what and what it achieves if you do not know who did it
You report it at any Policía Nacional station or Guardia Civil post, both of which have cybercrime units, and you can do so in A Coruña even if the intruder writes from another continent, because the offence is committed where the victim and their account are and international cooperation is driven by the investigating court. The Policía Nacional’s online reporting does not accept facts involving intimidation or a known perpetrator and requires ratification in person, so for extortion it has to be in person, or directly a formal complaint drafted by a lawyer that proposes from the outset the investigative steps that matter.
Bring your ID, Instagram’s alerts, the screenshots of the intruder’s messages with the wallet address, the posts and messages sent from your account, the notice you sent to customers, the payment receipt if you paid and proof that the account is yours, which for a business may be the email it was created with, Meta advertising invoices in the company’s name or the link to its Facebook page.
The report is useful even if you do not know who did it, which is the normal case. Articles 588 ter and following of the Spanish Criminal Procedure Act allow the investigating judge to require Meta to hand over registration data, IP addresses and the devices from which the account was accessed, and article 588 octies allows an order that those data be preserved for ninety days, extendable, while the disclosure is processed. Without a report there is no judge, and without a judge Meta hands nothing to a private individual. The police file is also what a cyber insurance policy will ask for if you have one, and what lets you explain to a defrauded customer that the account was not in your hands on those days.
The limitation period is five years under article 131 of the Criminal Code, and one year if the fraud on a follower does not exceed 400 euros, but Meta’s connection logs last far less, which is why reporting is a matter of days. When the perpetrator is not identified, the court issues a provisional stay, which does not close the case and is reopened with new information, for instance when the destination wallet appears in another investigation. After that stay, someone fairly often calls claiming to be able to recover the account or the money for an advance fee. It is the same scam under another name.
When Meta does not return the account, the complaint to the platform and the business losses
Meta’s recovery process is designed for people with a face and a phone, and a company account run by several employees, with a generic email and no photos of the owner, easily gets stuck in automated checks. When that happens there are routes that do not exclude the criminal one. Article 20 of the Digital Services Regulation requires Meta to keep, for six months, an internal complaint system, free of charge and not solely automated, against its decisions on accounts and content, and article 21 opens out-of-court settlement before certified bodies. The data on the account and on its accesses are personal data of the natural person who owns it, and data protection law offers its own routes against the platform. There is also the civil claim under the terms of use, which a consumer brings before the Spanish courts and which for a professional account takes more work.
Compensation for what was lost is directed first against the perpetrator, within the criminal proceedings themselves, as civil liability arising from the offence under articles 109 and following of the Criminal Code, and covers the paid campaigns that were lost, the orders not fulfilled, the brand contracts that fell through and the damage to reputation, provided they are proven with the account’s statistics, previous turnover and the contracts. Against Meta compensation is difficult, because the terms of use are drafted for that, although the Digital Services Regulation has opened cracks. Which route suits and how each claim is framed is the firm’s work.
Ex-partner, former employee or agency who had the password, a different case
When the person who gets in is someone who knew the password, the facts are easier to prove, because the IP and the device point to a specific person, but the legal classification is more contested. Article 197 bis requires breaching security measures, and courts do not always consider that using a password one was given amounts to breaching them, even if the authorisation ended with the relationship or the contract. That is why the moment access was revoked, the password change that was not made and the messages demanding the account back matter, and why other offences usually come alongside, discovery of secrets under article 197 if they read your messages, coercion under article 172 if they hold the account to force you into something, or blackmail if they threaten to spread what they found.
The former employee or agency that created the account with their own email and refuses to hand it over also raises a dispute over ownership, resolved with the contract, the invoices and proof that the account was opened for the business, often through civil or employment proceedings. Reporting an identified person has consequences for them and for you, and the formal complaint is prepared with more care than a report against a stranger.
With the evidence secured, the complaint and the request to Meta are drafted by the lawyer
The step to take this week is to file the police report or the formal complaint with the evidence in order and the full classification, unlawful access, extortion and damage, and to request in the same filing the preservation and disclosure of Meta’s data before the connection logs disappear. That filing is drafted by the lawyer, because the difference between a counter report and a formal complaint that proposes investigative steps lies in what the court gets to investigate. At Perseus & RC Abogados we act as prosecuting party in cybercrime cases and take on the claim for the business’s losses and the dealings with the platform. You can write to us through the contact page or call +34 677 841 007, and we reply as soon as possible.
Frequently asked questions
My Instagram account was hacked and I cannot recover it, what do I do?
Report it to the Policía Nacional or the Guardia Civil with Instagram’s emails and the screenshots, because only a court can require Meta to disclose the access data and the control of the account. The Digital Services Regulation also obliges Meta to process an internal complaint against its decision. Do not pay anyone who offers to recover it for a fee.
My Instagram account was hacked and I cannot log in, what can I do?
Look in your email for Instagram’s alert about the address change, which includes a link to revert it. If it no longer works, use the official hacked-account process from the login screen, on a device you have used before. Also change the password of your email and of Facebook, and take screenshots of everything before going on.
How do I know if my Instagram account has been hacked?
The most reliable sign is an Instagram email warning of a change of address, phone or password that you did not request. Others are being unable to log in, posts or stories that are not yours, a bio changed to cryptocurrency, messages to your followers that you did not write and a login from an unknown city in the account’s activity.
How do I report that my Instagram account has been hacked?
At any Policía Nacional station or Guardia Civil post, in person, with your ID, Instagram’s alert emails, the screenshots of the intruder’s messages and posts and proof that the account is yours. The Policía Nacional’s online reporting does not accept facts involving intimidation or a known perpetrator and requires you to ratify it in person afterwards.
My Instagram account was hacked, what can I do?
Recover it, secure the evidence, report it and claim the losses. If the account is personal, nobody is asking you for money and you recover it through Meta’s process, hiring a lawyer is not worth it. If it is a business account, a ransom is demanded, your followers are being defrauded or Meta does not respond, you do need one, because the classification in the report and what is asked of the court decide the outcome.
Is it a crime to hack my Instagram? Which article of the Criminal Code applies and what is the penalty?
Yes. Entering your account without authorisation is unlawful access to an information system under article 197 bis of the Spanish Criminal Code, with six months to two years in prison. Demanding money to give it back is extortion under article 243, with one to five years in prison, and deleting your content or disabling the account is computer damage under article 264, with six months to three years in prison.