// Guides
Recovering a WhatsApp or Instagram account
In an account takeover the attacker usually locks you out and posts in your name. What matters is fast reset via the official recovery routes — and securing the account afterwards.
Updated: 2026-06-19
Immediate steps
- 1WhatsApp: reopen the app and re-verify your number via SMS code — this automatically signs the attacker out.
- 2WhatsApp: then enable two-step verification with your own PIN.
- 3Instagram: reset via “forgot password”; if e-mail/number was changed, use Instagram account recovery and confirm your identity.
- 4Check the linked e-mail address and phone number and reset them to your own.
- 5Enable two-factor authentication — preferably via an authenticator app.
- 6Warn your contacts and save suspicious activity (messages, logins) as screenshots.
What not to do
- Never share verification codes — not even with supposed “friends” who ask for them.
- Do not engage with extortion or demands from the attacker.
- Do not give up your phone number prematurely — it is needed for recovery.
// CYBERSECURITY FOR SMES · GERMANY & EU-WIDE
Eliminate Vulnerabilities Before Adversaries Exploit Them
Benefit from discreet, high-caliber security expertise: Rigorous penetration tests, standard-compliant IT security audits (up to 50% subsidized in NRW via M.I.D.), and incident triage.
Direct security hotline:+49 176 503 459 60
Common questions
- The attacker set the two-step PIN — what now?
- After re-verifying by SMS, WhatsApp imposes a waiting period, after which the PIN can be reset without the old one. Stick to the official route.
- My Instagram was taken over with a changed e-mail.
- Use Instagram account recovery; you can confirm your identity via a selfie video or the original sign-up info.
- Should I file a report?
- For fraud in your name or extortion, yes — save screenshots as evidence first.