// Guides

Recovering a WhatsApp or Instagram account

In an account takeover the attacker usually locks you out and posts in your name. What matters is fast reset via the official recovery routes — and securing the account afterwards.

Updated: 2026-06-19

Immediate steps

1. 1WhatsApp: reopen the app and re-verify your number via SMS code — this automatically signs the attacker out.
2. 2WhatsApp: then enable two-step verification with your own PIN.
3. 3Instagram: reset via “forgot password”; if e-mail/number was changed, use Instagram account recovery and confirm your identity.
4. 4Check the linked e-mail address and phone number and reset them to your own.
5. 5Enable two-factor authentication — preferably via an authenticator app.
6. 6Warn your contacts and save suspicious activity (messages, logins) as screenshots.

What not to do

• Never share verification codes — not even with supposed “friends” who ask for them.
• Do not engage with extortion or demands from the attacker.
• Do not give up your phone number prematurely — it is needed for recovery.

Common questions

The attacker set the two-step PIN — what now?

After re-verifying by SMS, WhatsApp imposes a waiting period, after which the PIN can be reset without the old one. Stick to the official route.

My Instagram was taken over with a changed e-mail.

Use Instagram account recovery; you can confirm your identity via a selfie video or the original sign-up info.

Should I file a report?

For fraud in your name or extortion, yes — save screenshots as evidence first.

Sources

• Verbraucherzentrale — First aid for hacked online accounts
• BSI — Protecting against hacked accounts