Last reviewed: 13 August 2026.
Quick answer: If Instagram says your account is disabled, sign in through the Instagram app and use the on-screen Request a review route. If the account was taken over, start at instagram.com/hacked. Secure the connected email account first, save every reference number and screenshot, and do not pay anyone who promises reinstatement. Meta publishes no guaranteed recovery time and no third party can lawfully bypass its review.
A disabled account, a hacked account and an ordinary login failure need different routes.
| What you see | Use this route |
|---|---|
| A message saying the account was disabled | Log in in the Instagram app, read the reason and follow the on-screen review steps. |
| Email address or password changed without permission | Secure the email inbox, then use Instagram's hacked-account flow. |
| No disabled message; password or code does not work | Use the password and login-recovery tools in the Help Centre. |
| You can log in but content or a feature is restricted | Open Settings > Account Status and review the affected content or feature. |
Meta's disabled-account help page says a review may be available when a person believes the decision was a mistake. It also warns that an account deleted by the account holder or by someone with the password cannot be restored. That distinction matters before you spend time on an appeal.
Do not make Instagram the only copy of customer records or creative work. Tell customers through your website, verified email list or another established channel that the account is temporarily unavailable. Avoid creating lookalike profiles that may confuse customers; if you must use another profile, clearly identify it from your owned website.
Preserve invoices and campaign records separately. A creator can ask advertisers to pause a campaign or change the approved destination in writing. Never ask a customer to send passwords, OTPs or identity documents by direct message.
If the incident involved unauthorised payments or an online financial fraud in India, contact the bank immediately and use the official National Cyber Crime Reporting Portal. For urgent financial cyber fraud, the Government advises calling 1930. See our cybercrime evidence and complaint guide.
RTI applies to public authorities, not to Instagram merely because it operates in India. A cybercrime complaint is appropriate for hacking, impersonation or fraud; it is not a shortcut for a routine content-policy appeal.
Keep one dated folder containing screenshots, emails with full sender details, the profile URL, device and login history, ad-account invoices and a short chronology. Redact passwords, OTPs, recovery codes and government-ID numbers before sharing the file with an adviser. This file helps distinguish takeover, payment fraud and content enforcement without exaggerating what happened.
No. Only Meta controls the account review. A promise of guaranteed or instant reinstatement is a warning sign.
No. Use identity checks only inside Meta's official recovery interface. Never send an OTP, recovery code or unredacted identity document to an intermediary.
The official disabled-account page tells users to follow the in-app review but does not publish a universal response deadline. Follow the date and instructions shown in your own account notice.