Why Instagram just sent you a login code

An Instagram login code you didn't request means someone entered a working password on your account and got stopped at the second step.

Instagram accounts aren't taken for the photos. They're taken because a real account with real followers is worth money: it gets resold, used to run scams on people who trust you, or held for ransom. That changes what you're protecting against.

What to do

1. Change your password from inside the app

Open Instagram directly rather than following a link. Go to Settings, then Accounts Center, then Password and security. Use a password you don't use anywhere else.

2. Check Accounts Center for linked profiles

Instagram, Facebook, and Threads accounts are often linked through Meta's Accounts Center, which means a compromise on one can reach the others. Open Accounts Center and confirm the linked accounts are all yours. Remove anything you don't recognize.

3. Review login activity and end unfamiliar sessions

Under Password and security, look at "Where you're logged in." Log out of anything you don't recognize, particularly sessions in unfamiliar locations.

4. Check the email address and phone number on file

An attacker who gets in changes these first, because whoever controls the recovery address controls the account. Under Personal details, confirm both are still yours. Instagram also keeps a record of recent changes to contact details, which is worth reading.

5. Revoke connected apps and remove unfamiliar business tools

Third-party apps with account access keep working after a password change. Remove anything you don't actively use. If your account is linked to a business or creator toolset, check for people or partners added to it.

6. Move off SMS codes

Switch two-factor authentication from text messages to an authenticator app in the same settings area. Save your backup codes somewhere that isn't your phone.

The scam that follows

Expect a message. Once the code fails, the common next step is a direct message or email that looks like it's from Instagram support, saying your account has been flagged for a copyright violation or is scheduled for deletion, with a link to "verify" or appeal.

The link leads to a fake login page built to capture the password you're about to change and the code you're about to receive. Instagram doesn't handle account issues through direct messages, and there's no urgent verification link. Check your account status in the app instead.

A second variant comes from an account you know: a friend asking you to "vote for them in a contest" or help recover their account by forwarding a code. That friend has already been compromised, and the code being requested is yours.

Why you were picked

The password came from a breach somewhere else, replayed in bulk. What makes the follow-up convincing is knowing who you are off Instagram.

Data brokers and people-search sites publish current phone numbers, email addresses, and home addresses next to full names, compiled from public records and commercial sources. Combined with what you post publicly, that gives someone enough to write a message that sounds informed, or to answer a recovery question about you.

Delist finds those listings, files the removals, and re-checks them, because brokers commonly repost profiles after they come down. Run a free scan to see what's published about you.

The broader pattern is covered in why you're suddenly getting 2FA codes you didn't request. If someone is running a fake profile in your name, see someone is impersonating you online.

Frequently asked questions

Does a login code mean someone has my Instagram password?

Yes, most likely. Instagram sends the code after the password is accepted. Change it here and anywhere you reused it.

Someone messaged me saying they're Instagram support. Is that real?

No. Instagram doesn't contact people about account problems through direct messages, and there is no verification link you need to click. Check your account status in the app's settings instead.

A friend asked me to send them a code to recover their account. Should I?

No. Their account is already compromised and the message isn't from them. The code is for your account, and sending it hands yours over too. Contact them another way to let them know.

Why would anyone want my account? I'm not an influencer.

Established accounts with real history are valuable regardless of follower count. They get resold, used to run scams on your contacts, or used to advertise. A small account with genuine activity is more useful for fraud than a new empty one.

I lost access already. What now?

Use Instagram's account recovery flow from the login screen, and check your email for a "your email was changed" notice, which usually contains a link to revert the change. Recovery works better the sooner you start.