A reset message you never asked for isn't always a hack, but it can be phishing. Here's how to tell the difference.
You get a password reset email or text you never asked for, or a message saying your Instagram account has a problem, will be banned or will be deleted unless you act. It has a link, and the link goes to a page asking for your username and password. Two different things can look alike here, so it helps to separate them: a real reset you didn't request, and a fake message built to steal your login.
Got a message like this? Check it in seconds.
Check it with ShieldrInstagram says that receiving a password reset email doesn't necessarily mean your account has been hacked. For example, someone logging in or resetting their own password may mistype their email address or username and enter yours by mistake. It says only people who know your password, or who click the login link in that email, can log in to your account. (Instagram)
So the useful question isn't "did Instagram send this" but "did this really come from Instagram". If it did, you can ignore it or take extra steps to secure your account. If it didn't, it's phishing.
One caution: Instagram's phishing page also lists several other legitimate Meta sender addresses, such as ones ending in @fb.com or @meta.com, so a sender check alone isn't a full answer. (Instagram) When in doubt, don't use the link at all.
Instagram says that if you entered your username or password into a strange link, someone else might be able to log in. If you can still log in, reset your password and log out of any devices you don't own. If your username or password no longer works, use Instagram's account recovery. (Instagram) Turn on two-factor authentication, and if you reuse that password anywhere else, change it there too.
Share the text, email or voicemail to Shieldr and get a plain-English verdict — safe, suspicious or scam — with the reasons it spotted. It's one more check before you tap anything, not a guarantee.
Get Shieldr on the App StoreNot necessarily. Instagram says someone may have entered your email or username by mistake, and that only people who know your password or click the login link in the email can log in to your account.
Instagram says its emails only come from @mail.instagram.com. If the email came from somewhere else, it may be phishing, so don't click any links or attachments.
Instagram says you can report strange emails to phish@instagram.com. You can also forward a scam text to 7726.
Related: the "Hi Mom" new number scam, the job offer text scam, how to check if a link is safe and how to report a scam text.
Shieldr isn't affiliated with Instagram or Meta. Instagram is a trademark of Meta. Details are taken from Instagram's own pages as of October 22, 2026 and may change.