Instagram Hacked? How to Recover It in Nepal and Report to Cyber Bureau

As of 24 October 2026 (7 Kartik 2083). Recovery steps are from Instagram’s Help Center articles and the instagram.com/hacked page, read in a browser on the check date. Reporting steps and the complaint form are from the Nepal Police Cyber Bureau website, and the legal sections from the English text of the Electronic Transactions Act, 2063 linked on that site. Police statistics are as reported by The Himalayan Times on 14 August 2026.

If your Instagram was hacked, you can usually recover it from Nepal without visiting any office: Meta’s recovery tools work the same here as anywhere. The trick is to act in the right order, use only Instagram’s official pages, and keep evidence in case you need the police.

This guide covers the recovery steps Instagram publishes, how the video selfie identity check works, the cloned-account scam that often follows a hack in Nepal, and how to file a complaint with the Cyber Bureau, with a ready-to-use complaint text.

Quick answers

How common is this in Nepal?

The Himalayan Times reported on 14 August 2026, citing the Central Police Newsroom, that Nepal Police registered 20,526 cybercrime complaints in fiscal year 2082/83. Instagram accounted for 628 of them, behind Facebook and Messenger (7,123), TikTok (6,776), WhatsApp (3,105) and Telegram (1,031). Only 161 cases were filed and 155 people arrested in the same year.

Our reading: a complaint is worth filing for the record and for serious harm, but your fastest route back into the account is Meta’s own recovery process. Do both, starting with recovery.

Instagram hacked in Nepal? The first 10 minutes before you recover it

• Do not reply to the hacker or pay anyone who offers to “unlock” the account.
• Take screenshots now: your profile as it appears, any messages the hacker sent, any email from Instagram about a change.
• Copy your profile URL (instagram.com/yourusername) and write down the date and time you lost access.
• Warn close contacts on another platform that messages from your Instagram are not from you.
• If the same password is used on email, Facebook or eSewa, change it there first, starting with your email.

Step 1: Check your email for Instagram’s security message

When the email on an Instagram account is changed, Instagram sends a message to the original address. Instagram’s Help Center says this email comes from security@mail.instagram.com and contains a link to reverse the change.

1. Search your inbox, spam and promotions folders for security@mail.instagram.com.
2. Open the message about the email change and select secure my account (or the reverse link).
3. Follow the prompts to reset your password.

If the hacker also changed the password and you cannot reverse the email change, move to Step 2. Be careful: a message from any other sender address may be phishing. Instagram’s phishing article also lists the Meta sender domains it uses, such as @facebookmail.com, @meta.com and @fb.com, and asks users to forward suspicious emails to phish@instagram.com.

Step 2: Request a login link

Instagram’s steps for a login link:

1. On the Instagram login screen, tap Forgot password?
2. Enter the username, email address or phone number linked to the account, then tap Send login link.
3. Complete the captcha yourself.
4. Open the link in your email or SMS and follow the on-screen instructions.

If the hacker replaced both your email and phone number, the link goes to them, so go to Step 3.

Step 3: Use instagram.com/hacked

Open www.instagram.com/hacked in a phone or computer browser. On 24 October 2026 the page opened with “Find your account” and asked for your username, phone number or email. Enter your old username, which hackers often keep for a while, or the email or phone you used before.

Instagram says some recovery options may not appear for every account type, and recommends trying them all. When asked for a contact address, enter a secure email that only you can access, ideally a fresh Gmail account the hacker has never seen. All further messages from Instagram go there.

Step 4: Pass the identity check (video selfie)

What Instagram asks next depends on whether the account has photos of you.

According to Instagram’s Help Center:

• The video is used to check that you are a real person and the account owner, because photos and IDs can be edited.
• You will not have access to the account while the video is under review.
• If you pass, you receive an email at your secure address with a link to reset your password.
• If you fail, you get an email and may be able to resubmit a new video in the app.
• The video is never visible on Instagram and is deleted within 30 days.

Our practical tips for the selfie

These are our own suggestions, not Meta’s instructions:

• Record in daylight or facing a bright window. Avoid backlight.
• Remove caps, masks and sunglasses. If your profile photos show you with glasses, wearing the same glasses is fine.
• Turn your head slowly and fully when the screen tells you to.
• Use a stable internet connection so the upload does not fail halfway.
• If the account belonged to a business and has no photos of a person, have the original sign-up email or phone and the device type ready.

If you can still log in

Instagram’s advice when someone has accessed the account but you still have control:

1. Change your password, or send yourself a password reset email.
2. Turn on two-factor authentication (Settings, Accounts Center, Password and security, Two-factor authentication).
3. Confirm the email and phone number in your settings are yours.
4. Check Accounts Center and remove any linked accounts you do not recognise.
5. Revoke access for third-party apps you do not trust.

For two-factor authentication, Instagram recommends an authentication app such as Google Authenticator or Duo Mobile over SMS. Save the backup codes somewhere offline.

Professional (business or creator) accounts

If a hacker keeps acting on a professional account after you regain the login, Instagram says to check Meta Business Suite (business.facebook.com), Business Settings, then People, for unknown managers. Its fix is to switch the account back to a personal account, which removes those managers, and then switch back to professional. Insights data is kept for 90 days during that switch, according to Instagram.

The cloned-account scam pattern in Nepal

A hack is often followed by, or confused with, a cloned account. Our reading of how the pattern usually runs:

1. A new account appears with your name, profile photo and a username one letter different from yours.
2. It follows your followers or sends them messages saying your old account was hacked and this is your “new ID”.
3. Within a day it asks friends for an urgent eSewa, Khalti or bank transfer, or for a code sent to their phone.

The Himalayan Times report quoted the Cyber Bureau spokesperson describing fake offers, romance scams and fake job offers spreading through Instagram, Telegram and WhatsApp, which matches this pattern.

What to do:

• Post a story or note from your real account (if you still have it) naming the fake username.
• Report it to Instagram as impersonation. Instagram says to give all requested information, including a photo of your government-issued ID, and that it only acts on reports from the person impersonated or their representative (for example, a parent).
• Ask friends to report it too, but the impersonation report must come from you.
• If anyone sent money, they should also file a financial fraud complaint and contact their wallet or bank immediately. Our online fraud recovery guide covers that side.

Instagram hacked and hard to recover? Report it to the Cyber Bureau in Nepal

File a complaint if the hacker is posting your photos or private content, asking your contacts for money, threatening you, or if Meta’s process has not worked and you need an official record. The Cyber Bureau’s website sets out the process:

1. Download the form for Fake/Hacked ID recovery or closure from cyberbureau.nepalpolice.gov.np, under “Report cyber crime”. There are separate forms for online financial fraud and for obscene photos or videos.
2. Fill it in by typing or by hand, in English, Nepali or both.
3. Attach a copy of your citizenship, National ID, passport or driving licence (birth registration for children). This is mandatory.
4. Attach the account URL and clear screenshots. These are also mandatory.
5. Submit at the nearest district police office, area or ward police office, or in person at the Cyber Bureau in Bhotahity, Kathmandu. If you cannot go in person, email the full application to cyberbureau@nepalpolice.gov.np.
6. For follow-up, call 01-5319044 and ask for extension 112 (hacked or fake IDs), or 114 if you emailed and received no registration number. Police control is 100.

The hacked/fake ID form (version dated 2083/02/04) asks for: the platform (FB/Messenger/Insta/WhatsApp or TikTok), whether the ID was hacked or faked, the URL and full profile name, the language used, the date of the hack, the phone and email on the account before the hack, the brand and model of the phone you used, the approximate creation date, the URL of any profile you now use, and an email never used on any account. For pages, it asks for the admin details. Our full Cyber Bureau complaint guide walks through each form.

Complaint text you can adapt

Use the official form, and attach a short statement like this on a separate sheet:

To the Chief, (name of) Police Office / Cyber Bureau, Bhotahity

Subject: Request to recover or close my hacked Instagram account

I, (full name), resident of (address), am the owner of the Instagram account (URL) with the name (profile name). On (date, time), I lost access after (how it happened, for example a login link message from a friend’s account). The email and phone on the account before the hack were (email) and (phone). The account is now being used to (post content / ask my contacts for money / message my followers). I have reported it to Instagram on (date). I request help to recover or close the account and to take action under the Electronic Transactions Act, 2063.

Attached: copy of my (ID type), screenshots, account URL, Instagram report confirmation.

(Signature, date, contact number)

What the law says

The Electronic Transactions Act, 2063 is the law under which cybercrime is prosecuted, as the Himalayan Times report notes. The English text linked by the Cyber Bureau includes:

Our reading of Section 74: do not wait months while trying Meta’s process. File the complaint early, even if you recover the account later.

Prevent the next hack

• Use an authentication app for two-factor authentication, not only SMS.
• Use a unique password for Instagram and a separate one for your email.
• Never type your Instagram password on a page reached from a DM link, even if it looks like a “copyright” or “verification badge” notice.
• Never share the 6-digit codes Instagram or Meta send you. Our OTP, PIN and password safety guide explains why.
• Keep the email and phone number on your account current, so recovery links reach you.

Frequently asked questions

Can I recover a hacked Instagram account if the hacker changed my email and phone?

Often, yes. Use www.instagram.com/hacked, give a new secure email, and complete the identity check. Accounts with your photos get the video selfie; others are asked for the original sign-up email or phone and device type.

How long does Instagram’s video selfie review take?

Instagram does not publish a fixed time. It says you cannot access the account during review and that you will get an email at your secure address with the result.

Will the Cyber Bureau recover my Instagram for me?

The Bureau has a dedicated form for recovering or closing hacked and fake IDs, and a follow-up extension (112). Recovery still depends on Meta, so keep using Meta’s process in parallel.

Is it safe to pay someone who says they can recover my account?

No. Instagram warns against messages demanding money. Hackers and fake “recovery agents” often target people right after a hack.

Someone made a fake Instagram account with my photos. What do I do?

Report it to Instagram as impersonation with a photo of your government ID. If it is used to ask for money or post harmful content, also file the Cyber Bureau’s Fake/Hacked ID complaint.

Do I need to go to Kathmandu to complain?

No. You can submit at any district, area or ward police office, or email the full application to cyberbureau@nepalpolice.gov.np.

Conclusion

When your Instagram is hacked, you can recover it from Nepal by following Meta’s order: the security@mail.instagram.com email first, then the login link, then www.instagram.com/hacked with a new secure email and the video selfie check. Report any cloned account as impersonation. If money, threats or private content are involved, file the Cyber Bureau’s Fake/Hacked ID form with your ID copy and screenshots within 35 days. Then switch on app-based two-factor authentication so it does not happen again. For the same problem on Facebook, see our guide to recovering a hacked Facebook account.

Sources

• Instagram Help Center, If you think your Instagram profile has been hacked (read 24 Oct 2026): https://help.instagram.com/149494825257596
• Instagram, My Instagram was Hacked (recovery page, read 24 Oct 2026): https://www.instagram.com/hacked/
• Instagram Help Center, Why you might be asked to upload a video selfie to confirm your identity: https://help.instagram.com/1053588012132894
• Instagram Help Center, Hacked Instagram Account (includes email change and phishing articles): https://help.instagram.com/368191326593075
• Instagram Help Center, Lost access to email or phone number linked to Instagram account: https://help.instagram.com/358911864194456
• Instagram Help Center, Professional account still controlled by a hacker: https://help.instagram.com/588993474002733
• Instagram Help Center, Report an account that’s impersonating you on Instagram: https://help.instagram.com/370054663112398
• Instagram Help Center, Securing your Meta Account with two-factor authentication: https://help.instagram.com/566810106808145
• The Himalayan Times, Cybercrime complaints top 20,000 in Nepal, but only 155 arrests made (14 Aug 2026): https://thehimalayantimes.com/nepal/cybercrime-complaints-top-20000-in-nepal-but-only-155-arrests-made
• Nepal Police Cyber Bureau, Report cyber crime (forms, documents, where to submit): https://cyberbureau.nepalpolice.gov.np/report-cyber-crime/
• Nepal Police Cyber Bureau, Contact and follow-up extensions: https://cyberbureau.nepalpolice.gov.np/about-us/contact-us/
• Nepal Police Cyber Bureau, Fake or hacked ID complaint form (2083/02/04): https://cyberbureau.nepalpolice.gov.np/media/filer_public/b7/f1/b7f16a77-26c9-48a5-b4ec-ab8e005fd335/fake-or-hacked-ccb_2083_02_04.pdf
• Electronic Transactions Act, 2063, English text hosted by the Cyber Bureau: https://cyberbureau.nepalpolice.gov.np/media/filer_public/d5/3b/d53b5f7f-4ff0-4171-8804-5d4fdd8fbd5f/eta-2063-en.pdf
• Nepal Law Commission, Electronic Transactions Act, 2063: https://lawcommission.gov.np/content/13397/electronic–electronic–traded-international-act–2063/

This is general guidance based on Instagram’s and the Cyber Bureau’s published pages as of 24 October 2026; it is not legal advice, and menus and procedures can change.

Written by

Rabin Paudel

Rabin Paudel is the Founder of Digital Solution, a Content Creator, and an AI Trainer. He shares practical and easy-to-understand content on Artificial Intelligence, Digital Literacy, Online Services, FinTech, and Technology. His mission is to make technology simple, accessible, and useful for everyone.

View all posts by Rabin Paudel →