You open Instagram and the login fails. Or a volunteer texts you a screenshot: your museum’s account is posting crypto giveaways, the bio has changed, and members are getting DMs asking them to “verify” a payment. Whoever is holding the phone in that moment needs to move fast. Here is the order we’d work in.
The first hour
- Check your email for a message from Instagram. When the login email on an account changes, Instagram typically sends a notice to the old address, often with a link to reverse the change. Search the inbox tied to the account (and its spam folder) before doing anything else. That link is the fastest way back in, and it can expire.
- Use Instagram’s official recovery flow. Start from the “forgot password” or “need more help” options in the app, or go to instagram.com/hacked. Depending on the account, you may be offered a login link, a security code, or identity verification such as a video selfie. Only use links that come from Instagram’s own app or site.
- Secure the email account first if you still control it. Change its password and turn on two-step verification. If the attacker got into that inbox, they can keep resetting Instagram no matter what you do.
- Check the Facebook Page and Meta Business settings. If the Instagram account is connected to a Facebook Page or a business portfolio, look for admins you don’t recognize and remove them. A connected account is sometimes a back door, and sometimes it’s your way back in.
- Write down what you see. Screenshot the changed bio, the posts, the DMs supporters forward to you, and the time you noticed. Recovery reviewers and your leadership will both ask.
If the standard recovery doesn’t work
This is where it gets slow, and it’s worth being honest about that. Meta does not offer a general phone line for account recovery. A few routes that organizations do use:
- Repeat the identity verification carefully. Use a device and network the account has logged in from before, if you can. Requests from a familiar device sometimes go further.
- Meta Verified or advertiser support. If your organization pays for Meta Verified, or runs paid ads through a business account, you may have access to support channels that free accounts don’t. Check what’s available from inside your business tools rather than trusting anyone who contacts you offering help.
- Report the account from another profile. Ask staff to report it as hacked or impersonating your organization. This doesn’t restore access, but it can get scam posts taken down.
One warning that bears repeating to everyone on staff: hacked accounts attract fake “recovery experts” in the comments and DMs. Anyone who asks for money or your login to get the account back is running a second scam. Don’t engage.
Protect your members and donors
Your followers are the real target. A compromised cultural organization account is convincing because people trust it, and the usual scams are fake ticket sales, fake membership “renewal” links, and giveaways that ask for card details.
Tell people quickly, through channels you still control:
- A short post on your other social accounts and a banner or notice on your website.
- An email to members and recent donors. Pull the list from Altru with a query on active members and recent givers (or whatever segment follows you on Instagram most), and send it through your usual email process. Keep it plain: the account was compromised, we will never ask for payment through DMs, here is where to buy tickets and renew safely.
- A note to front desk and membership staff so they can answer calls the same way.
Name the real URLs for tickets, memberships, and donations in that message. If anyone reports paying through a fake link, tell them to contact their card issuer, and log the contact on their constituent record so the next staff member who talks to them knows what happened.
Check whether anything else was exposed
The way an account gets hacked matters. If it was a reused password, ask where else that password lives. Shared social logins tend to sit in the same spreadsheet or password note as the website admin, the email platform, and sometimes Altru itself. Change anything that shared the password, and if you suspect a staff email was phished, have your IT contact review that mailbox.
For Altru specifically, review the user list for accounts that should have been deactivated (former seasonal staff, past contractors) and confirm everyone with access has their own login. If you’re unsure what Altru’s login security options are in your environment, Blackbaud support can confirm what’s turned on for your organization.
Once you’re back in
- Change the password to something unique and stored in a password manager, not a shared document.
- Turn on two-factor authentication using an authenticator app rather than text messages where possible.
- Review the account’s security settings: active login sessions, connected apps, and login email and phone. Remove anything you don’t recognize.
- Delete the scam posts and restore your bio and links.
- Post a brief all-clear so followers know the account is safe again.
Set it up so next time is easier
Most recovery headaches come from the account being tied to one person. Use an organizational email address the communications team controls, not a staff member’s personal inbox. Make sure at least two people have admin access through Meta’s business tools, so losing one login doesn’t lock you out. Keep a one-page note of which email, phone number, and Facebook Page each social account is connected to, and review it whenever someone with access leaves.
It’s also worth drafting the supporter notice now. When the next compromise happens, you’ll want to send a clear message in minutes, not write one from scratch while the scam posts are still live.
