An unknown Instagram login appears: contain the session and recovery routes

An unfamiliar session in Instagram can be a forgotten tablet, a traveler network or an account compromise. Location estimates are not precise enough on their own to identify a person. A real intruder, however, may read private messages, change recovery details and impersonate you before you notice a public post. Work from a device you trust, preserve the evidence you need and remove the routes that would let the intruder return.

Before you start​

Open Instagram directly, not through a warning link. Ensure you can receive mail at the recovery address and that the address itself is secure. If you are managing a professional account connected to a Facebook Page or other Meta account, make a note of those connections so you can review them too.

Do it step by step​

1. In the app's settings, open Accounts Center, Password and security, then Where you're logged in or the equivalent login-activity view. Select the Instagram account if Accounts Center lists several. Record the suspicious device, approximate time and location before changing anything.
2. Compare the event with your own devices and travel. A VPN or mobile network can shift the apparent city. If the device or time cannot be explained, use the session's Log out control. Review the full list, not only the newest entry.
3. Change the password to a new, unique value from the trusted device. If the old password was reused, change it on other affected services too, starting with the mailbox that receives password resets. Do not share a login or recovery code with someone claiming to investigate the event.
4. Check the email and phone number in Accounts Center. Restore details you did not set and confirm your own details still work. Turn on two-factor authentication with an authenticator app where practical, then save backup codes offline or in a secure password manager.
5. Inspect account links and connected experiences in Accounts Center. A second Meta account with shared login or a third-party app may offer a return path. Remove only connections you recognize as unnecessary; record what you changed so legitimate workflows can be restored.
6. Examine outgoing DMs, stories, posts and account settings for changes. Report a compromised account through Instagram's official recovery help if the attacker still has access, and warn affected contacts outside Instagram if messages were sent from your profile.

Check the result​

The session list contains only devices you can account for; recovery details, password and second factor are under your control. A follow-up login alert you did not initiate is treated as a new incident, not dismissed because you changed the password once.

If something goes wrong​

If the password no longer works, use the official hacked-account flow. If only the location is strange, compare device and time before forcing every family member out. If your mailbox is compromised, secure it first; otherwise reset links can keep returning to the attacker.

Know the limit​

Logging out a device is access containment, not proof that no data was viewed or copied. A linked business account or an authorized app can have separate access. Meta's menu labels and available recovery checks can vary by account, device and region. Meta account-security tools Instagram Security Checkup Instagram recovery-contact guidance