A "someone has been in my account" report is usually a mix of real artefacts and anxiety. The useful work is separating them: what the account actually records, what it doesn't, and what a forensic examiner can still recover.
This is the checklist we run before anyone spends money on recovery — written for account owners, not for intruders.
1. Start with the record the platform keeps for you
Instagram and Facebook both keep a login history. In the app: Settings → Accounts Centre → Password and security → Where you're logged in. On the web: Settings → Login activity.
You are looking for a device, city or time you don't recognise. Two warnings:
- VPN users get false positives. If you or your household use a VPN, a foreign city is expected.
- The list is pruned. Logins fall off after a while, so absence of a strange entry proves nothing.
Screenshot it with a timestamp before you change anything. If the case later goes to a lawyer or the police, that screenshot is evidence and the account state is not.
2. Pull the data export, not just the activity page
Accounts Centre → Your information and permissions → Download your information. Choose JSON, and ask for the full date range.
The export includes things the UI hides: IP addresses attached to sessions, message metadata, and the security emails the platform says it sent you. Those emails are the useful part — if the platform claims it sent a "new login" alert and you never received it, that tells you something about the intruder's access to your mailbox.
The export takes hours to days. Request it first, then keep working.
3. Read your own mailbox for the handover trail
An account takeover almost always leaves mail:
- password reset requests you didn't make (the "we sent you a code" mails),
- a "your email was changed" notice,
- security alerts marked read that you never opened.
Check the read/unread state. An attacker with mailbox access marks their own alerts as read so the phone never buzzes. Unread alerts you don't remember seeing are normal; read alerts from a night you were asleep are not.
Also check for filters and forwarding rules — a rule that silently forwards password resets to another address is the single most-missed artefact in these cases.
4. Check the devices that are still attached
- Two-factor method. If it changed from SMS to an authenticator you didn't set up, that's a strong indicator. So is a new backup code set.
- Linked apps. Settings → Website permissions / Apps and websites. Anything you don't recognise had an access token; revoking it is reversible, deleting the account is not.
- Trusted devices. On Android, check for device admin apps you didn't install.
5. Separate "accessed" from "still has access"
These need different responses.
Accessed means: logins from new places, changed recovery details, messages read. Still has access means: an active session, a linked app token, a forwarding rule, or a cloned session cookie on a device you no longer control.
Removing the intruder is the easy half. The half people skip is checking every route they left open — which is why "I changed my password and it happened again" is such a common story.
6. When it is worth paying an examiner
DIY is enough if you only need your account back. It is not enough if you need to know who, or need evidence that survives scrutiny:
- harassment, stalking, or a partner or ex with physical access to your devices;
- a business account where messages were used to defraud clients;
- a dispute where "I was hacked" is your defence;
- a device you suspect was compromised at the operating-system level, not just the app.
An examiner works from the device image and the platform records, not from screenshots, and produces something a court can be shown.
What we do, and what we won't
We take Instagram and WhatsApp account-compromise cases only with the account owner's written authorization, proof you control the account, and a lawful purpose. We don't break into other people's accounts, and we turn down requests to read a partner's, employee's or ex's messages — that's not a grey area, it's a crime in most jurisdictions.
If your case fits, the intake is at cyberlords.io/hire-a-hacker/instagram, and messaging-app cases are handled at cyberlords.io/hire-a-hacker/whatsapp. You'll be asked for authorization before anything is touched.
If it doesn't fit, the six steps above are most of what we'd do in the first hour anyway. Do them, and screenshot everything as you go.
Top comments (0)