Confirm it's you to log in: why Instagram logged you out and how to get back in

"Confirm it's you to log in" means that Instagram saw activity on your account that looked unusual. It logged the account out, and it wants proof that the account is yours before you can use it again. To get back in, do the steps on the screen before the deadline that the screen gives.

This guide gives the reasons that Instagram's help pages name, the ways back in, and what to change after you get in. Instagram has no help page for this exact screen, and it moves its menus from time to time, so your screen can look a little different.

What does "Confirm it's you to log in" mean?

People report that the screen appears when they open the app or try to log in. In a version that a user posted on Reddit, the title is "Confirm it's You to Login", and the text says:

"We noticed unusual activity from your account so we've logged you out. Follow the next steps within 1 day so we can try to get you back into your account before it's disabled."

Three parts of this text are important:

• You are logged out. You can't use the account until you finish the steps.
• There is a deadline. The posted version gives 1 day. Instagram's help pages don't describe this screen, so use the deadline on your own screen.
• The account can be disabled. This is a warning, not a decision. According to Instagram's page about disabled accounts, a disabled account shows its own message when you try to log in.

If the next steps ask for a code, that matches how Instagram says it checks who owns an account. Instagram's account security page says that when an account is hacked, Instagram confirms who owns it "by asking you to enter a code sent to your email or phone when you try to log in."

Why did Instagram log you out?

Instagram doesn't say which activity caused the screen on your account. But its help pages name the signals that make it check or restrict an account:

Signals that Instagram's help pages give as reasons for security checks and restrictions.

According to the data scraping page, the first two signals can get an account "restricted and flagged for further review". The account at risk page says that Instagram asks you to change your password when it thinks that the password is weak or exposed. It also names an account that "is synced with an unauthorized third-party app".

Other sites add causes such as a VPN, which Instagram's help pages don't confirm. If no signal in the table fits what you did, someone else may have tried to use your account.

How do you get back into your account?

Start with the steps on the screen, because the deadline applies to them. Instagram's help pages describe the checks that it uses to confirm that you are a real person and that the account is yours:

1. A captcha. Complete it. Instagram uses a captcha to confirm that you are a real person.
2. A security code. Choose your email address or your phone number, and make sure that it is yours. Then enter the code that Instagram sends.
3. A video selfie or an ID. Follow the steps on the screen. The next section explains both.

If Instagram asks for a video selfie or an ID

For a video selfie, you turn your head in different directions. According to Instagram's hacked account page, the video is never visible on Instagram, and Instagram deletes it within 30 days. Instagram's video selfie page gives the rest:

• You can't use your account while Instagram reviews the video.
• If you pass, Instagram can send a link to reset your password to your secure email address.
• If you don't pass, you can send a new video.
• If you don't confirm your identity, you may not be able to log back in.

An ID works in a similar way. According to Instagram's ID page, you usually get at least two attempts, and other users can't see your ID. You can lose access to your account during the review. In some cases, if you don't pass, Instagram may disable the account and delete its data.

If the steps don't work

If the code never comes, or the screen keeps coming back, use Instagram's recovery steps from the login screen. Instagram's hacked account page gives these steps for a login link:

1. On the login screen, tap Forgot password?.
2. Enter your username, email address or phone number, then tap Continue.
3. Complete the captcha.
4. Select your email address or phone number, then tap Continue.
5. Tap the login link in the email or text message, then follow the steps on the screen.

If the login link doesn't help, go to the login link screen and tap Can't reset your password?. Select your email address or phone number, then tap Send security code. If no code comes, tap I can't access this email or phone number and follow the steps. Give an email address that only you can access, because Instagram sends the next steps there.

What should you do once you're back in?

You still don't know why Instagram logged you out, so secure the account. These steps come from Instagram's data scraping page and its hacked account page:

1. Change your password. Use a password that you don't use on other sites, with at least six numbers, letters and special characters. Instagram says that a password change logs you out of all other devices. So a device or service that had your old password loses access.
2. Check where you're logged in. According to Instagram's login activity page, tap Menu, then Password and security, then Where you're logged in. Log out of the devices that you don't know.
3. Remove apps that you don't trust. According to Instagram's page on apps and websites, tap Menu, then Website permissions, then Apps and websites. Tap Remove next to an app. This list shows apps that you connected to Instagram. A service that logged in with your password can show as a login in step 2 instead.
4. Turn on two-factor authentication. In Accounts Center, tap Password and security, then Two-factor authentication. Instagram recommends an authentication app.
5. Check your account details. Make sure that the email address and phone number are correct. In Accounts Center, remove linked accounts that you don't recognize.

Some settings can be unavailable for a few days. According to Instagram's page on limited settings, after a login from a device or browser that Instagram doesn't recognize, Instagram limits some security and account settings on that device. To change them sooner, use a phone or computer that you usually use for Instagram.

Is the screen real, or a phishing message?

The real screen appears in the Instagram app or on instagram.com when you open it or log in. Phishing messages copy this kind of warning to get your login details.

Instagram's phishing page says that phishing messages "may also claim that your account will be banned or deleted" if you don't follow their directions. That is close to the words on the real screen, so check before you act:

• Don't use links in the message. Open the Instagram app yourself instead.
• Check the email in the app. According to Instagram's account security page, emails that Instagram sends about your account also appear in the app under Emails from Instagram. Instagram says that you can use this list to check if an email is real.
• Don't send your password to anyone. Instagram's phishing page says not to answer messages that ask for it. Report strange emails to phish@instagram.com.

Can a last seen app like iLS cause it?

It can be one of the causes, but no one can tell you for certain. Instagram's data scraping page names two signals: automated access to your account, and your username and password in a third-party app. A last seen app works in both of these ways. Instagram's Terms of Use don't allow access "in an automated way without our express permission".

iLS (instagram Last Seen) is an independent service that shows when one person you already message on Instagram comes online. You connect your Instagram account once. Then iLS signs in with an automated browser and keeps the logged-in session, encrypted. It never stores your password. To Instagram, this is a new device. If Instagram sends a code when you connect, iLS shows a box for it. If Instagram shows another step, the connect page says: "We couldn't confirm the login — Instagram may have shown an extra step (an authenticator app or a security check). Try again." How connecting your Instagram account works explains each step.

If you change your password to get back in, the session that iLS saved stops too, because the change logs out all other devices. The Tracker then shows Tracking paused. Press Reconnect account if you want the checks to start again. Fixing common iLS problems gives the steps.

Know the limits before you connect again. iLS works only with a person you already have a DM conversation with, and only when you both have activity status on. To read the status, it opens the conversation, which can mark their messages to you as read. Using iLS breaks Instagram's Terms of Use, and Instagram can restrict your account. What that risk is and how to lower it explains the details.

What can't the screen tell you?

• What caused it. Instagram's help pages name possible signals, not the signal for your account.
• Whether someone else tried to get in. Check where you're logged in after you get back in.
• What happens after the deadline. The screen warns that the account can be disabled. Instagram's help pages don't say when or if that happens.
• Whether the steps will work. Instagram's pages promise no result. For example, the video selfie page says that after a passed review, you "may receive" an email with a link to reset your password.