Why does Instagram login activity show the wrong location?

A wrong city in your Instagram login activity doesn't always mean that someone else got into your account. According to Meta, a login from a phone often goes through an IP address that doesn't show your actual location. Meta can also sometimes give only an approximate location. So check the device first. If the device is yours, the city alone is not a reason to worry. If the device isn't yours, log it out and change your password.

This guide shows where to find the list, the reasons that Meta gives for a wrong location, and what to do about a login that you don't recognize. It also explains why a login from iLS can show a city that you have never been to. Instagram moves its menus from time to time, so the names on your screen can be a little different.

Where do you find your Instagram login activity?

Instagram calls the list Where you're logged in. According to Instagram's login activity page, it shows the devices that logged in to your account recently. In the app:

1. Tap your profile picture at the bottom right.
2. Tap Menu at the top right.
3. Tap Password and security. If you don't see it, tap Accounts Center first.
4. Tap Where you're logged in.

The list shows the logins of every account in the same Accounts Center. If you have more than one account there, check which account each login belongs to.

Instagram says that not everyone has this menu yet. If you can't find it, tap Menu, then Security, then Login Activity. On a computer, click More at the bottom left, then click Settings. You find the same two menus there.

One reason to open the list is that Instagram shows you as active when you don't use it. Why Instagram can show you as active when you're not explains that case.

Why does the location look wrong?

Instagram's login activity page doesn't explain how Instagram finds a location. Meta explains it for the Facebook list with the same name, on its Facebook Help Center page about unfamiliar locations. Instagram's list is in the same Accounts Center.

Meta's first advice is to check whether the login came from a mobile device. When you log in on a phone, your connection often goes through an IP address that doesn't show your actual location. An IP address is the address that your device uses on the internet. So your own phone can show a city where you weren't.

For a login that didn't come from a phone, Meta gives three possible reasons. The table puts all four cases together:

Possible reasons for an unfamiliar location in Where you're logged in, from Meta's help page.

So decide by the device, not by the city. A wrong city on a device that you know has an ordinary explanation. A device that you don't know is the sign to act on. If you aren't sure that a device is yours, treat it as unknown and log it out.

What should you do about a login you don't recognize?

Do these steps in this order:

1. Log out of that device. In Where you're logged in, tap your account, then scroll down and tap Select devices to log out. Select the device, then tap Log out. In the older Login Activity menu, tap Options next to the login, then tap Log out.
2. If the older menu shows This Wasn't Me, tap it and follow the steps to reset your password. Instagram can hide this option when no login came from a device or browser that it doesn't recognize. If you don't see it, change your password yourself.

Then check the rest of your account. According to Instagram's page for hacked accounts, do these things if you can still log in:

• Change your password, or send yourself a password reset email.
• Turn on two-factor authentication.
• Make sure that the phone number and email address in your account settings are correct.
• In Accounts Center, remove the linked accounts that you don't recognize.
• Remove access for third-party apps that look suspicious.

Did you get an email from security@mail.instagram.com that says your email address changed? Then you may be able to undo the change with secure my account in that email. If you can't log in at all, go to instagram.com/hacked in a browser on your phone or computer.

To get a warning next time, turn on login requests. According to Instagram's login requests page, they work when two-factor authentication is on. When someone tries to log in from a device or browser that Instagram doesn't recognize, you get an alert. The alert shows the device and its location, and you can approve or deny it. If you deny it, Instagram asks you to reset your password. Go to Menu, Security, Two-factor authentication, then Additional methods, and turn on Login requests.

To get the login codes for two-factor authentication, Instagram's two-factor authentication page recommends an authentication app. Text message and WhatsApp are the other methods.

Why can an iLS login show a city you've never been to?

If you connected your Instagram account to iLS, one of the logins in the list can be from iLS. iLS signs in to Instagram with an automated browser, the same way that you sign in on a computer. Then it keeps that session. It signs in through a connection in the country that you chose under Where you usually use Instagram, and every later check uses that country too. So the location shown for this login comes from that connection, not from where you are. It can be a city that you have never been to. How to connect your Instagram account explains the country choice.

If you log out of this login or change your Instagram password, the session that iLS saved can stop. The Tracker then shows Tracking paused. To start the checks again, press Reconnect account and sign in again. Fixing common iLS problems gives the steps. If you want to stop using iLS, press Disconnect on the IG Account page. This deletes the session that iLS stored. If the login is still in the list after that, you can log it out there too.

iLS never posts, sends messages, follows anyone or changes your settings. It opens your DM conversation with a contact and reads the activity status line. For this, you need an existing DM conversation with the person, and activity status on for both of you. Opening the conversation can mark their messages to you as read. Using iLS also breaks Instagram's Terms of Use, and Instagram can restrict your account. What that risk is and how to lower it explains the details.

What can't login activity tell you?

• The exact place. Meta says that the location is sometimes approximate, and a phone login often shows a different place.
• Who used the device. The list shows a device, not the person who held it.
• What happened during the login. Instagram's help page describes the device and the location, and nothing about what the session did.
• Another person's logins. The list shows only the accounts in your own Accounts Center.
• Why Instagram chose that city. Instagram doesn't publish how it finds a location.