Instagram password reset email you didn't request: why it happens and what to do

An Instagram password reset email that you didn't ask for usually means that someone entered your details on the Forgot password? screen. They typed your username, email address or phone number, maybe by mistake. The email alone doesn't mean that someone got into your account. According to Instagram, only people who know your password or tap the login link in that email can log in.

A login code that you didn't ask for is different, and it needs more care. This guide shows how to tell the two apart and how to check that a message came from Instagram. It also gives the steps to take. Instagram changes its menus from time to time, so the names in your app can be a little different.

Why does Instagram send password reset emails you didn't request?

Instagram's Help Center gives one example. A person tries to log in to their own account, or to reset their own password. They type or remember their email address or username wrong, and they enter yours by mistake. The reset email then goes to you, because those details belong to your account.

The message can also come as a text message. Instagram's page about hacked accounts shows how Forgot password? works. A person enters a username, email address or phone number. Instagram then sends a login link by email or by text message (SMS). So anyone who knows your username can make Instagram send you a reset message.

Some people get these messages again and again. In a Reddit thread from January 2026, one person got reset emails for a week. Replies from February 2026 said that it still happened. Instagram's pages about reset emails describe no setting that stops other people from asking for a reset for your account (checked in October 2026). However many messages arrive, a person still needs your password or the link in the email to get in.

In January 2026, many people got these emails in the same few days. At the same time, a seller offered data that it said covered about 17 million Instagram users, as Malwarebytes reported on January 12, 2026. The data listed no passwords, and Instagram said that the two events weren't related. Instagram said on X that it "fixed an issue that let an external party request password reset emails for some people", as Security Affairs reported. Instagram also said that there was no breach of its systems, and that people could ignore those emails.

Is a password reset email the same as a login code?

No. The two messages come for different reasons. A reset email comes when someone uses the Forgot password? screen. A login code comes when someone tries to log in.

Some people use text messages for two-factor authentication. For them, Instagram sends a 6-digit security code each time someone tries to log in from a device that it doesn't recognize. Instagram's two-factor authentication page also lists WhatsApp as a way to get these codes. If a code arrives while you aren't logging in, someone may know your password. The code is the step that they still need, so never share it.

Instagram messages that can arrive when you didn't ask for them, and what to do about each one.

Login requests appear when two-factor authentication is on, and they show the device and its location. Instagram's page about hacked accounts says that the "email changed" message comes from security@mail.instagram.com. You may be able to undo the change from that email.

How can you tell if the email is really from Instagram?

Use the Instagram app, not the link in the message. Instagram's page about recent emails says that you can see the official emails that it sent in the last 14 days:

1. Tap your profile picture in the bottom right.
2. Tap the menu in the top right.
3. Tap Meta Account, then tap Login and security.
4. Tap Recent emails, then tap your profile.

Instagram is moving accounts from Accounts Center to Meta Account settings, so you may see Accounts Center in step 3. If you do, open it and look for Recent emails there. Emails about security and login are under Security, and all other emails are under Other. If an email isn't in the list, it may not be from Instagram.

Check the sender address too, but don't trust it alone. Instagram's page about unrequested reset emails says that its emails come only from @mail.instagram.com. Its page about recent emails lists five addresses for security messages: @support.facebook.com, @support.instagram.com, @facebookmail.com, @mail.instagram.com and @global.metamail.com. The two pages don't agree, so the Recent emails list is the better check.

Two more facts help you find fake messages. Instagram never contacts you about the security of your profile through Direct Messages. Phishing messages often ask for personal details, or say that your account will be banned or deleted. Don't tap the links or attachments in them, and report fake emails to phish@instagram.com.

Instagram's pages about reset emails and phishing don't list the phone numbers that send its text messages. If a reset link comes by text message, open the app yourself and don't tap the link.

What should you do after an unrequested email or code?

1. Don't tap the link in the message. Don't forward the message, and don't share a code from it.
2. Open the Instagram app yourself. If you're still logged in, do the next checks there.
3. Look for the message in Recent emails.
4. Go back to your profile and tap the menu. Tap Password and security, then tap Where you're logged in. Instagram's login activity page shows these steps.
5. If you see a login that you don't recognize, tap your account, then tap Select devices to log out. Select that device and tap Log out.
6. Change your password if a login code came while you weren't logging in. Also change it if you typed your password on a page from a link. Do the same if you found a login that you don't recognize. A password change logs you out of all other devices, so other people who are logged in lose access.
7. If two-factor authentication is off, turn it on in Password and security > Two-factor authentication. Instagram recommends an authentication app, and text messages and WhatsApp are also options.
8. If you can't log in, go to instagram.com/hacked in a browser on your computer or phone.

If these checks show no problem, you can ignore the message. Instagram said the same thing about the emails in January 2026.

If you asked for the reset yourself and the link doesn't work, ask for a new email. According to Instagram, the old email may have expired. In the email, choose to reset your password, not to log in.

Can a last seen app like iLS cause these emails?

If you gave your Instagram password to an app, you may think that the app caused the message. This is how iLS works:

• iLS logs in to Instagram only when you connect on the IG Account page. You get there with Connect account, or with Reconnect account on the Tracker. Instagram can send a verification code to your email or phone at that time, and iLS then shows Enter your verification code. A code that arrives right after you connect is for your own login.
• iLS never stores your Instagram password. It keeps only the logged-in session, encrypted. So iLS can't log in again by itself, and it never asks Instagram to reset your password. A reset message that arrives when you didn't connect doesn't come from iLS.
• When you change your Instagram password, Instagram logs out every other session, and the iLS session is one of them. The Tracker then shows Tracking paused, and checks stop until you press Reconnect account and use your new password. Read what Tracking paused means and how to reconnect.

The same question applies to every app that asks for your password. Instagram says that an app with your username and password can get complete access to your account. If you don't trust an app that has your password, change your password.

iLS has other limits too. Using iLS breaks Instagram's Terms of Use, which don't allow automated access without Instagram's permission, and Instagram can restrict an account that uses it. Read how iLS can affect your Instagram account before you connect. iLS works only with a person who already has a DM thread with you. Both of you must also have activity status on. To read the status, iLS opens the thread, and this marks their messages to you as read.

What can't the email tell you?

• Who asked for the reset. The Instagram pages in this guide don't show a way to see who made the request. Recent emails lists only the emails that Instagram sent to you.
• Whether someone got into your account. The email alone doesn't show it. Check Where you're logged in.
• Whether your password leaked. When Instagram notices that your password may be exposed, it asks you to change it. An unrequested reset email isn't that warning.
• How to stop new requests. Instagram's pages about reset emails describe no setting for it.