For about a week, I've received five email notifications saying someone tried to reset the password for my Instagram account. I barely use the account and can't think of anyone who would specifically target me. The messages arrive at unusual hours, such as 2 a.m. or 5 a.m. local time. My username is short and uncommon, so I'm wondering whether that makes the account more noticeable. Is this likely to be automated activity, and should I change my email address or take other steps to stop it?
2 Answers
This is probably automated activity using an old leaked email-and-password list, not someone personally targeting you. Don’t reuse passwords, and change the Instagram password to a long, unique one. Turn on two-factor authentication with an authenticator app rather than relying only on text messages. Also secure the email account connected to Instagram with its own unique password and 2FA.
Be careful with the notifications themselves. Check the sender and open Instagram directly through the official app or website instead of clicking links in the emails. Some messages can be phishing attempts designed to make you enter your password. If the alerts are genuine, changing the account email may reduce future attempts, but it won’t fix a compromised email account or a reused password.
If my email appeared in a leak, would changing the email connected to Instagram actually help, or is securing the existing email enough?