Is this Instagram password reset email real?

How to spot the Instagram scam

• The sender is not a Meta domain. Meta publishes the addresses its mail comes from: notification@facebookmail.com, noreply@facebookmail.com, and addresses at business.fb.com, support.facebook.com, fb.com, meta.com, account.meta.com and internal.metamail.com. Check the text after the @, not the display name.
• The link is a lookalike. lnstagram.com uses a lowercase L in place of the I, and instagram-login-verify.com or ig-accounthelp.net simply bolt a familiar word onto a domain nobody owns but the attacker. On a phone, long-press to preview the destination before tapping.
• It threatens to ban, delete or restrict your account unless you act. Instagram names this as a phishing hallmark, alongside messages demanding money or offering gifts.
• It is a DM from an account that looks like support. Instagram support does not DM you. Watch the username for a swapped character or an added underscore, and note the timing: these often arrive minutes after you complain publicly, because your complaint is how you were found.
• It is a DM from a friend, asking you to vote for them or check whether a photo is you. Their account was taken this way, and yours is next in the chain. The wording is canned and sounds nothing like them.
• The login page sits on free hosting, an onrender.com or netlify.app subdomain, or anything that is not instagram.com. The page can be a perfect copy; the address bar cannot.
• There is a deadline, usually a few hours. Voting closes tonight, the account is restricted by morning. Urgency is there to stop you checking.
• You are asked to forward a six-digit code you did not request. That code is the login. Passing it on completes the takeover rather than preventing it.

What to do now

1. Ignore the message and open the app yourself. Check Settings for login activity and end any session you do not recognise.
2. If you entered your password anywhere, reset it from the app or from instagram.com reached by your own bookmark, and log out of every device you do not own. That pair is Instagram's own instruction for a phished account.
3. If you can no longer get in, go to instagram.com/hacked, which is Instagram's account-recovery route.
4. Move two-factor authentication to an authenticator app. A phishing page can relay an SMS code within its lifetime; it cannot replay a code generated on your device.
5. Report it. Instagram asks for suspicious emails at phish@instagram.com, and a fake support account or DM can be reported from the profile itself.
6. Warn the friend whose account sent it, on any channel except Instagram. Their account is doing this to their whole contact list while they still think it is fine.