Nobody legitimate can "hack" an Instagram account, but the owner can almost always recover it through Meta's own flow — and if it is a teenager's account you supervise, there is a supported parental route that is far better than guessing passwords.
Owner recovery, in order:
- Login help — on the login screen choose "Forgot password", then "Try another way" if the email is inaccessible. Instagram will offer SMS to the phone number on file, a trusted device prompt, or a video selfie verification.
- Hacked account flow — instagram.com/hacked walks through securing the email first, then the account. Do the email first; if the attacker controls the inbox, every other reset fails.
- Check connected sessions — Settings > Security > Login activity and Devices. Log out anything unfamiliar and change the password from a device you trust.
- Two-factor — turn on an authenticator app rather than SMS. SIM-swap attacks are the most common way teen accounts get taken.
- If the account is gone — Meta's support forms plus the original email receipt from a verification purchase are the only escalation path. Paid "recovery" services on Instagram are scams; Meta does not work with them.
For a parent: Instagram's Teen Accounts (default for under-16s) include parental supervision from the parent's own account — you approve followers, set time limits, and see who they message, without needing their password. That is the sanctioned version of what people are actually asking for in this thread.
Where a monitoring product adds value is the device layer rather than the app layer: Ultimate Phone Spy covers Android, Windows and Mac with message, call, location and app-usage visibility (sms tracker). It cannot read Instagram DMs on iPhone — Apple and Meta both close that door — and any product claiming otherwise is selling a screenshot of an old Android build.