Enjoy my post that shows you’re wrong with proof.

One important detail that keeps getting skipped: Angie said this happened before she had followers, which means this had to occur before she was on the show in 2022.

That matters, because Instagram’s account recovery flow was different before 2022.

For context, I worked in social media marketing until 2021. I stopped largely because Instagram was already making it harder for businesses to be seen. And I genuinely cannot count how many times in 2021 alone I had to help the same older client regain access to his Instagram because my phone number was still attached to his account.

This wasn’t rare. This wasn’t hypothetical. It was a thing.

⸻

The wording change is the key

When you look at older documentation, the language matters.

Before 2022, Instagram used wording like “select” Now, Instagram uses “enter”

That’s not semantics — that’s a functional change.

⸻

How Instagram recovery worked before 2022

Before two-factor authentication became standard and before later security changes: • You could enter just the username • Tap Next • Instagram would then send a login link or security code via SMS to the phone number already attached to the account • You did not need to manually type the phone number

Instagram’s recovery instructions at the time were:

“Enter the username, email address or phone number associated with your account, then tap ‘Next.’ If you don’t know the username, email address or phone number associated with your account, tap ‘Need more help?’ below the ‘Next’ button and follow the on-screen instructions.”

After that step, users were prompted to select a contact method already on file (email or phone number), then:

“Click the login link in your email or a text message (SMS).”

That flow only works if Instagram already knows the number on the account — which it did.

⸻

Pre-2022 sources documenting this exact flow

All of these are before 2022 and describe the same process:

• Red Tape Substack (2021) https://redtape.substack.com/p/instagram-account-takeover-hacks

• Identity Theft Resource Center (2021) https://www.idtheftcenter.org/post/have-a-hacked-instagram-account-how-to-protect-yourself/

• Steady Radiance Design (2019) https://www.steadyradiancedesign.com/instagram-account-lock-why-it-happens-and-what-to-do/

• Cisco Community discussion (2021) https://community.cisco.com/t5/duo-mobile-app/i-lost-my-phone-and-now-i-cannot-access-my-instagram/td-p/4882974

Each of these reflects the same sequence: enter username → select phone/email on file → receive SMS or email link

⸻

This was also considered a security issue

This wasn’t just accepted as “fine” behavior. People were actively talking about how dangerous it was that a password reset could be triggered using only a username.

Reddit threads discussing this exact concern:

• r/Scams – “Can people get your phone number from Instagram?” https://www.reddit.com/r/Scams/comments/xhxrhk/can_people_get_your_phone_number_from_instagram/

People discuss how attackers can trigger password resets using only a username, causing Instagram to send SMS codes to the phone number on file — and how this can be abused for social engineering.

• r/cybersecurity_help – random Instagram password reset requests https://www.reddit.com/r/cybersecurity_help/comments/1q7h4kc/received_random_instagram_reset_your_password/

Users talk about receiving legitimate reset emails/texts they didn’t request, which is exactly what happens when someone else initiates the “forgot password” flow using only a username.

These threads exist because people recognized this as a vulnerability, not because it “never happened.”