"We suspect automated behaviour": what the flag means and how to clear it
Stop doing whatever you were doing when the message appeared, disconnect anything that holds your Instagram password, change the password, and then leave the account alone for a while. The flag is Instagram telling you its systems have matched your activity against a bot pattern. It generally clears once the pattern stops, so the thing to avoid is retrying the blocked action, which from the outside looks like the same pattern still running.
Do this now
In order, and the first two matter most.
- Stop the action. If you were following people, following is what triggered it. If you were sending DMs by hand at speed, that is what triggered it. Do not try it again to see whether it still fails.
- Work out what else has your login. Any growth panel, engagement pod tool, unfollower app, scheduler that asked for your password, or bot service you tried once and forgot about. Remove your credentials from all of them.
- Open Instagram's settings, find the list of apps and websites you have authorised, and remove anything you do not recognise or no longer use. This is a different list from tools holding your password, and both need checking.
- Change your Instagram password. This ends any session you did not start, including ones a panel is still running on a server.
- Turn on two factor authentication while you are in there. It stops a removed tool getting back in with a saved password.
- Check Account Status, in Instagram's settings under More info and support. It lists content removed for breaching Community Standards and features you can no longer use, and it offers a route to request a review.
- Use the account normally and slowly for the next few days. Post, reply to real people, answer your DMs by hand. Normal activity is the signal the systems are waiting for.
What the message actually is
Instagram sends this before it enforces anything. Its systems think something other than a person is operating the account, and the message asks you to fix that while you still have the chance. The wording people report most often runs along these lines.
We suspect automated behaviour on your account. To prevent your account from being temporarily restricted or permanently disabled, please ensure that no other users or tools have access to your account and that you're adhering to our Terms of Use.
Wording as widely reported by affected users. Meta does not publish the text of this prompt, so yours may differ.
Read the middle clause again, because it tells you what Instagram thinks the problem is. It asks you to make sure no other users or tools have access to your account. Instagram is describing a session it cannot attribute to you, which is precisely what a tool holding your password creates. That framing is your best clue about where to look.
A separate and more specific message reads along the lines of an action being blocked with an invitation to try again later. That one is a feature restriction on one action rather than a general warning, and the advice below applies to both.
The automated behaviour notice arrives before Instagram restricts anything. It asks you to remove whatever else has access to your account and to slow down, and accounts that do both usually recover without contacting anyone.
What triggers it
Instagram does not publish its thresholds, and it would be foolish to pretend otherwise. What is documented is the class of behaviour it acts against: the Terms of Use prohibit accessing or collecting information in an automated way without express permission, whether or not you are logged in. Everything in the table below sits inside that clause.
| What you did | Why it reads as a bot | Who usually does it |
|---|---|---|
| Follow or unfollow in bulk | Evenly spaced actions at a rate a thumb cannot sustain | Growth panels and unfollower apps |
| Like or view stories automatically | Same pattern, and no API permission exists for either | Engagement bots |
| Send identical DMs to many accounts | Repeated content to people with no prior conversation | Mass DM tools and panels |
| Give your password to a third-party tool | A login from a server rather than your device | Anything that asked for your username and password |
| Log in from several places at once | Concurrent sessions in different locations | An agency, a VA and a panel sharing one login |
| Comment the same thing on many posts | Repetition, and comments on media you do not own | Comment bots and engagement pods |
| Hammer an action after it was blocked | Retrying a refused action is itself bot behaviour | Almost everyone, once |
One pattern catches people who never used a bot at all. A phone that has been passed between an agency, a freelancer and an owner, each logging in from a different city, produces concurrent sessions that look like a shared credential, because it is one.
How long it lasts
Instagram does not publish a duration for these restrictions, and the numbers you will read elsewhere are worth treating carefully. Search this and you will be told 24 to 48 hours, or a few hours, or up to two weeks, all stated confidently and all sourced to nothing. The honest answer is that it varies with what triggered it, whether it is the first time, and whether the behaviour stopped.
- Some restrictions come with a date attached, shown in the message itself. If yours has one, that is the only duration you can rely on.
- Most do not come with a date, and they lift when Instagram's systems stop seeing the pattern. That means the clock effectively starts when you stop, which is why step one matters more than the rest.
- Repeat flags on the same account tend to be treated more seriously than a first one, which is a reasonable thing to expect from any abuse system.
- A general warning with no restriction attached needs no waiting at all. Remove the access it is complaining about and carry on normally.
What not to do
Several popular pieces of advice make things worse, and two of them are actively risky.
| Response | Effect |
|---|---|
| Retry the blocked action | Repeats the activity that was flagged in the first place |
| Switch to mobile data or a VPN and try again | Adds a location change to the behaviour it flagged |
| Buy an account unban service | No such service has access to Meta's enforcement systems |
| Delete and reinstall the app | Nothing. The restriction is on the account, not the app |
| Switch the account type back and forth | Nothing useful, and it disrupts your own insights |
| Make a second account and carry on | Links a new account to a flagged one |
| Stop, remove third-party access, use the app normally | The thing that actually works |
The unban services deserve a specific warning. They ask for your login in order to work, which hands your account to a stranger at the exact moment Instagram has told you that other tools having access is the problem.
Stopping it happening again
Once the account is clear, the question is what you replace the tool with. This is where the difference between the two kinds of Instagram automation stops being an abstraction, because one of them cannot produce this flag in the first place.
| Official API app | Tool with your password | |
|---|---|---|
| How it connects | Meta OAuth on Instagram's own screen | A login form on the vendor's site |
| What Instagram sees | A registered app calling documented endpoints | You, apparently on a device in a data centre |
| Rate limits | Published by Meta, so a tool can respect them | Unpublished, so it finds them by tripping them |
| Can it follow, unfollow or like? | No permission exists for any of them | Yes, which is why it exists |
| How you switch it off | Remove the app in Instagram settings | Change your password and hope |
There is a caveat worth saying plainly. Moving to an approved app removes the cause of this particular flag, and it does not make your messages welcome. Somebody who receives a DM they did not want will report it whatever sent it, so the copy and the frequency stay your job.
An app connected through Meta OAuth cannot follow, unfollow, like or view stories on your behalf, because no Instagram permission allows it. That is why an account running only official-API automation does not generate automated behaviour flags from those actions.
If the account was disabled instead
A disabled account is a different situation from a restriction. You cannot log in, and Instagram tells you the account was disabled rather than that an action was blocked. There is an appeal route in the message and in the Help Centre, and the sequence above will not help you because you have no access to run it. Use the appeal, describe what you have removed, and wait. Creating a replacement account while the appeal is open tends to go badly.
Questions people ask about this
- What does we suspect automated behaviour on your account mean on Instagram?
- It means Instagram's systems have matched your activity against patterns they associate with bots or with a tool operating the account. The notice is a warning before enforcement, and it asks you to make sure no other users or tools have access to your account. It is usually triggered by bulk following, automated liking, repetitive DMs or a third-party service holding your password.
- How do I fix the automated behaviour flag on Instagram?
- Stop the action that caused it and do not retry it. Remove your password from every third-party tool that has it, then change your password and enable two factor authentication. Remove unused apps from the connected apps list in Instagram's settings, check Account Status for any listed restriction, and use the account normally for a few days. Most accounts clear without contacting support.
- How long does an Instagram automated behaviour restriction last?
- Instagram does not publish a duration, so the specific figures circulating online are not sourced from Meta. Some messages state a date, and those are the only reliable ones. Where no date is given, the restriction lifts once the systems stop seeing the pattern that triggered it, which means it effectively starts counting from when you stop rather than from when you were flagged.
- Will using a VPN or mobile data get around an Instagram action block?
- No, and it makes the situation worse. The restriction sits on the account, not on the connection, so changing network only adds an unexplained location change to the activity Instagram already flagged. The same applies to reinstalling the app or switching account type. Neither touches the restriction, and both waste the days you should spend behaving normally.
- Can an official API tool cause the automated behaviour flag?
- It cannot cause the version of the flag that comes from bulk following, liking or story views, because no Instagram API permission allows any of those. An approved app connects through Meta OAuth, never holds your password and calls only documented endpoints within published rate limits. What an approved app can still attract is reports from recipients who did not want your message, which is a separate problem.