Instagram users have reported unexpected emails, sparking fears of a possible data breach.

Millions of users around the world, including some here in New Zealand, have received emails in the last week, prompting them to reset their passwords

The warning appears to come from Instagram's security team, reading: “Instagram has been sent a request to reset your password” and “If you ignore this message, your password will not be changed.”

The email also appears with links to either "reset" or “let us know” if no reset was requested.

Now, even if you think you’re pretty tech-savvy and can spot a ridiculous phishing attempt, heads up, this one appears pretty legit at first and even a second glance.

One of the links takes users to an official Instagram help page, the email footer appears correct, and the sender’s address doesn’t immediately scream alarm bells.

Following the latest concerns, a TikToker has shared a sure-fire way to check whether an email claiming to be from Instagram is actually legit.

The account @ohhackno is known for sharing tips and tricks to avoid being scammed online. In their latest viral video, creator Flo explains how to confirm whether these emails are genuine.

Flo says to open the app, head to 'Settings', then tap 'Password and security'. At the bottom of the screen is a button - unbeknownst to many of us - labelled 'Recent emails'.

Once clicked, you can see all official communications Instagram has sent you in the past 14 days. If there’s nothing there asking you to reset your password, IGNORE THE EMAIL!

In a follow-up video, Flo explains why it’s important for us all to have two-factor login enabled - especially with suspected cyber attacks.

Instagram, however, says there’s no need to panic... at least not yet.

“Receiving a password reset email doesn’t necessarily mean that your account has been hacked,” the platform’s website reads.

“For example, when someone is trying to log into their account or reset their password, they may mistype or misremember their email address or username and enter yours by mistake.

“Only people who know your Instagram password or click the login link in this email can log in to your account.”

Instagram also clarified that official communications will only ever be sent from @mail.instagram.com.

“If you do have additional security concerns, you may want to reset your password and enable two-factor authentication,” the platform added - within the app, of course.

At this stage, Meta has not confirmed whether Instagram has experienced a breach or simply just a bug. But better to be safe than sorry, eh?