Facebook Account Hacked? How to Get It Back and Lock It Down

If your Facebook account has been hacked, go to facebook.com/hacked from a device and browser you have used before, and follow Meta’s recovery steps. If you can still log in, change your password, sign out of every session you don’t recognize and turn on two-factor authentication straight away. If the hacker changed your email or password, look for Meta’s security email about that change, which usually includes a link to reverse it.

Once you’re back in, the work isn’t finished. You also need to secure the email account behind your Facebook login, warn friends about messages sent in your name, and remove anything the hacker posted. The steps below are in the order that usually helps most.

Signs your Facebook account has been hacked

Sometimes it’s obvious: you’re locked out. Often it’s quieter. Look for any of these:

• Your password, email address, phone number or name has changed without you doing it.
• Friends tell you they’re getting odd messages from you, often links, investment offers or requests for money or gift cards.
• Posts, comments, stories or ads appear that you didn’t create.
• You see logins from devices or locations you don’t recognize.
• You get an email from Meta about a login, password reset or contact change you didn’t request.
• Friend requests were sent, or friends were removed, without you.

If you see even one of these, treat the account as compromised and work through the steps below.

Step 1: If you can still log in, secure it now

Being able to log in is the best-case scenario. Move quickly, because a hacker who has your password may try to change your contact details next.

1. Change your password. Use a long password you have never used anywhere else. A password manager makes this easier.
2. Check where you’re logged in. In Meta’s Accounts Center, under password and security, you can see active sessions. Log out of any device or location you don’t recognize, or log out of all sessions.
3. Check your contact details. Make sure the email addresses and phone numbers on the account are yours. Remove any you don’t recognize.
4. Turn on two-factor authentication. An authenticator app or security key is generally stronger than text message codes. Save your recovery codes somewhere safe.
5. Review apps and websites connected to your Facebook login and remove any you don’t use or don’t recognize.
6. Check any Pages, ad accounts or business assets you manage. Remove admins you didn’t add. If a business Page is involved, our guide to a hacked Facebook Page or business account covers the extra steps.

Step 2: If you’re locked out, use Meta’s official recovery routes

If the hacker changed your password, email or phone number, you’ll need Meta’s recovery process. Use only official routes. Meta’s help pages describe these options, and the exact screens change from time to time, so follow the prompts you’re given.

Check your email for Meta’s security message

When the email address or password on an account changes, Meta typically sends a message to the previous email address. It usually includes an option saying you didn’t make the change, with a link to secure your account. Search your inbox, spam and junk folders for recent messages from Facebook or Meta. Be careful: check the sender carefully, and if in doubt, go to the Facebook site directly rather than clicking.

Use facebook.com/hacked

This is Meta’s dedicated page for compromised accounts. It walks you through identifying the account, confirming who you are and resetting access. It generally works best from a phone or computer you’ve used to log in before, on a network you normally use, because Meta can recognize that device.

Try “Forgot password” with your old details

On the login screen, the forgotten password option lets you search for your account by email, phone number or username. If any of your original contact details are still attached, you can get a reset code sent there.

Confirm your identity if asked

If none of your contact details work, Meta may ask you to confirm your identity. Depending on the account, this can include uploading a photo of an ID document or recording a short video selfie so Meta can compare it with photos on the account. Follow the instructions exactly and use the email address you actually have access to. Reviews can take time, and repeated submissions don’t usually speed them up.

Step 3: Secure your email account first

Your email is the master key. If a hacker is in your email, they can reset your Facebook password again as soon as you recover it, and do the same for your bank, shopping and other social accounts.

• Change your email password, and make it different from your Facebook password.
• Turn on two-factor authentication for email.
• Check recovery phone numbers and backup email addresses on the email account.
• Look for forwarding rules or filters you didn’t create. Hackers sometimes set these up to hide security alerts.
• Review recently signed-in devices and sign out any you don’t recognize.

If you use Gmail, our guide on what to do if your Gmail was hacked walks through Google’s own recovery and security checkup steps. For Outlook or Hotmail, see our guide to a hacked Microsoft account.

Step 4: Warn your friends and clean up what the hacker did

Hackers often use a stolen account to reach the people who trust you. The damage to your reputation usually comes from what they sent or posted, not from the hack itself.

1. Post a short warning once you’re back in, or ask a friend to share one for you if you’re still locked out.
2. Delete posts, comments and messages the hacker created. Check your activity log so you don’t miss anything.
3. Check Messenger for conversations started in your name, and reply to anyone who may have been targeted.
4. Review your profile: name, profile photo, bio, links and privacy settings can all be changed by a hacker.
5. Check Instagram too if your accounts are linked in Accounts Center. Our Instagram hacked guide covers that side. If your WhatsApp is also sending odd messages, our guide to a hacked WhatsApp account covers it.

A simple warning post might read:

My Facebook account was hacked earlier this week. If you got a message from me asking for money, a code or to click a link, please ignore it and don’t send anything. I’ve secured the account now. If you did click or send anything, let me know and change your password.

Step 5: Check for wider damage

A hacked Facebook account is sometimes part of a wider problem, especially if you reuse passwords.

• Change reused passwords. Any account that shared your old Facebook password should get a new, unique one.
• Check payment methods. If you had a card saved for ads or purchases, review recent charges and contact your bank about anything you didn’t make.
• Scan your devices with reputable security software if you think malware may have been involved, for example after downloading a file or browser extension.
• Watch for identity theft if the hacker could have seen personal details in messages. Our guide to ways to prevent identity theft covers credit freezes and other protections.

How Facebook accounts usually get hacked

Knowing the common routes helps you close them off.

Method	What it looks like	How to protect yourself
Phishing	A message or email warning that your account will be disabled, or that a post broke the rules, with a link to “appeal” or “verify”	Don’t log in through links. Go to Facebook directly and check notifications there.
Reused passwords	A password leaked in another site’s data breach is tried on Facebook	Use a unique password for every account, stored in a password manager.
Code sharing	A “friend” asks you to send them a code you just received by text	Never share login or reset codes with anyone, even people you know.
Malicious apps and extensions	A quiz, tool or browser extension that asks you to log in with Facebook	Only connect apps you trust, and review connected apps regularly.
Fake support	Accounts or pages posing as Meta support, offering help in comments or messages	Use only Meta’s own help center and in-app tools.

Worked example: a hacked account sending crypto messages

This is an illustrative scenario, not a real case.

A small business owner wakes up to texts from three friends asking why she’s recommending a cryptocurrency platform. She can’t log in: her password has changed. In her inbox she finds a Meta email about an email address change and uses its link to report that it wasn’t her. That lets her reset the password.

Once in, she logs out of all sessions, removes the hacker’s email address, turns on two-factor authentication with an authenticator app and changes her email password. Her activity log shows dozens of Messenger messages and two public posts promoting the scheme. She deletes them, posts a short warning, and messages the friends who replied to ask whether anyone sent money. She also checks the business Page she manages and removes an admin she doesn’t recognize. The whole cleanup takes an afternoon, and the account is harder to take over next time.

Common mistakes to avoid

• Paying a “recovery hacker.” This is one of the most common follow-up scams, and it can lead to a second loss.
• Creating a new account straight away. It can make recovery of the original harder, and it leaves the hacked account active in your name. Try the official recovery routes first.
• Fixing Facebook but not email. If your email is compromised, the hacker can simply reset your password again.
• Clicking links in “security” emails without checking them. Phishing emails often pretend to be about a hacked account.
• Staying silent. Friends who don’t know the account was hacked may keep trusting messages from it.

If someone is still using your name

If you can’t get the account back, report it to Meta as hacked so it can be secured or disabled, and ask friends to report it too. If the hacker, or someone else, sets up a new profile using your name and photos, report it as impersonation. Our guide on online impersonation covers that process.

Occasionally posts made during a hack get screenshotted, shared or picked up in search results for your name. If that has happened, our personal reputation management service can help you work out what can be removed and what needs to be outranked by accurate pages.

Frequently asked questions

How do I contact Facebook if my account was hacked?

The main official route is Meta’s hacked account page at facebook.com/hacked, along with the recovery options in the Facebook app and on the login screen. Meta will not contact you out of the blue by phone, direct message or comment to fix your account, so anyone who does and claims to be Facebook support is likely a scammer. If you subscribe to Meta Verified, its account support is also reached from inside the app.

How long does it take to recover a hacked Facebook account?

It depends on how much the hacker changed. If you can use a security email or an old contact detail, it can be quick. If Meta needs to verify your identity, a review can take longer. Follow the instructions once and check the email address you provided.

Can I recover my Facebook account if the hacker changed my email and phone number?

Often, yes. Meta’s security email to your old address usually includes a link to reverse the change, and facebook.com/hacked offers identity confirmation options. Using a device you’ve logged in with before can help Meta recognize you.

Should I delete my Facebook account after it was hacked?

Usually not. Recover and secure it first, then decide. Deleting it doesn’t undo messages already sent, and an abandoned account is easier for someone to misuse. If you do leave Facebook, secure the account and remove personal details before deleting it.

Will the hacker still have access after I change my password?

Possibly, if they are still logged in on another device or control your email. After changing your password, log out of all sessions, remove unfamiliar contact details, turn on two-factor authentication and secure your email account.