If your Facebook account has been hacked, go to facebook.com/hacked, ideally on a phone or computer you have used to log in to Facebook before. That page is Meta's own recovery flow, and it walks you through securing the account and getting back in. Once you are in, change your password, log out every device you do not recognize and turn on two-factor authentication so the same thing cannot happen again.
Signs your account has been taken over
Not every odd login alert means a hack, but Meta lists a set of signs that together point strongly to one:
- Your profile picture has changed, or there are posts, comments or messages you did not write.
- You cannot log in, or your two-factor authentication method, such as your authenticator app, has stopped working.
- Facebook has told you, by message or notification, that someone is trying to log in or has already logged in, and it was not you.
- You received an email from Facebook saying an email address or phone number was added or removed, or that your password was changed, and you did not make that change.
- The list of places where you are logged in shows a device or location you do not recognize.
If you are unsure, Meta's advice is to use the recovery flow anyway. You may be able to recover the account through facebook.com/hacked even when you are not certain it was compromised.
Step one: use facebook.com/hacked
Type facebook.com/hacked into your usual browser. The page explains that it will walk you through some security steps to recover your account, and it asks you to start on the device you normally use for Facebook if you can. That matters because Facebook uses familiar devices as one of the signals that you are the real owner. An old phone, a laptop you used to share with family or a tablet in a drawer can all count if you logged in to Facebook on them before.
Follow the prompts from there. The exact screens depend on what the attacker changed and what access you still have, so they are not identical for everyone. Answer honestly and use the contact details you genuinely control.
If the hacker changed your email or phone number
This is the most common reason people get stuck, and there are two routes out.
The first is the reversal link. When the email address on a Facebook account is changed, Facebook sends a message to the previous address with a special link that reverses the change and secures the account. Search the inbox of your original email address for that message before doing anything else. Check it carefully, because criminals also send fake Facebook emails, and Facebook provides a way to confirm whether an email really came from it.
The second route is account identification. On a device you have used for Facebook before, go to facebook.com/login/identify and enter an email address or phone number that is, or once was, linked to the account. If none work, try the account name or username. A friend can find your username in the web address of your profile and send it to you. Once the account is found, Meta's steps are:
- Select No longer have access to these? If you do not see that option, you may see Forgotten account? or Recover instead.
- Follow the prompts. You may be asked for new contact information, and it must be an email or phone number that has never been used on the account.
- Complete the checks that confirm the account belongs to you.
- Reset your password once all the security checks are passed.
Before assuming the details are gone, Meta also suggests some simple checks: try any other email or phone number you might have added years ago, include the country code when entering a phone number, and contact your email provider if your email account itself was compromised.
If you can still log in
Sometimes the attacker gets in without locking you out. In that case, act quickly from inside the account:
- Change your password to something new that you have not used anywhere else.
- Log out every session you do not recognize. In Accounts Center, open Password and security, then Where you're logged in, and pick your account. Each session shows a date, time, location and device type. You can select individual devices or select all, then log out.
- Check your contact details and remove any email address or phone number you did not add.
- Review two-factor authentication and remove any method the attacker may have set up.
- Delete posts or messages the attacker sent, and warn friends who may have received scam messages from your account.
Securing the account afterward
Getting back in is half the job. Meta's own list of protections is short and worth following in full.
- Use a strong, unique password. Do not reuse your Facebook password anywhere else, and avoid your name or common words.
- Consider a passkey. Meta supports passkeys, which are generated uniquely for each account and are less vulnerable to phishing than passwords.
- Turn on two-factor authentication. You will then be asked for a login code whenever someone tries to access the account from a browser or device Facebook does not recognize. An authenticator app or security key is stronger than text messages.
- Save your recovery codes somewhere offline, so losing your phone does not lock you out.
- Turn on alerts about unrecognized logins. Facebook will tell you when someone logs in from a device or place it does not know.
- Run Security Checkup. It reviews your account and recommends actions such as updating your password and enabling two-factor authentication and login alerts.
Also look at why the hack happened. Meta points to reused passwords, phishing sites that imitate the Facebook login page, suspicious links sent by friends whose accounts were compromised, and malicious software on a computer. If you typed your password into a fake page, check the web address before logging in anywhere in future, or type facebook.com yourself. Keep your browser updated and remove browser add-ons you do not trust.
What Meta will and will not ask for
Meta states that it will never ask for your password in an email. It also warns against forwarding emails from Meta to anyone, since they may contain sensitive account information. Treat any message that asks for your password, a login code or a verification code as a scam, even if it seems to come from Facebook or a friend. Be wary of people on social media or in search results who offer to recover your account for a fee. Recovery runs through Meta's own tools, and handing a stranger your details gives a second person access to the account.
Pages, purchases and helping someone else
If the hacked account manages a Facebook Page, Meta has a separate recovery process for Pages. Recover your personal account first, since Page access usually depends on it, then follow the Page recovery steps.
If the account was used to buy things in apps or games, Meta's Help Center has a specific article for purchases made on a hacked account. Contact your bank or card issuer as well, and remove any saved payment methods you no longer trust.
If you are helping a friend or relative, the steps are the same, but they should be carried out on a device the account owner has used for Facebook before. Doing it from your own phone removes one of the signals Facebook uses to confirm the owner.
A quick routine to prevent the next one
Keep your email account as well protected as Facebook, because whoever controls your email can usually reset your Facebook password. Check the Where you're logged in list every few months and log out anything you no longer use. Make sure the phone number and email on your account are current, since outdated contact details are what turn a quick fix into a long recovery. And keep a note of your recovery codes somewhere you can find without your phone.
