Losing access to your Facebook account is stressful. A hacker may post scams to your friends, change your email and phone number, run ads with your payment card or lock you out entirely. Act quickly, because the sooner you start recovery, the better your chances. This guide walks you through how to recover a hacked Facebook account step by step, what to do if the hacker changed your email and password, and how to make sure it never happens again.
Signs your Facebook account was hacked
- Your password no longer works
- Your email address, phone number or name has changed
- Friends receive messages you did not send, often asking for money or sharing links
- Posts, ads or comments you did not create appear on your profile
- You received an email from Facebook about a login or a change you did not make
- New friend requests were sent to strangers
- Unknown charges appear from Meta ads on your card
Step 1: Try to log in and reset your password
If you can still log in, change your password immediately in Settings and privacy, Settings, Accounts Center, Password and security, Change password. Choose a long, unique password. Then go to Where you are logged in and log out of every session you do not recognize.
If you cannot log in, click Forgot password? on the login page and enter your email or phone number. Facebook sends a code to whatever contact details are still on the account.
Step 2: Use facebook.com/hacked
Facebook has a dedicated recovery page: facebook.com/hacked.
- Visit facebook.com/hacked on a device you have used before.
- Choose the option that best describes the problem, such as Someone accessed my account without my permission.
- Follow the prompts to identify your account and reset access.
Using a phone or computer and WiFi network you have logged in from before helps Facebook recognize you.
Step 3: Check your email for a Facebook security message
When someone changes the email address on your account, Facebook sends a message to the old email with a link that says this wasn’t me or secure your account. Search your inbox and spam folder for emails from security@facebookmail.com. Clicking that link lets you reverse the change. Be careful: only trust emails that come from facebookmail.com or meta.com addresses.
Step 4: Verify your identity
If the hacker changed every contact detail, Facebook may ask you to confirm your identity:
| Verification method | What you do |
|---|---|
| Video selfie | Record a short video turning your head so Facebook can match your face to profile photos |
| Government ID | Upload a photo of a passport, driving licence or national ID card |
| Trusted contacts | Older accounts may get recovery codes from chosen friends |
| Code to old email or phone | Enter a code sent to contact details previously on the account |
Make sure the name on your ID matches the name on your profile as closely as possible.
Step 5: Secure the account once you are back in
- Change your password to a new unique one.
- Turn on two-factor authentication in Accounts Center, preferably with an authenticator app.
- Remove unknown emails and phone numbers from your account.
- Log out of all other sessions.
- Review Apps and websites and remove anything you do not recognize.
- Check Ad payments and remove unknown payment methods; report fraudulent charges to your bank.
- Delete posts, messages and pages the hacker created.
- Check your Instagram and WhatsApp links in Accounts Center.
Frequently asked questions
How long does Facebook recovery take?
Simple password resets take minutes. Identity verification can take from a day to several weeks.
Can I call Facebook to recover my account?
Facebook does not offer general phone support. Paid Meta Verified subscribers can access account support chat. Anyone claiming to be Facebook support on the phone or in comments is likely a scammer.
Should I pay a recovery service?
No. People offering to recover accounts for money are almost always scammers.
What to do if the hacker changed your email and phone
This is the hardest situation, but it is still recoverable in many cases.
- Search your old email for the change notification from Facebook and click the secure your account link. This is the fastest route and often works even days later.
- Use a recognized device. Try recovery from a phone or computer where you were already logged in, ideally on your usual home WiFi. Facebook trusts familiar devices and locations more.
- Check if you are still logged in somewhere. An old tablet, a second phone or a work computer may still have an active Facebook session. If so, use it to change the password and remove the hacker’s email.
- Go through identity verification using a video selfie or ID if offered.
- Report the account as compromised with the help of a friend, who can open your profile, tap the three dots, choose Find support or report, then Something else, then Report account and select that it may be hacked.
How hackers get into Facebook accounts
| Method | How it works | How to protect yourself |
|---|---|---|
| Phishing | Fake login pages or messages ask for your password | Only log in at facebook.com, never through links in messages |
| Fake copyright or page violation messages | Scare messages claim your page will be deleted | Facebook never asks for your password in Messenger |
| Password reuse | A password leaked from another site is tried on Facebook | Use a unique password for every account |
| SIM swap | Criminals take over your phone number | Use an authenticator app instead of SMS codes |
| Malware and browser extensions | Steal saved passwords and cookies | Install apps only from trusted stores |
| Friend asks for a code | A hacked friend asks you to send a code you received | Never share login codes with anyone |
| Weak password | Easy passwords are guessed | Use a long passphrase |
Warn your friends
If the hacker messaged your friends, post from your recovered account or ask a family member to tell your contacts not to click links or send money. Common scams include fake investment opportunities, requests to buy gift cards, emergency money requests and links to fake videos. If someone already sent money, they should contact their bank or payment app right away.
Recovering a hacked business page
If your account managed a Facebook Page or ad account:
- Recover your personal account first, because pages are controlled through personal profiles.
- In Meta Business Suite, go to Settings, People and remove admins you do not recognize.
- Check Billing and payments for unknown ads and contact your bank about fraudulent charges.
- Use the Meta Business Help Center to report a compromised business asset.
- Add at least two trusted admins with two-factor authentication so one hacked account cannot take over the page.
Recovery scams to avoid
When your account is hacked, scammers target you a second time. Watch out for:
- People in comments or on X claiming they are hackers who can recover accounts for a fee
- Fake Meta support pages and phone numbers found in search results
- Emails that look like Facebook but come from strange addresses
- Requests to pay in cryptocurrency or gift cards
Genuine help is free and only comes from facebook.com, meta.com or facebookmail.com.
Real example
The page admin. Carlos clicked a message claiming his business page broke copyright rules and entered his password. Within minutes the hacker changed his email. Carlos found the security email in his old inbox, clicked secure your account, reset his password, removed the hacker as page admin and turned on an authenticator app. He was back in control the same day, and posted a warning to customers.
Facebook security checklist
Run through this list every few months to keep your account safe:
- Unique password of at least 14 characters, stored in a password manager
- Two-factor authentication on, using an authenticator app or security key
- Login alerts turned on in Security and login, Get alerts about unrecognized logins
- Only your current email and phone number listed in Accounts Center
- No unknown devices under Where you are logged in
- Old apps and games removed from Apps and websites
- Recovery codes saved somewhere safe offline
- Privacy check-up completed in Settings
When to give up and start again
If weeks pass and every recovery path fails, you may need to create a new account. Report the hacked profile so Facebook can disable it, warn friends to unfriend it, and set up the new account with two-factor authentication from day one.
Before you do, give recovery one more try from a different familiar device, because Facebook’s automated checks sometimes succeed on a second or third attempt after a few days. Keep copies of your ID uploads, case emails and screenshots of the hacker’s posts in case you need to show what happened to your bank or the police.
The bottom line
To recover a hacked Facebook account, act fast: try a password reset, use facebook.com/hacked, look for Facebook’s security email to undo changes and verify your identity if needed. Then secure the account with a strong password and two-factor authentication. Learn how to create a strong password and how to spot a fake website to stay safe.
1 thought on “How to Recover a Hacked Facebook Account (Step by Step)”