My Facebook Was Hacked: How to Get It Back and Lock It Down

Think someone got into your Facebook account? Take a breath. Go to facebook.com/hacked, Meta’s own recovery page, and follow its steps, if you can on a phone or computer you’ve used for Facebook before (Meta). Don’t pay anyone who offers to get your account back: Meta representatives never request money or ask for passwords.

My Facebook was hacked: how do I fix it?

1. Go to facebook.com/hacked. Meta says to report your account as compromised there whether or not you can still log in.
2. Still logged in? Change your password, log out of sessions you don’t recognize, and remove any email or phone number that isn’t yours.
3. Turn on two-factor authentication, so a stolen password isn’t enough to get in.
4. Warn friends and family, and check your linked accounts and saved payment methods.
5. Watch for follow-up scams, like fake Meta support and paid “recovery” offers.

Locked out? Skip to “How can I get it back?” below.

Signs your Facebook was hacked

Meta lists these warning signs:

• Your profile picture changed.
• You see posts, comments or messages you didn’t write.
• You can’t log in, or your two-factor authentication method stopped working.
• Facebook tells you someone logged in, or tried to, and it wasn’t you.
• Facebook emails you that an email address or phone number was added or removed, or that your password changed, and you didn’t do it.

If you can still log in: lock the hacker out

Start with your device. The FTC suggests updating your security software and running a scan, then following the provider’s recovery steps. Report the account at facebook.com/hacked too, even though you can log in (Meta).

Most settings below live in Accounts Center. Click your profile picture (on a computer) or tap Menu (in the app), then Settings & privacy > Settings > Accounts Center (Meta).

How do I change my Facebook password?

In Accounts Center, select Password and security > Change password, then choose your account (Meta). Pick a password you don’t use anywhere else. The FTC says to make it hard to guess, or to use a passphrase, a series of words separated by spaces.

Log out devices you don’t recognize

Go to Password and security > Where you’re logged in and select your account. Log out any session you don’t recognize, or choose Select devices to log out > Select all > Log out (Meta).

A strange location isn’t always a hacker, because phones can show a location that isn’t accurate. But if you think someone else is logged in, Meta says to log that session out and change your password.

Check your email and phone number

In Accounts Center, go to Personal details > Contact info. Delete any email or phone number that isn’t yours. Make sure you’re the only person who can get into the ones that remain, and that your email password is different from your Facebook password (Meta).

Turn on two-factor authentication

Go to Password and security > Two-factor authentication. You can use a security key, codes from an authentication app or text message codes, and save recovery codes for times you can’t use your phone (Meta).

Even if someone steals your password, they can’t log in without that second step, the FTC says. A passkey, a safe alternative to passwords, is less vulnerable to phishing, Meta says.

Review what the hacker did

• Activity log: Click your profile picture, then Settings & privacy > Activity Log (Meta). Look for posts, interactions and connections you didn’t make, and delete posts you didn’t write (Meta).
• Recent emails: Under Password and security, Recent emails shows the security emails Facebook sent you in the past year, like password change requests (Meta).
• Friends and messages: Look for messages the hacker sent and new friends you don’t recognize.

My Facebook was hacked and they changed the email

Meta has a fix for this. When the email on your account changes, Meta sends a message with a special link to the old address. Clicking it can reverse the change and secure your account.

Scammers copy these emails, so check before you click (Meta):

• Real Facebook email comes only from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, metamail.com or global.metamail.com, or their subdomains. Watch for misspellings.
• In Gmail, Yahoo Mail or Apple Mail, you can trust the email if the Facebook logo appears next to the address.

Still not sure? Don’t click any links in it (Meta). Type the address into your browser yourself, as Meta suggests when in doubt, and start at facebook.com/hacked.

If the hacker got into your email account too, secure it as well. Whoever controls your inbox can request password reset links for your other accounts. See My email was hacked.

My Facebook was hacked: how can I get it back?

If you can’t log in, try these steps in order. Use a phone or computer you’ve logged in on before, even an old phone or a family member’s laptop (Meta).

1. Start at facebook.com/hacked. You may be able to recover your account there even if you’re not sure it was hacked.
2. Still getting Facebook’s emails or texts? Reset your password: on the login screen, select Forgot password? and follow the steps (Meta). No code? Check your spam folder, then wait a few minutes before asking for a new one (Meta).
3. Lost the email or phone? Try any other email or number you may have added, include the +1 country code, or ask your email provider for help (Meta).
4. Find your account. Type facebook.com/login/identify into your usual browser and enter an email, phone number, name or username. Select No longer have access to these? (you may see Forgot account? or Recover instead) and follow the prompts. You may need to give new contact info that was never used on the account (Meta).

Helping a parent or friend? Have them use the device they usually use for Facebook (Meta).

How Meta confirms it’s you

Meta runs a security check when it thinks your account’s security might have been affected. You may be asked for:

• An ID. Meta accepts one government ID, like a driver’s license, or two non-government IDs, like a library card. If you’ve lost access, it may need one with a photo or date of birth that matches your account. Meta says it ignores details it doesn’t need, like your ID number, and you can cover them before taking the photo (Meta).
• A video selfie, in some places. In October 2024, Meta announced it was testing video selfies that it compares with your profile pictures, and said it deletes the facial data after the check (Meta newsroom). You’ll only see this option if Meta offers it to you.

My Facebook was hacked and disabled

Check which message you see:

What you see	What it means	What to do
Your account is locked	Meta saw unusual activity and locked it for security	Open Facebook, select Get started and follow the steps
“We suspended your account” or “We disabled your account”	Meta found the account or its activity may not follow its Community Standards	Log in and follow the prompt to appeal
You can’t log in at all	The hacker may have changed your details	Start at facebook.com/hacked (Meta)

Meta says you have 180 days to appeal a suspension, though the window varies by region. If you don’t appeal, or the appeal fails, the account is permanently disabled (Meta).

Don’t wait. Meta may disable or delete an account that appears hacked if it can’t confirm who owns it after a year.

Warn your friends and check your other accounts

Tell friends and family

Hackers can use stolen accounts to phish the owner’s family or friends, trying to get money, personal information or access to their accounts. Send a quick text or email, or post, telling people not to click links from you and to ignore pleas for help or money.

Also tell them:

• Never share a verification code. “Anyone who asks you for your account verification code is a scammer,” the FTC says.
• Check “emergencies” first. Call or message the person using a number you know is right. More: grandparent scams and AI voice clones.

Instagram, Messenger and WhatsApp

• Accounts Center: Under Accounts, you can see and remove the accounts connected in your Accounts Center.
• Instagram: If it was hacked too, go to instagram.com/hacked (Instagram).
• Messenger: Meta’s recovery hub sends hacked Messenger accounts to the same facebook.com/hacked page.
• WhatsApp: It has its own steps. You re-register with the 6-digit code sent to your phone, which logs everyone else out. Changing your password alone won’t remove someone (WhatsApp).

Payments and Marketplace

• Saved cards: In Accounts Center, open Meta Pay > Manage. Select Options next to a card you don’t recognize, then Delete payment method (Meta).
• In-app purchases you didn’t make: Check your purchase history to see whether Meta Pay, Google Play or the Apple App Store took the payment, and ask that platform for a refund (Meta).
• Marketplace: For an order you didn’t place, go to Marketplace > Buying > Purchased orders, select it and follow the help prompts (Meta).
• Your bank: If someone may have gotten into your financial accounts or made payments, Meta says to contact your bank immediately.

How to report a hacked Facebook account

• To Meta: Report the account as compromised at facebook.com/hacked (Meta). Report scam posts or messages with the Report link next to them (Meta), and send phishing emails to phish@fb.com (Meta).
• Lost money: Tell the FTC at ReportFraud.ftc.gov. It can’t resolve individual reports, but uses them to investigate and bring cases.
• Money lost or demanded: File a complaint with the FBI’s Internet Crime Complaint Center (IC3). Its account takeover page covers social media accounts; use the words “account takeover” in your description. Meta warns that scammers sometimes hold hacked accounts “hostage” and demand money. If you believe a crime was committed, Meta recommends reporting it to local law enforcement.
• Personal information stolen: Report it at IdentityTheft.gov to get a recovery plan (FTC). See what a scammer can do with your information.

The report-a-scam tool lists more official channels, and the scam recovery checklist helps you track each step.

Watch for the follow-up scam

Watch for these follow-up tricks:

• Fake Meta support. Meta representatives never ask for money, passwords or payment details over chat or email (Meta). Chats with Meta’s AI support assistant happen in the app or Help Center and can only be started by you. To reach Facebook, use a bookmark, not search results or ads, the FBI’s IC3 advises.
• Fake warnings about your account. Scam emails may falsely claim you broke Facebook’s Community Standards, or warn that something will happen to your account unless you act (Meta). Don’t trust messages that threaten to delete or ban your account, Meta says.
• Paid “recovery” help. The FTC’s rule for anyone offering to get back what you lost: if they contact you and ask for an upfront fee, “That’s a scammer.”
• Reset emails you didn’t ask for. Don’t click the link. If a second email says your password was reset, secure your account right away.

Did a link start all this? See I clicked a phishing link. Let a “support agent” into your computer? See I let a scammer into my computer.

What varies

• Menus. Meta is gradually moving people to Meta Accounts, so you may see Meta Account settings instead of Accounts Center (Meta). Steps also differ between the app and a computer.
• Identity checks. Meta says its recovery steps adjust to your situation, and video selfies aren’t offered everywhere.
• Appeals. The time to appeal a suspension varies by region.
• Facebook Pages. If a hacker took over a Page you manage, Meta has a separate Page recovery form.