Hacked Facebook account: how to recover it step by step

Signs your Facebook account has been hacked

A hack is not always obvious at first. The most common signs:

• You can no longer log in: “incorrect password” even though you never changed it.
• You received an email from Facebook about an email, password or phone number change you did not make.
• Posts, messages or friend requests are being sent in your name.
• Your contacts receive messages asking for money, a code or a “vote”.
• Ads are running from your page or ad account, or you have been removed as an admin of your page.

If any of this sounds familiar, act now. The sooner you move, the better your chances of getting back in before the hacker locks everything down.

Step 1: use Facebook’s official recovery page

1. From a phone or computer you have used to log in to Facebook before (Facebook recognises it more easily), open facebook.com/hacked.
2. Say that your account has been compromised, then find it using your email, phone number or username.
3. Facebook may offer to send a code to an email address or phone number already linked to the account. Pick one you can still access.
4. If both your email and number were changed, look for an option such as “No longer have access to these?”. Facebook may then ask you to confirm your identity another way, for example with a video selfie or an ID document. The options shown vary from account to account.
5. Complete every step without leaving the process halfway.

Key tip: when the email address on an account is changed, Facebook usually sends a message to the old address. That message often contains a link to reverse the change and secure the account. Search your inbox (and spam folder) for a recent email from Facebook, and check it really comes from an official domain before clicking.

Facebook’s menus and screens change regularly. If what you see does not match exactly, the official Facebook Help Center is the reference.

Step 2: once you are back in, take full control

Getting access back is not enough: the hacker may have left “back doors”. In Accounts Center (usually: Menu, then Settings & privacy, Settings, Accounts Center, Password and security), do the following:

1. Change your password to a long, unique one you have never used anywhere else.
2. Check your contact details: remove any email address or phone number you do not recognise and add your own back.
3. Log out unknown devices under “Where you’re logged in”.
4. Turn on two-factor authentication, preferably with an authentication app rather than plain SMS.
5. Review connected apps and websites and remove anything you did not authorise.
6. Check your page and ad account: who has access to the page, saved payment methods, active campaigns. Remove any suspicious access.
7. Delete content the hacker posted and go through your sent messages to see who was contacted.

If recovery does not work

Sometimes the process fails, especially when the hacker changed the email, the number and switched on their own two-factor authentication. In that case:

• Try again from the device and network you normally use (your own phone, your everyday connection).
• If you are asked for a video selfie or an ID, do it carefully: good light, face clearly visible, name matching the account.
• Ask friends to report the profile as hacked from your profile’s menu.
• Beware of “account recovery experts” who contact you promising to fix everything for a fee. It is almost always a second scam. Nobody can guarantee an account recovery, and Facebook will never ask you to pay to get your account back.

While you wait, protect your audience. That is the next step, and it is just as urgent as the recovery itself.

Do this right now: checklist

• Start the process at facebook.com/hacked.
• Look for Facebook’s email about the email change and use the reverse link if there is one.
• Change your email password: if your inbox is compromised, the hacker will take Facebook back every time.
• Change the password of any other account that used the same password.
• Warn your contacts and customers through another channel (WhatsApp, Instagram, SMS, your official page): “My Facebook has been hacked, do not answer any request for money or codes.”
• Screenshot the hacker’s messages and posts (useful for a report or a police complaint).
• If money was requested or sent, contact your bank or mobile money provider quickly.

Stop it from happening again

• Two-factor authentication on for Facebook and for your email account, with backup codes stored somewhere safe.
• Up-to-date recovery email and phone: an old number you no longer use is an open door for a hacker.
• Be wary of fake messages “from Facebook” or “from Meta”: “your page will be deleted within 24 hours”, “copyright violation”, “get the blue badge for free”. They lead to fake login pages. Facebook never asks for your password in a message.
• Never share a code you receive by SMS, not even with a friend: if their account was hacked, the hacker may be the one writing to you.
• A different password for every account, ideally stored in a password manager.
• Several trusted admins on your business page, each with two-factor authentication.

To go further, read our guide on protecting your brand online.

How My Official Links helps when your account is hacked

During a hack, the real danger is confusion: your customers no longer know which account to trust. The hacker writes in your name, and sometimes fake accounts pop up at the same time.

With My Official Links, you have one official link that brings together your real social accounts, your WhatsApp numbers and your address. You stay in control of that link even when Facebook is no longer yours. You can post an alert on it (“Our Facebook has been hacked, our only real contacts are here”) and point customers to the channels that are still safe.

If your page is certified, customers see the blue badge and can check any account or number themselves with the free Check an account tool. Also let our team know through the report form so they know that account is temporarily out of your control. If you remove a verified account from your page, your certification may be paused until it is verified again. That is intentional: a badge should never vouch for a hacked account.

My Official Links is not affiliated with Meta and cannot recover your Facebook account for you. What it does is help your audience avoid the trap while you recover it. If a fake profile is pretending to be you, also read how to report a fake Facebook account.