Quick answer
Go to facebook.com/hacked (Meta’s own hacked-account tool) on a device you’ve used for Facebook before, and follow the steps. If you can still log in, change your password straight away and log out of every device you don’t recognise. If the hacker changed your email and phone, the same tool offers ways to prove it’s you, which can include an optional video selfie. Never pay anyone or share a code to “recover” your account.
Signs your account was hacked (the first six are Meta’s own list)
- Your profile picture has been changed.
- There are posts, comments or messages you didn’t write.
- You’re having problems logging in, or your two-factor authentication method (for example your authentication app) isn’t working.
- Facebook sent you a message or notification that someone is trying to log in, or has logged in, and it wasn’t you.
- You got an email from Facebook saying an email address or phone number was added or removed, or your password was changed, and it wasn’t you.
- In Where you’re logged in in your Settings, there’s a device or location you don’t recognise.
- Your password, email address or phone number was changed and you didn’t do it.
- Friends say you sent them strange messages, links or requests for money.
- Posts, stories, comments or Marketplace listings appear that you didn’t make.
- Your name, profile photo or birthday changed.
- You received an email about a login from a new device or location you don’t recognise.
- Charges for Facebook ads you didn’t buy appear on your card statement, or you were added to a Business account.
- Facebook logs you out and your password no longer works.
iPhone & iPadAndroidComputer (browser)
Meta’s recovery screens vary by account, country and device, and Meta updates them regularly. The steps below describe what to look for; follow the wording on your screen.
The 5-minute emergency checklist
Do these in order, as quickly as you can. Each one limits the damage while you recover the account.
- Don’t panic-click. Ignore any links in messages or emails about the hack. Open Facebook yourself.
- Secure your email. Change the password of the email account linked to Facebook, and sign out of other sessions there. If the hacker controls your email, they control your resets.
- If you’re still logged in, change your Facebook password now and log out of other devices (Path A).
- If you’re locked out, go to facebook.com/hacked on a device you normally use (Path B).
- Protect your money. If a card is saved for ads or payments on Facebook, watch your statements and contact your bank if you see charges you didn’t make.
- Tell friends not to trust messages from your account for now (template below).
Why this happens: the possible causes
You don’t need to know exactly how it happened to recover the account, but knowing the likely route helps you close the gap so it doesn’t happen again.
| Your situation | What it means | Your path |
|---|---|---|
| Still logged in on at least one device | You can lock the intruder out from the inside | Path A |
| Password changed; you still have your email or phone | You can reset through Meta’s tools | Path B |
| Password, email and phone changed | You’ll need to prove your identity to Meta | Path C |
| A Page or business assets you manage were taken | Separate route for Pages | Hacked Page |
| Account disabled after the hack | Possibly an enforcement action on the hacker’s activity | Disabled account guide |
- A fake login page (phishing)Possible
A message or email says your account will be closed, has a copyright problem, or won a prize, and links to a page that looks like Facebook. Typing your password there hands it over.
- A code you were tricked into sharingPossible
Hackers often message from a friend’s hacked account asking you to “send back” a code they “sent by mistake”. That code is the key to your account.
- A reused passwordPossible
If your Facebook password was also used on another site that was breached, criminals may try it on Facebook automatically.
- A third-party app, browser extension or devicePossible
Apps you logged in to with Facebook, untrusted browser extensions, or a shared or lost device can expose your account.
- A fake “recovery service”Possible
Some people are hacked a second time by scammers posing as support after a first problem. Meta notes that hackers will keep trying to exploit account recovery tools.
Try these 60-second checks first
- Use facebook.com/hacked or the hacked option in Facebook’s login help, never a link someone sent you.
- If you’re still logged in anywhere (phone, tablet, old laptop), don’t log out. That session may be your way back in.
- Secure your email account first if you think the hacker can get into it: change its password and turn on its two-step verification.
- Warn close friends by another channel (text or call) not to click links or send money “from you”.
Path A: You can still log in
This is the best position to be in. Work quickly through Fix 1 to Fix 4 below; together they remove the intruder and close the most common doors back in.
Path B: Your password was changed
If you can’t log in but the account still has an email address or phone number you control, use Fix 5. Facebook will send a code to a contact method it has on file and help you secure the account.
Path C: The hacker changed your email and phone
Start with your old email inbox. Meta says that when an account’s email address is changed, it sends a message to the previous email address with a special link, and that you can click this link to reverse the email change and secure your account.
- Open the email account that used to be on Facebook and search for a recent message from Facebook about an email change (check spam/junk too).
- Before clicking, check it’s genuine: Meta says its emails only come from domains such as facebookmail.com, facebook.com, fb.com, meta.com or metamail.com — watch for misspellings (full check).
- Click the link in that message to reverse the email change and secure your account, then follow the steps.
- If you can’t find that email, or you no longer have access to your old email or phone either, use Fix 5 and then Meta’s step-by-step route for when you can’t access your email or phone — when asked for new contact details, use an email or number that has never been used on your Facebook account before.
How to fix it, step by step
Work through these in order. They start with the quickest, safest checks and only move to steps that sign you out or remove data later.
Fix 1: Change your password and log out everywhere else (if you can still log in)
A new password stops the hacker using the old one, and logging out other sessions kicks them out of devices where they’re already signed in.
- Open Menu (☰: top left on iPhone, top right of the Home screen on Android) > Settings and privacy > Settings > Accounts Center (or Accounts Centre) > Password and security — Meta’s path; if you don’t see Accounts Center, choose Password and security directly (on a computer, start from your profile picture).
- Choose Change password, then fill in Current password, New password and Re-type new password. Facebook asks for at least 6 characters mixing numbers, letters and special characters, but make it long and unique, not used anywhere else.
- Tick Log out of other devices (the screen says to choose it “if someone else used your account”), then tap Change password.
- Find Where you’re logged in (or a devices list) and log out of every session you don’t recognise. If you’re unsure, log out of all except the device you’re holding.
- Accept any prompt to review other security settings.
Did it work? The devices list shows only the device you’re using (and others you recognise).
Fix 2: Remove the hacker’s email, phone number and two-factor method
Hackers often add their own contact details or second factor so they can reset the password again later.
- In security or personal details settings, review every email address and mobile number. Remove any that aren’t yours.
- Make your own email and phone the primary contacts.
- Open Two-factor authentication. If you don’t recognise a method, such as an unknown phone or authenticator, remove it and set up your own.
- Save fresh recovery codes somewhere safe.
Did it work? Only your own email, phone and two-factor methods are listed.
Fix 3: Remove unknown apps, extensions and admins
Connected apps and browser extensions can keep access even after a password change.
- In Facebook settings, find Apps and websites (logged in with Facebook) and remove anything you don’t use or recognise.
- On your computer, review browser extensions and remove any you didn’t install on purpose.
- If you manage Pages or groups, check the admin list and remove people you don’t know.
Did it work? Only apps, extensions and admins you trust remain.
Fix 4: Undo changes and report what the hacker posted
Scam posts, messages and Marketplace listings in your name can hurt friends and your account’s standing.
- Check your profile name, photo and birthday and correct anything that was changed.
- Delete posts, stories, comments and Marketplace listings you didn’t make.
- Open Messenger and look for messages you didn’t send. Warn the people involved.
- Use the Check what the hacker may have done table below for the full list.
Did it work? Your profile looks as you left it and friends confirm messages have stopped.
Fix 5: Locked out? Start Meta’s official recovery at facebook.com/hacked
facebook.com/hacked is the link Meta itself gives for recovering a hacked account, and Meta’s login help says to visit it on a device you’ve used to log into Facebook before. It walks you through securing the account based on what happened.
- On a phone or computer you’ve used for Facebook before, type facebook.com/hacked into the browser yourself.
- Choose the option that best matches what happened (for example, someone changed your password or you saw activity you didn’t do).
- Find your account using your email, phone number, username or name.
- Follow the steps. Facebook may send a code to a contact method on the account, or ask you to confirm your identity.
- Enter any code into Facebook yourself. Don’t forward it to anyone.
Meta also offers an Account Recovery Hub (external site, opens in a new tab) covering Facebook, Instagram and Threads. In late 2025 Meta said it had launched a central support area in its iPhone and Android apps.
Did it work? You’re asked to create a new password and review your security settings, then go back to Fix 1–4.
Fix 6: Prove it’s you: video selfie or ID (and how to tell a genuine request)
When the hacker has changed every contact method, Meta needs another way to confirm you own the account. Meta says its optional video selfie compares your face with your profile pictures and that the facial data is deleted afterwards, whether or not there’s a match.
- During recovery, when asked where to send a code, look for an option such as No longer have access to these? (wording varies).
- Enter a new email address or phone number you can use now.
- Check the request is genuine: a real identity check appears inside the Facebook app or on facebook.com, during a recovery you started. It never arrives as a message from a person, a WhatsApp chat, or a link from a “support agent” in comments.
- If offered, record the video selfie following the on-screen guidance: good light, face visible, no sunglasses or hat.
- If asked for ID, upload it only through Facebook’s own screen, never by email or chat to a person.
- Wait for Facebook to contact you at the new email or number. Avoid submitting again and again; it doesn’t speed things up.
Meta has said the video selfie option has rolled out in stages by region (as of its March 2025 update it was launching in the UK, the EU and South Korea), so not every account sees it. Because it compares against your profile photos, accounts without clear photos of your face may be offered different options.
Did it work? You receive a message or email from Facebook letting you set a new password.
Fix 7: A Page or business assets were taken over
Pages are recovered through the personal account of an admin, so recover your profile first, then follow Meta’s separate help for hacked Pages.
- Recover your personal account first (Paths A–C).
- Open Meta’s help page Recover a hacked Facebook Page you manage (linked in Official help routes) and follow its steps.
- Check the Page’s admin and access list and remove people you don’t recognise.
- If your Page runs ads, review ad accounts and payment methods for charges you didn’t authorise.
Did it work? You’re listed as an admin with full control, and no unknown people have access.
Tell your friends (copy this message)
Send this by text, WhatsApp or another account so friends don’t fall for messages sent in your name:
If the hacker posted or messaged from your account, you can also report those messages so Facebook can remove them.
Check what the hacker may have done
Once you’re back in, look around carefully. Hackers often try to make money from an account or keep a way back in.
| Check | Where to look (names vary) | Why |
|---|---|---|
| Contact details | Facebook security settings (Accounts Centre in recent versions) | Remove any email or phone that isn’t yours |
| Where you’re logged in | Meta calls it the Where you’re logged in section of your Settings | Select any device or location you don’t recognise and log it out |
| Two-factor methods | Two-factor authentication settings | A hacker may add their own phone or authenticator |
| Apps and websites | Settings, apps and websites logged in with Facebook | Remove apps you don’t recognise |
| Posts, messages, Marketplace | Your profile, Messenger, Marketplace listings | Delete scam posts and listings; warn people who were contacted |
| Pages, groups and business tools | Pages you manage, Meta Business settings | Remove admins you don’t know |
| Payments and ads | Payment settings, ad account billing, your bank statements | Remove unknown cards; dispute charges with your bank |
| Linked accounts | Accounts Centre or linked-accounts settings | A hacker may link their own Instagram or remove yours; unlink anything that isn’t yours |
| Your email account | Your email provider’s security page | Look for forwarding rules or filters the hacker added |
Messages you might see (reported wording; yours may differ)
These are the messages as people report seeing them. The exact wording on your screen can differ by app version, language and region, so match the meaning, not every word.
Your email address was changed / Your Facebook password was changed- What it usually means
- Meta says it emails you when an email address or phone number is added or removed or your password is changed. When the email is changed, the message to your previous address includes a special link to reverse the change.
- What to do
- Check the email is genuine, then look for a way to secure your account or reverse the change, and start at facebook.com/hacked. Check the email is genuine first (Recovery scams).
Login from a new device- What it usually means
- Someone, possibly you, logged in from somewhere new.
- What to do
- If it wasn’t you, change your password and log out of other sessions (Fix 1).
Confirm your identity / Upload a video selfie- What it usually means
- Usually Meta’s identity check during a recovery you started.
- What to do
- Complete it only inside Facebook during a recovery you started (Fix 6).
We suspended your account- What it usually means
- Facebook may have acted on activity the hacker carried out.
- What to do
- Meta says you can appeal a suspension within 180 days by logging in. Appeal promptly and explain that the account was hacked — see account disabled or suspended.
How to know it worked
- You can log in with a new password that only you know.
- Only your own email addresses, phone numbers and two-factor methods are on the account.
- The devices list shows only your devices.
- Unknown apps, Page admins and payment methods have been removed.
- Friends confirm they’ve stopped receiving strange messages from you.
- Your email account is also secured with a new password and two-step verification.
Still not working? Your next steps
- Repeat the facebook.com/hacked steps from a device and network you’ve used Facebook on before.
- Check the original email address for Facebook’s security notices; some include a way to secure the account.
- Use Meta’s Account Recovery Hub (external site, opens in a new tab) for the latest official options.
- If your account shows a suspension or disabled notice, follow account disabled or suspended.
- If you paid a “recovery service” or shared a code or ID with someone, follow what to do if you were scammed.
Official help routes
SocialAppFix can’t see or change your account. For account decisions, recovery and appeals, only the platform’s own tools can help. These links go to the official sites.
- Recover a hacked account: facebook.com/hackedFacebook (external site, opens in a new tab)
- Meta Account Recovery HubMeta (external site, opens in a new tab)
- Recover your Facebook account if you were hackedFacebook Help Center (external site, opens in a new tab)
- Recover a hacked Facebook Page you manageFacebook Help Center (external site, opens in a new tab)
- Check if an email is really from FacebookFacebook Help Center (external site, opens in a new tab)
Helping someone else, or is it a fake account?
- Helping a parent, partner or friend? Meta says they should try the facebook.com/hacked steps on a device they’ve used to log in to Facebook before — so do it on their phone or computer, not yours. Meta has a help page about helping someone else with a hacked account (external site, opens in a new tab).
- Someone made a fake profile pretending to be you (but your own account is fine)? That’s an imposter account, not a hack. Use Meta’s page on imposter accounts (external site, opens in a new tab) to report it.
- A Page you manage was taken over? Use Meta’s guide to recovering a hacked Page (external site, opens in a new tab).
Frequently asked questions
How long does it take to recover a hacked Facebook account?
Meta doesn’t publish a fixed timeframe. Recovery can be quick if you still have your email or phone; identity reviews can take longer. Meta reported in late 2025 that its hacked-account recovery success had improved in the US and Canada.
Can I call Facebook to recover my hacked account?
Be very careful with any phone number claiming to be Facebook support; fake numbers are a common scam. Meta has a help page about phone support availability. Use facebook.com/hacked and the tools inside Facebook.
Should I pay someone who says they can recover my account?
No. Nobody outside Meta can access its systems, and Meta’s recovery tools are free. People who charge, or ask for your codes or ID, are scammers.
The hacker turned on two-factor authentication. Can I still get back in?
Use facebook.com/hacked and the identity options Facebook shows, such as giving a new email or phone and confirming your identity. Once in, remove their two-factor method and add your own.
Will my friends know I was hacked?
Only if the hacker contacted them or posted publicly. Tell them yourself using the template above so they don’t fall for scam messages.
How do I stop it happening again?
Use a unique password, turn on two-factor authentication (an authenticator app or passkey is stronger than SMS), save recovery codes, keep your contact details current, and never type your password into a page you reached from a link.
Did this solve your problem?
Your answer stays in your browser — nothing is sent or stored. The “tell us” link opens your own email app.
Out of date or didn’t work? Email us — never include passwords or codes.
Sources and how we checked this guide
We base steps on the platforms’ own help pages and the phone makers’ official guides. Menu names change often and can differ by device, app version and region. Where a platform page could not be independently read, we link it so you can check the current wording yourself.
- Change or reset your Facebook password (external site, opens in a new tab)
- Recover your Facebook account if you can’t access your account email address or mobile phone number (external site, opens in a new tab)
- Recover your Facebook account if you were hacked (external site, opens in a new tab)
- Imposter accounts (external site, opens in a new tab)
- Help someone else with a hacked account (external site, opens in a new tab)
- Where you’re logged in (external site, opens in a new tab)
- Keep your Facebook account secure (external site, opens in a new tab)
- Recover your Facebook account if you can’t log in (external site, opens in a new tab)
- Recover a hacked account (external site, opens in a new tab)
- My personal Facebook account is suspended or disabled (external site, opens in a new tab)
- facebook.com/hacked – Recover a hacked account (external site, opens in a new tab)
- Account Recovery Hub – Facebook, Instagram, Threads (external site, opens in a new tab)
- Recover your Facebook account if you were hacked (external site, opens in a new tab)
- Recover a hacked Facebook Page you manage (external site, opens in a new tab)
- Check if an email is really from Facebook (external site, opens in a new tab)
- Protect yourself from phishing on Facebook (external site, opens in a new tab)
- Phone support availability on Facebook and other Meta Company Products (external site, opens in a new tab)
- Making it Easier to Access Account Support on Facebook and Instagram (Dec 2025, updated Mar 2026) (external site, opens in a new tab)
- Testing New Ways to Combat Scams and Help Restore Access to Compromised Accounts (2024, updated 2025) (external site, opens in a new tab)
- Cybersecurity Awareness Month: Helping Older Adults Avoid Online Scams (Oct 2025) (external site, opens in a new tab)
Last reviewed 20 October 2026 by the SocialAppFix editorial team against the sources above. Next scheduled review: 18 January 2027. How we write and review guides.
What changed
- 20 October 2026: Menu position per device confirmed: iPhone from Meta’s iPhone steps (owner-supplied), Android from owner screenshots.
- 20 October 2026: Change password screen fields, password rule and “Log out of other devices” option confirmed from an owner screenshot (Android).
- 20 October 2026: Confirmed Meta’s in-app Change password path.
- 20 October 2026: Added Meta’s official email domains and confirmed the Accounts Centre > Password and security path.
- 20 October 2026: Added Meta’s confirmed list of hacking signs, the reverse-email-change link sent to your previous address, the “Where you’re logged in” settings name, and advice for helping someone else.
- 20 October 2026: Confirmed Meta’s instruction to use facebook.com/hacked from a device you’ve logged in on before.
- 20 October 2026: First published.
- 20 October 2026: Editorial audit corrections applied.
SocialAppFix is an independent guide and is not affiliated with or endorsed by Meta or Facebook. We never ask for passwords, login codes or payment to fix an account.