Quick answer
Real account recovery for Facebook, Instagram, X and TikTok happens inside the app or on the platform’s own website, and it’s free. No genuine support agent will contact you first in comments or DMs, ask for your password or a login code, or charge a fee or gift cards. If someone offers to recover your account for money, it’s a scam. Use facebook.com/hacked or Meta’s Account Recovery Hub for Facebook and Instagram, and the official help centres for other apps.
Does this match what you see?
- Someone replies to your public post about being hacked, offering to “recover” it, often with a phone number or WhatsApp link.
- An account or Page with “Meta Support”, “Facebook Help Centre” or a blue tick in its name messages you first.
- A website that looks official lists a “Facebook customer service” phone number.
- Someone claims they are an “ethical hacker” who can get any account back for a fee.
- You get an email saying your account will be deleted unless you “verify” it via a link.
- A friend’s account asks you to send them a code that was “sent to your phone by mistake”.
- Someone asks for photos of your ID, or a video of your face, outside the Facebook app or website.
iPhone & iPadAndroidComputer (browser)
These scams look similar across Facebook, Instagram, WhatsApp, X, TikTok and other platforms. The signs and protective steps apply to all of them.
Why this happens: the possible causes
These are the main kinds of recovery scam. They all exploit urgency: the feeling that you must act right now or lose the account forever.
| Scam | How it looks | The giveaway |
|---|---|---|
| Fake support account | A profile or Page named like “Meta Support” replies to your post or DMs you | Real support doesn’t start conversations in comments or DMs |
| Fake helpline | A “Facebook customer service” number on a website, ad or forum | It asks you to pay, install an app, or read out a code |
| Paid “recovery hacker” | Testimonials, guarantees, a fee upfront | Nobody outside the platform can access its systems |
| Phishing email or text | “Your account will be disabled in 24 hours. Verify now.” | The link goes to a site that isn’t the real domain |
| Code-forwarding trick | A friend’s account asks you to send a code | That code unlocks your account |
| ID or selfie harvesting | Asks for ID photos or a face video by chat or email | Real checks happen inside the app or website only |
| Refund or “recovery of losses” scam | Offers to get back money you already lost, for a fee | A second scam aimed at the same victim |
- Fake support accounts and PagesPossible
In October 2025 Meta reported acting against over 21,000 Pages and accounts pretending to be customer support. They often use logos, blue-tick emojis and names like “Help Centre” to look official.
- Look-alike help pages in search resultsPossible
Scam pages are sometimes hosted on hijacked or free website services and appear in search results for phrases like “Facebook disabled account support”. Their content copies real help pages and adds a phone number or contact form.
- Paid “recovery experts” and hackers for hirePossible
They promise guaranteed recovery for a fee. Even if they’re not outright criminals, they have no special access, and many simply take payment and disappear or ask for more.
- Phishing messages that copy security alertsPossible
Messages warn of copyright strikes, policy violations or imminent deletion and link to a fake login page that captures your password and code.
- Abuse of the real recovery processPossible
Meta has warned that “hackers will keep trying to exploit account recovery tools”, for example by tricking people into sharing codes or starting a recovery for an account that isn’t theirs.
- Follow-up scams after money is lostPossible
Meta has also described scammers posing as officials who can help fraud victims recover their money. People who were scammed once are often targeted again.
Is this message real? A quick test
| Question | Genuine platform support | Likely scam |
|---|---|---|
| Who started the contact? | You, through the app or official website | They contacted you first |
| Where does it happen? | Inside the app or on the official domain | Comments, DMs, WhatsApp, Telegram, phone |
| What do they ask for? | Steps on screen, a code you type in yourself | Your password, a code, ID by chat, remote access |
| Is there a fee? | No, recovery tools are free | Upfront fee, gift cards, crypto, “deposit” |
| Tone | Neutral, factual | Urgent, threatening or too good to be true |
| Guarantees | No guarantee of an outcome | “100% recovery guaranteed” |
Try these 60-second checks first
- Did you start this contact through the official app or website? If someone reached out to you first, treat it as suspicious.
- Is anyone asking for a password, code, ID, remote access or payment? That’s a scam.
- Check the web address of any recovery page: Facebook and Meta recovery pages are on facebook.com or meta.com, and Meta’s emails only come from its own domains such as facebookmail.com and metamail.com (how to check); Instagram on instagram.com, X on x.com, TikTok on tiktok.com. For emails, don’t judge by the sender domain alone (genuine Meta emails can come from other Meta domains): use Meta’s page Check if an email is really from Facebook instead.
- Is the message trying to rush you (“within 24 hours”, “last warning”)? Meta notes that scammers often create “a false sense of urgency or panic”.
How to fix it, step by step
Work through these in order. They start with the quickest, safest checks and only move to steps that sign you out or remove data later.
Fix 1: Use only the official recovery routes
The safest way to avoid a recovery scam is to never need a middleman. Every major platform has its own free recovery tools.
- Facebook: go to facebook.com/hacked or Meta’s Account Recovery Hub (external site, opens in a new tab), or use the help options inside the app. See our hacked Facebook guide. In the Facebook app, ☰ Menu > Help and support also lists a Scam Protection Center and a Meta AI support assistant, both inside Facebook itself, not on an outside site.
- Instagram: use the login help inside the Instagram app or Instagram’s hacked-account help (external site, opens in a new tab).
- X (Twitter): follow X’s compromised account help (external site, opens in a new tab) and its official forms.
- TikTok: use the in-app Report a problem option (Profile > menu > Settings and privacy > Report a problem) or TikTok Support (external site, opens in a new tab).
- Type these addresses yourself or use the app. Don’t trust links in messages or ads.
Did it work? The page address belongs to the platform itself, and you didn’t get there from a link someone sent you.
Fix 2: Check who is really contacting you
Scammers rely on looking official at a glance. A closer look usually gives them away.
- Look at the account name and handle carefully. Extra words, numbers or misspellings (“Meta-Support-Team01”) are red flags.
- Check when the account was created and what else it posts. Fake support accounts are often new, with few genuine posts.
- Remember that genuine support doesn’t reply to your post in the comments offering help.
- Don’t move the conversation to WhatsApp, Telegram or a phone call because someone suggests it.
- Report the account using the platform’s own report button, then block it.
Did it work? You’ve stopped engaging with anyone who contacted you first, and reported them.
Fix 3: Never share a code, even with a friend
A login, reset or two-factor code is the last lock on your account. A common trick is a message from a friend’s hacked account saying a code was “sent to you by mistake”.
- Ignore any request to forward, read out or screenshot a code.
- If a friend’s account asks, contact your friend another way (call or text) to check. Their account is probably hacked.
- If you receive codes you didn’t request, someone may be trying to log in. Change your password when you can, and turn on two-factor authentication.
Did it work? No codes have left your device.
Fix 4: Check whether an email really came from Facebook (Meta’s 3 tests)
Fake security emails are designed to look exactly like real ones. Meta’s help page gives three ways to check — and one rule that settles most cases: Facebook will never ask for your password in an email or send you a password as an attachment.
- Check the sender’s domain. Meta says emails from Facebook or Meta only come from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, metamail.com or global.metamail.com, or their subdomains (such as support.facebook.com or business.fb.com). Look closely for misspelled versions — they’re a common trick.
- Look for the logo. Meta says that in Gmail, Yahoo Mail or Apple Mail, you can trust the email if the Facebook logo appears alongside the email address.
- Confirm Facebook really sent it. Without clicking anything in the email, go to facebook.com/recent_emails/security — or open Facebook and go to your profile picture > Settings and privacy > Settings > Accounts Centre > Password and security > Recent emails (below Security checks).
- Look in the SECURITY tab (security emails from the last year) and the OTHER EMAILS tab (other emails from the last two days). If the email isn’t listed, Facebook didn’t send it.
- Note: Meta says it may hide special links or codes in that list to protect you, so you may need to open your own inbox to see them.
Meta is gradually moving people to Meta Accounts, so you may see Meta Account settings instead of Accounts Centre. Also see Meta’s guide to protecting yourself from phishing (external site, opens in a new tab).
Did it work? The email appears in Recent emails on Facebook — or, if it doesn’t, you’ve deleted it without clicking anything.
Fix 5: Only submit ID or a video selfie inside the official app or website
Meta does use identity checks, including an optional video selfie in some regions (how it works). Scammers ask for the same things to steal your identity.
- Only upload ID or record a selfie when the request appears during a recovery you started in the Facebook or Instagram app or on the official website.
- Never email, DM or WhatsApp ID photos to a person, however official they seem.
- If you already sent ID to a scammer, see already scammed below.
Did it work? Any identity documents you’ve shared went only through the platform’s own upload screen.
Fix 6: Make your account harder to steal
Scammers go for easy targets. Meta recommends two-factor authentication, passkeys and its Security Checkup.
- Use a long, unique password for each account, stored in a password manager.
- Turn on two-factor authentication, ideally with an authenticator app or passkey, and save your recovery codes.
- Keep your email and phone number on the account up to date.
- Run the platform’s security checkup if it offers one.
- Secure the email account linked to your social accounts; it’s the master key for resets.
Did it work? Two-factor authentication is on and your recovery codes are saved somewhere safe.
Someone is pretending to be you
Scammers sometimes copy your name and photos to create a fake profile, then message your friends asking for money or codes. It’s a different problem from a hacked account: your own account is fine, but a copy is out there.
- Report the fake profile using the platform’s own report option (choose impersonation, and that it’s pretending to be you).
- Ask friends to report it too, and warn them by another channel not to send money or codes.
- Check your own account’s privacy settings so fewer of your photos and friends are public.
- If your own account was taken over instead, follow hacked account recovery.
Already paid or shared a code? Do this now
Don’t be embarrassed. These scams are designed to work on stressed, ordinary people. Acting quickly limits the damage.
- Stop all contact with the scammer. Don’t pay any further “fees” they demand, whatever they promise or threaten.
- Secure your accounts: change your password on the affected account and your email, log out of other sessions, and turn on two-factor authentication. If you’re locked out, use the official route (Facebook).
- Contact your bank or card provider straight away if you paid by card or bank transfer. Ask whether the payment can be stopped or disputed.
- If you sent ID documents, keep an eye on your accounts and credit, and consider contacting the organisation that issued the document for advice.
- If you installed an app or gave remote access, uninstall it, and have the device checked or reset.
- Report the scam: report the account or Page on the platform, and report the fraud to your national service (below).
- Keep evidence: screenshots of messages, usernames, phone numbers and payment receipts.
Where to report fraud
- United States: the FTC’s ReportFraud.ftc.gov (external site, opens in a new tab).
- United Kingdom: Action Fraud (external site, opens in a new tab), the national fraud and cyber crime reporting centre.
- Canada: the Canadian Anti-Fraud Centre (external site, opens in a new tab).
- Australia: Scamwatch (external site, opens in a new tab).
- Elsewhere: your national police or consumer-protection fraud reporting service.
Example scam messages (not genuine platform errors)
These are typical scripts, written in our own words. Real scam messages change their wording all the time, so look for the pattern: urgency, a link, or a request for a code, password or money.
Your account will be permanently disabled within 24 hours. Verify now.- What it usually means
- An example of a phishing message designed to rush you into a fake login page.
- What to do
- Don’t click. Open the app yourself and check your notifications and account alerts.
I sent a code to your number by mistake, can you send it back?- What it usually means
- An example of the code-forwarding trick, often sent from a friend’s hacked account.
- What to do
- Don’t send it. Contact your friend another way to warn them.
Meta Support: we can restore your account, contact us on WhatsApp- What it usually means
- An example of a fake support account. Real support doesn’t contact you this way.
- What to do
- Report and block. Use the official routes in Fix 1.
How to know it worked
- You only use recovery tools on the platform’s own app or website.
- You haven’t shared passwords, codes or ID with anyone outside those tools.
- Scam accounts that contacted you have been reported and blocked.
- Two-factor authentication is on for your important accounts and your email.
Still not working? Your next steps
- Go back to the official recovery route for your platform, such as Facebook hacked account recovery or Can’t log in.
- If money was lost, follow up with your bank and the fraud reporting service for your country.
- If someone is impersonating you, report the fake profile using the platform’s reporting tools and ask friends to report it too.
Official help routes
SocialAppFix can’t see or change your account. For account decisions, recovery and appeals, only the platform’s own tools can help. These links go to the official sites.
- Facebook: recover a hacked accountFacebook (external site, opens in a new tab)
- Meta Account Recovery Hub (Facebook, Instagram, Threads)Meta (external site, opens in a new tab)
- Check if an email is really from FacebookFacebook Help Center (external site, opens in a new tab)
- Instagram: if you think your profile was hackedInstagram Help Center (external site, opens in a new tab)
- X: help with a compromised accountX Help Center (external site, opens in a new tab)
- TikTok: report a problemTikTok Support (external site, opens in a new tab)
Frequently asked questions
Is there a phone number for Facebook support?
Be very wary of any number claiming to be Facebook support: fake helplines are a well-known recovery scam. Meta publishes a help page about phone support availability; check it directly on facebook.com rather than trusting numbers from search results or ads.
Can a hacker really recover my account for a fee?
No. Only the platform can restore access to an account, and its recovery tools are free. Paying a “hacker” usually means losing money and sometimes the account a second time.
Are paid account recovery services legitimate?
Some agencies simply fill in the same free forms you can use yourself; others are outright scams. None has special access to Meta or any other platform. Use the official routes first.
Someone with a blue tick says they work for Meta. Can I trust them?
A badge, logo or official-sounding name doesn’t prove anything; scammers copy them. Genuine help doesn’t come from an account contacting you first in comments or DMs.
I gave a scammer my login code. What should I do?
Change your password immediately if you can still log in, log out of other devices, and turn on two-factor authentication. If you’re locked out, start at facebook.com/hacked (or the equivalent for your platform).
How do I report a fake support account?
Use the report option on the profile, Page or message in the app, choose impersonation or scam, then block the account.
Did this solve your problem?
Your answer stays in your browser — nothing is sent or stored. The “tell us” link opens your own email app.
Out of date or didn’t work? Email us — never include passwords or codes.
Sources and how we checked this guide
We base steps on the platforms’ own help pages and the phone makers’ official guides. Menu names change often and can differ by device, app version and region. Where a platform page could not be independently read, we link it so you can check the current wording yourself.
- Cybersecurity Awareness Month: Helping Older Adults Avoid Online Scams (Oct 2025) (external site, opens in a new tab)
- Testing New Ways to Combat Scams and Help Restore Access to Compromised Accounts (2024, updated 2025) (external site, opens in a new tab)
- Making it Easier to Access Account Support on Facebook and Instagram (Dec 2025, updated Mar 2026) (external site, opens in a new tab)
- facebook.com/hacked – Recover a hacked account (external site, opens in a new tab)
- Account Recovery Hub – Facebook, Instagram, Threads (external site, opens in a new tab)
- Check if an email is really from Facebook (external site, opens in a new tab)
- Protect yourself from phishing on Facebook (external site, opens in a new tab)
- Phone support availability on Facebook and other Meta Company Products (external site, opens in a new tab)
- If you think your Instagram profile has been hacked (external site, opens in a new tab)
- Help with my compromised account (external site, opens in a new tab)
- Report a problem (external site, opens in a new tab)
- ReportFraud.ftc.gov (external site, opens in a new tab)
- Action Fraud – report fraud and cyber crime (external site, opens in a new tab)
- Report fraud and cybercrime (external site, opens in a new tab)
- Report a scam (external site, opens in a new tab)
Last reviewed 20 October 2026 by the SocialAppFix editorial team against the sources above. Next scheduled review: 18 January 2027. How we write and review guides.
What changed
- 20 October 2026: Added the in-app Help and support items (Scam Protection Center, Meta AI support assistant) from owner screenshots (Android).
- 20 October 2026: Added Meta’s official email domains, the logo check, the never-asks-for-your-password rule and the Recent emails page (facebook.com/recent_emails/security).
- 20 October 2026: First published.
- 20 October 2026: Editorial audit corrections applied.
SocialAppFix is an independent guide and is not affiliated with or endorsed by any social media platform. We never ask for passwords, login codes or payment to fix an account.