How to Recover a Hacked Facebook Account Step by Step

Last updated: October 8, 2026

Finding out that your Facebook account has been hacked is stressful. Maybe your password no longer works, your email address was changed, or friends are receiving strange messages and posts from you. The good news is that Facebook has an official process for regaining access, and acting quickly improves your chances.

Facebook regularly updates its menus and recovery tools, so the exact wording on your screen may differ from what is written here. Meta is also gradually moving people from "Accounts Center" to "Meta Account" settings, so you may see either name. We describe each step generally, and you should follow the on-screen instructions from Facebook itself.

Signs Your Facebook Account Has Been Hacked

• You cannot log in even though you are sure the password is correct.
• You get emails from Facebook saying your email, password or phone number was changed.
• There are posts, messages, friend requests or ads you did not create.
• Your name, birthday or profile details changed.
• You see logins from unfamiliar devices or places.
• You are unexpectedly added as an admin of pages or groups, or someone else is removed.

If several of these apply, treat it as a real compromise and start with the steps below.

Before You Start: Use Trusted Devices and Official Pages

Facebook's own Recover a Hacked Account help page says to visit facebook.com/hacked on a device you've used to log into Facebook before. A network you normally use, such as your home Wi-Fi, also helps. Facebook uses these familiar signals to help decide whether you are the real owner. Always go to Facebook by typing the address yourself or using your usual app. Fake "Facebook Support" pages and messages are a common trap.

Which Path Fits Your Situation?

Your situation	Where to start
You can still log in	Step 1: change password, log out unknown sessions, turn on 2FA
Locked out, but you still control your email or phone	Step 2: facebook.com/hacked or "Forgot password"
Locked out, and the hacker changed your email or phone	Step 3: old-email notice, "No longer have access?", identity check
A Facebook Page you manage was taken over	"Recovering a Hacked Facebook Page" section below
A friend or relative was hacked	"Helping Someone Else" section below

Step 1: If You Can Still Log In, Secure the Account First

1. Change your password to a new, unique one that you do not use anywhere else.
2. Review where you are logged in. Facebook's help page on logging out of Facebook on another device describes the current path: Accounts Center → Password and security → Where you're logged in. Each entry shows a date, time, location and device type. Use Select devices to log out to end sessions you do not recognize, or Select all to end them all. Menu names may vary.
3. Check the email addresses and phone numbers on the account, and remove any that are not yours.
4. Turn on two-factor authentication (see Step 5).

Step 2: If You Cannot Log In, Use Facebook's Official Recovery Pages

Facebook has a page for hacked and compromised accounts, at facebook.com/hacked. It walks you through identifying your account and describing the problem. There is also the "Forgot password" or "Find your account" link on the login page. Steps you may be asked to complete:

1. Identify your account. Enter the email address, phone number, or name and username you used.
2. Choose how to get a code. If you still control the email or phone number on file, Facebook may send a verification code there.
3. Enter the code and set a new password. Choose a strong, unique one.
4. Follow the security prompts. Facebook may ask you to review recent logins and confirm which are yours.

Facebook's hacked-account help page also lists a "Chat with Meta AI support assistant" option under "Other ways to get help". If you use it, open it only from Facebook's own Help Center, never from a link someone sends you.

Step 3: If the Hacker Changed Your Email or Phone Number

This is the hardest situation, because the codes go to the attacker. Here is what generally helps:

• Check your old email inbox. Facebook usually sends a notice to your previous email address when it is changed, often with a link to undo or secure the account. Search your inbox and spam folder for messages from Facebook about a change. Only trust the link if it comes from the real Facebook sender, and be careful, since scammers copy these emails.
• Try "No longer have access to these?" On the recovery screens, there is often an option along these lines. It lets you give a new email or phone number and start another verification process. Facebook's help center has a dedicated path for recovering an account when you can't access the email address or mobile number on it.
• Complete any identity checks. In some cases Facebook may ask you to confirm who you are, for example by uploading an ID or taking a video selfie. Availability depends on your account and country. Only do this through Facebook's official screens, and never send your ID to a stranger or a chat contact.

How the Video Selfie Check Works

Meta's help page on how it uses facial recognition to verify you explains the process. If you agree to use it, an automated system compares your video selfie or ID photo with the photos on your profile, including previous Facebook profile photos. Meta says that if there is a match, it usually takes about one minute to verify you. It says the facial data created for the comparison is deleted as soon as the comparison is finished, whether or not it matches. If the system cannot confirm a match, or you choose not to use facial recognition, your selfie or ID may go to manual review, or you may be asked to verify another way.

Recovery can take time. If one attempt fails, wait, then try again from a trusted device without repeatedly guessing passwords.

Step 4: Clean Up After You Regain Access

Review activity and posts

Check your recent posts, messages and Activity Log. Delete anything you did not write. Tell your friends that the messages were not from you, and warn them not to click links.

Check connected apps and websites

Open the settings for apps and websites connected to your Facebook account and remove any you do not know or no longer use. Our guide on checking which devices and apps have access to your account explains what to look for.

Check ads, payment methods and ad accounts

Stolen accounts are sometimes used to run ads, because they come with a real history and sometimes a saved card. Look for:

• Payment methods (cards or PayPal) you did not add, in your Facebook payment settings and Ads Manager. Remove them.
• Ad campaigns, boosted posts or ad accounts you did not create, and charges you do not recognize.
• Admins or people with access to your Pages and ad accounts whom you do not know. Remove them.

If you see unfamiliar charges, contact your bank or card issuer using the number on the back of the card, as well as reporting them to Facebook.

Review your profile information

Confirm that your name, birthday, email and phone number are correct.

Step 5: Turn On Two-Factor Authentication

In Facebook's security settings, look for two-factor authentication. You can typically choose an authentication app, a text message code, or a physical security key, depending on your account. An authentication app or security key is generally more resistant to SIM-swap attacks than SMS. Save your recovery codes in a safe place. Our guide "Two-Factor Authentication Explained" compares the options, and our Google Authenticator setup guide shows how to back up app codes so a lost phone does not lock you out.

Apps like Google Authenticator or Authy generate the codes, and password managers such as Bitwarden, Proton Pass or 1Password can store your new unique password. Our free password manager comparison can help you choose.

Step 6: Protect the Email Account Linked to Facebook

If your Facebook was hacked, your email may be at risk too. Change your email password, enable 2FA there, and check for forwarding rules. Our article on telling whether your email has been hacked covers those checks, and if you use Gmail, see how to recover a hacked Gmail or Google account. Also update the password on any other site where you used the same password. Our guide to creating a strong password you can remember can help.

Step 7: Scan Your Device

If you clicked a strange link or installed a suspicious app or browser extension around the time of the hack, run a security scan and remove unknown extensions. Update your phone, computer and browser. A reputable anti-malware program can be a helpful second check.

Recovering a Hacked Facebook Page You Manage

Facebook's hacked-account help page lists "Recover a hacked Facebook Page you manage" as its own path. Start by securing your personal account using the steps above, because Pages are managed through personal profiles. Then follow that official path from Facebook's Help Center, review who has access to the Page, and remove anyone you do not recognize. If the Page runs ads, check its ad account and payment methods as described in Step 4.

Helping Someone Else Recover Their Account

The same help page also has a "Help someone else recover their account" option. If a friend or relative was hacked, you can point them to it, or open it with them on their own trusted device. Do not ask them to share their password or codes with you, and warn other friends not to respond to money requests from the hacked profile. If the hacker created a separate fake profile instead, Facebook's help center explains how to report an impostor account.

Warning: Recovery Scams

People who have lost accounts are common targets for "recovery experts" on social media, in comments or by direct message. They may claim to be Facebook staff, ask for payment, or ask for verification codes. Facebook does not sell account recovery through random chat contacts. Never share codes, passwords or ID with anyone who contacted you first.

How Hackers Usually Get In

• Phishing messages that copy Facebook login pages.
• Reused passwords leaked from another website.
• Fake "you violated copyright" or "your page will be deleted" messages containing links.
• Malicious apps or browser extensions.
• Friends' hacked accounts sending trusted-looking links.

Avoiding these habits, and using 2FA, removes most of the risk.

Frequently Asked Questions

How long does Facebook account recovery take?

It varies. Some people regain access within minutes using a code sent to their email, while cases involving changed contact details or identity checks can take longer. Meta says a matched video selfie usually takes about a minute to verify, but manual review takes longer.

Can I recover an account without email or phone access?

Sometimes. Facebook may offer alternative verification options, but it is not guaranteed.

Will I lose my photos and messages?

If you regain access, your content usually remains unless the attacker deleted it. Consider downloading a copy of your information through Facebook's settings once you are back in.

Should I report the hack to Facebook?

Yes. Use the official hacked-account page and report fake profiles or scam messages sent from your account.

Can I be hacked again?

Yes, especially if the original cause, such as a reused password or infected device, was not fixed. That is why the cleanup steps matter.

Related Guides

• How to Tell If Your Email Has Been Hacked and What to Do
• How to Recover a Hacked Instagram Account
• Two-Factor Authentication: SMS vs App vs Security Key
• How to Check Which Devices Have Access to Your Account
• How to Create a Strong Password You Can Actually Remember

Conclusion

To recover a hacked Facebook account, use Facebook's official recovery pages, work from a device you have used before, and check old email for change notices. Once you are back in, change your password, log out unknown sessions under "Where you're logged in", remove unfamiliar apps, admins and payment methods, and enable 2FA. Avoid anyone promising paid recovery. Patience and careful steps will serve you better than speed.

Safe Sign In is not affiliated with Facebook or Meta.