How to Recover a Hacked Facebook Account
If someone takes over your Facebook account, start at Facebook’s hacked-account recovery page, using a device you have logged in on before.
A changed profile photo, messages you did not send or an unfamiliar email address on the account can be signs of a compromise. The immediate job is to regain control and close the routes the intruder may still have.
Start with Facebook’s recovery process
Meta’s hacked-account guidance directs people to facebook.com/hacked. Type that address yourself and, where possible, use a phone or computer you previously used for Facebook.
Follow the checks offered for your account. This is a recovery process, not a promise that every account will be restored or that a reply will arrive within a particular number of hours.
If the password or email has changed
If you still control the email address or phone number attached to the account, use the password-reset option offered by Facebook. If you have lost those too, Meta’s contact-access recovery instructions suggest trying another email address or number already associated with the account and checking whether your email provider can restore access.
The same instructions describe finding the account at facebook.com/login/identify from a familiar device. After finding it, follow the recovery options displayed. Their names can vary, and Facebook may ask for new contact information and checks to establish that the account belongs to you.
Meta also says an email-address change triggers a message to the previous address with a route to reverse it. Check that any message is authentic before using a link. An urgent email demanding a password or verification code deserves scrutiny, even when it appears during a real recovery attempt.
Remove access you did not authorise
Once you can reach the account, set a strong password you do not use elsewhere. Review Where you’re logged in and sign out devices you do not recognise. Check the account’s contact information for changes you did not make.
Meta’s security guidance also recommends reviewing connected apps and their permissions. Remove connections you no longer trust or need. A new password is an important step; the connected services and active sessions deserve attention too.
If the linked email account shows signs of compromise, secure it through the email provider as well. Warn contacts about messages you did not send so they know not to follow those requests.
Media retained from the earlier version
The following media appeared in the earlier article. Interfaces can change; use the current written guidance and linked Meta instructions for the steps that apply to your account.
Add protection without treating it as a guarantee
Enable two-factor authentication and alerts for unfamiliar logins. These add safeguards; they do not make an account impossible to compromise. Keep passwords and recovery codes private, including from anyone who claims they can recover the account for a fee.
Use Facebook’s own recovery flow instead of following unsolicited login links. Our Facebook hub collects account guidance. If the account works but only Marketplace is restricted, use the Marketplace access checks to identify that separate problem.
If you later decide to leave Facebook, first regain control and understand the consequences of deactivation or deletion. An unresolved intrusion should not be mistaken for a normal account-setting choice.
