What to Do If Your Facebook Account Gets Hacked: Recovery Guide

Discovering that your Facebook account has been hacked feels personal. Someone may be messaging your friends, changing your photos, or locking you out entirely. In that moment, it is easy to panic and click the first recovery link you find, which can make things worse.

Take a breath. Many hacked Facebook accounts can be recovered if you act methodically and use only Facebook’s official recovery tools. The steps below are ordered by urgency, so you protect your friends and money first, then regain control.

This guide covers what to do if you can still log in, what to do if you are locked out, and how to secure the account properly once you get it back so it does not happen again.

Quick Answer

If your Facebook account is hacked, go directly to facebook.com/hacked from a trusted device and follow the official recovery steps.

Change your password, log out of all sessions, turn on two-factor authentication, and warn your friends not to trust strange messages from you.

If you are locked out, use your recovery email or phone, and also secure that email account immediately.

First Signs Your Account Has Been Compromised

Sometimes the first clue comes from friends. They may ask why you sent a strange link, a money request, or a post you never wrote. Other signs include password changes you did not make, logins from places you have never visited, or new email addresses added to your account.

You might also notice messages sent from your account that you do not remember, friend requests sent to strangers, or adverts and Page roles you never approved. For business users, unauthorised ad spending is a serious warning sign that needs immediate action.

If any of this sounds familiar, do not wait to see if it resolves itself. The longer an attacker stays in the account, the more changes they can make to block your recovery.

If You Can Still Log In, Move Fast

Being able to log in is an advantage. Use a device you trust, preferably one you have used for Facebook before, and work through the securing steps in the next section without delay. Do not log out until you have changed the key settings.

Check your email inbox for security alerts from Facebook as well. Those messages often include a link to secure the account or reverse a change. Only trust messages that genuinely come from Facebook and, when in doubt, navigate to the settings yourself instead of using an email link.

If the attacker is actively changing things while you are logged in, prioritise changing your password and logging out all other sessions. That cuts off their access in one action.

Recovery Steps If You Are Locked Out

If your password no longer works, use only official routes. Search results and social media posts are full of fake recovery services that charge money and steal more data.

1. Go to the official hacked page. Type facebook.com/hacked directly into your browser on a trusted device. Select the option that says your account is compromised and follow the prompts.
2. Try the forgotten password flow. On the login page, choose Forgotten password and enter the email or mobile number linked to your account. Use a code sent to that contact method to reset your password.
3. Secure your email first if it is also compromised. If you cannot access your recovery email, recover that account through its provider before continuing. Facebook recovery depends on it.
4. Identify your account another way. If your email and phone were changed, follow Facebook’s identity steps and try from a device and network you have used before, which helps Facebook recognise you.
5. Check for trusted contacts or legacy options if offered. Some accounts may see additional recovery choices during the process. Follow the on-screen instructions carefully and do not pay any third party who promises faster access.

Facebook’s dedicated official hacked account recovery page is the correct starting point, and the wider Facebook Help Center explains identity verification if you are asked for it. Bookmark those addresses rather than searching again under stress.

How to Secure the Account Once You Are Back In

Getting back in is only half the job. Attackers often leave behind extra access, such as an unknown email address, a linked app, or an active session. Clean everything in one sitting.

1. Change your password to something unique. Choose a long password you have never used elsewhere and store it in a password manager. Do not reuse your email password.
2. Log out of all sessions. In Settings, go to Security and login, review where you are logged in, and choose Log Out Of All Sessions.
3. Turn on two-factor authentication. In the same security section, set up two-factor authentication using an authenticator app or security key for the strongest protection.
4. Review your contact details. Remove any email addresses or phone numbers you do not recognise, and confirm your primary recovery email is correct.
5. Check apps, Pages, and ad accounts. Remove suspicious connected apps, review Page admin roles, and inspect Ads Manager for campaigns or payment methods you did not add.
6. Turn on login alerts. Enable alerts for unrecognised logins so you hear about the next attempt immediately by notification and email.

After this clean-up, review your recent posts, messages, and friend activity for anything the attacker sent. Delete fraudulent posts and let affected contacts know what happened. For broader recovery habits, our guide to recovering and protecting hacked online accounts covers the same session and password checks for your other services.

Protect Your Friends and Your Money

Warn people quickly. Post from your recovered account, and if you are still locked out, ask a trusted friend to post on your behalf explaining that your account was hacked and that money or link requests were not from you.

If anyone sent money because of a message from your hacked account, tell them to contact their bank or payment provider immediately and report the fraud. Speed matters for payment recalls, even though recovery is never guaranteed.

If your Facebook account is linked to business advertising, contact your bank about any unfamiliar charges and remove unknown payment methods inside Ads Manager once you regain access.

Common Mistakes During Recovery

The most damaging mistake is paying a stranger on Instagram, Telegram, or a random website who claims they can hack your account back. These services are scams. They take your money, may steal more accounts, and cannot override Facebook’s systems.

Another mistake is creating a brand-new account and abandoning the old one without reporting it. The hacked profile can continue scamming your friends under your name and photo. Always report and attempt recovery of the original account, even if you also make a temporary profile to warn people.

People also change the Facebook password but forget their email password. If the attacker controls your email, they can simply reset Facebook again. Secure email with a unique password and two-factor authentication on the same day.

Finally, avoid rushing through identity steps with blurry or cropped documents if Facebook requests verification. Follow the instructions exactly and submit clear images, because repeated failed submissions can slow the process.

Conclusion

A hacked Facebook account is stressful, but a calm, official process gives you the best chance of full recovery. Start at facebook.com/hacked, secure your email, change your password, remove every unknown session and contact detail, and turn on two-factor authentication before you consider the job done.

Then warn your friends, check for financial damage, and apply the same protections to your other major accounts, because attackers often try a recovered password elsewhere. Ten careful minutes of clean-up today can prevent months of impersonation and fraud in your name.

Frequently Asked Questions

How long does Facebook account recovery take?

It varies. If you still have access to your recovery email or phone, it can take minutes. If you need identity verification, it may take several days. Avoid submitting repeated requests unless Facebook asks, as duplicates can confuse the process.

Can I recover my account if the hacker changed my email and password?

Often yes, especially if you start from a familiar device and use facebook.com/hacked promptly. Check your original email inbox for a message about the email change, which sometimes includes a link to reverse it. If that fails, follow Facebook’s identity verification steps.

Should I report my hacked account to the police?

If money was stolen, your identity documents were misused, or threats were made in your name, consider reporting it to your local police and keep screenshots and dates. For most account takeovers, your bank and Facebook’s reporting tools are the urgent first contacts.

Why did my account get hacked in the first place?

Common causes include reusing a password that leaked elsewhere, entering your login on a fake Facebook page, approving a malicious app, or sharing a verification code. Review those possibilities during clean-up so you close the exact door the attacker used.

Will turning on two-factor authentication really prevent this again?

It greatly reduces the risk. With it on, a stolen password alone is not enough to log in from a new device. Use an authenticator app rather than text codes where possible, and keep your recovery methods up to date.