Facebook account hacked, how to get it back

Your Facebook account is hacked when someone else can post, message, or change the login, or when you can no longer sign in. Open facebook.com/hacked on a phone or computer you have used to log into Facebook before. Facebook’s hacked-account article says that is the path to use. If you are helping someone else, they need to do it on a device they have used before.

Facebook is moving people to Meta Accounts. You may see Accounts Center, or you may see Meta Account settings. The job of each screen is the same. The label in the app may not match this page word for word.

The longer checklist is Social media account hacked. If the password reset never arrives, the mailbox may be the account that was taken. Fix that before you keep requesting links. Use Personal email account hacked.

Messenger Help publishes the same hacked-account article. The login you recover is the Facebook account those chats use.

How to tell

Facebook lists the signs like this.

• The profile picture changed.
• There are posts, comments, or messages you did not write.
• You cannot log in, or two-factor authentication stopped working. Their example is an authentication app that no longer gets you in.
• Facebook tells you someone is trying to log in, or already did, and it was not you.
• Facebook emails you that an email address or a mobile number was added or removed, or that the password changed.
• Where you’re logged in shows a device or a location you do not recognise. You can select that device and log it out.

A second profile that pretends to be you is a different problem. Facebook’s hacked help page points that case to a separate article. The steps below are for the account that is yours.

If you can still log in

Do these in order. The password change and the device logout are two different screens.

Change the password

Facebook’s password article gives this path on a computer.

1. Click your profile picture in the top right, then Settings & privacy.
2. Click Settings.
3. Click Accounts Center and select Password and security. If you do not see Accounts Center, select Password and security.
4. Click Change password, then click the account.
5. Enter the current password and the new one. If you do not remember the current password, select Forgot your password? Facebook may send a confirmation code to your email.

You can reset a password only a certain number of times a day. If two-factor authentication is on, you cannot use the same mobile number that receives those codes to reset the password. You need a different mobile number or an email on the account.

From the login screen, if you are already locked out but the email still works:

1. Click Forgot password?
2. Enter the email, mobile number, full name, or username, then click Search.
3. Follow the screen.

Log out the other devices

Where you’re logged in lists each session with a date, a time, a location, and a device type.

1. Go to Password and security settings.
2. In Accounts Center, click Password and security.
3. Click Where you’re logged in and select the account.
4. Scroll down and click Select devices to log out. You can pick several sessions, or Select all.
5. Click Log out, then confirm. Facebook says that logs those devices out immediately.

A location you do not recognise is not always another person. Facebook’s note on unfamiliar locations says a phone often shows an IP address that is not where you are standing. The location can also be a rough guess. If the line is a phone you still have, leave it. If it is not, log it out and change the password.

Turn on two-factor authentication

Facebook’s two-factor article says a code, or a confirmation, is required when a login comes from a browser or a phone they do not recognise. You can also get alerts about those logins.

1. Click your profile picture, then Settings and privacy, then Settings.
2. Click Accounts Center, then Password and security.
3. Click Two-factor authentication, then the account.
4. Choose a method and follow the screen.

Facebook offers three methods.

• A security key, tapped on a compatible device.
• Login codes from an authentication app.
• Text message codes. You can add a new mobile number, or use one already on the account.

When you turn this on, Facebook may ask you to save the browser. Do that on a computer that is yours. Facebook says not to click Save this browser on a public computer. Private browsing, or a browser that clears history when it closes, can make Facebook ask for a code every time.

Text-message codes fail in a SIM swap, because the texts follow the number. Prefer the authentication app or a security key if you can. If a SIM swap is how this started, read SIM swap, what to do.

After two-factor authentication is on, get the recovery codes. Facebook’s recovery-code article says you get 10 codes, and each code works once, in place of the authenticator code, when you cannot use your phone.

1. Open Accounts Center, then Password and security, then Two-factor authentication, and select the account. You may need to enter the password again.
2. Below How you get login codes, click Additional methods, then Recovery codes.
3. Click Get new codes.
4. Print the codes or write them down. Store them somewhere other than the Facebook account. If you lose them, click Get new codes again.

Put your email and phone back

Open Accounts Center and check the email and the mobile number. If the email on the account changed, search the old inbox. Facebook says they send the previous email a message with a special link. That link reverses the email change and secures the account. Use it before the other person changes more.

Remove apps and business tools

An app that can post or manage a Page is a way back in.

Remove an app or a game like this.

1. Click your profile picture, then Settings & privacy, then Settings.
2. Click Apps and websites in the left menu.
3. Next to the app, click Remove.
4. You can let Facebook tell the app that the login connection was removed. They may offer another way to log in.
5. Click Remove again.

If you connected a loyalty program or a news subscription through that app, remove each connection on its own. After you remove the app, it should stop posting to your timeline. A post that is already there can still be deleted by you. The app may keep information it already stored. Facebook says you can ask the developer to delete that.

Business integrations are the tools that can manage ads, Pages, groups, events, or messages.

1. Click your profile picture, then Settings & privacy, then Settings.
2. Click Business Integrations.
3. Open Active. Select the integration you do not recognise, click Remove, then Remove.

If you have not used a business integration for 90 days, its access to personal information such as your email expires. That expiry does not cut its connection to your Facebook business assets. Integrations with expired permissions stay in the Active list. Removed integrations can no longer manage those assets. They can still hold information you already shared. A removed app can still see your name, your profile picture, your cover photo, and an app user ID that does not include your Facebook account details.

Check Pages you manage

A person in your profile can add themselves to a Page and then remove you. Facebook’s Page article describes that, and it describes a scam that takes a Page through Meta Business Suite.

If you still have the personal account, and you recently lost the Page, submit the Page recovery form. Facebook says they aim to reply by email within a day, and some reviews take longer. They also say this form is the path to use even if you have Meta Verified or another support route. They can act only if they can confirm the Page was compromised.

You can submit the form only while logged in, and only if Facebook can see that you recently lost the Page. If the form is missing, log in first. If you cannot log in, use facebook.com/hacked on your usual device, then come back to the form. If you are helping someone else, they have to submit it from their own login.

After the Page is back, look through the Page and the business portfolio in Meta Business Suite. Undo changes you do not recognise. Facebook then points you at extra protection and at their phishing guidance.

If you cannot log in

Stay on a device that has logged into this account before. Facebook’s article for a missing email or phone says facebook.com/hacked is still the first try, even when you are not sure the account was compromised.

If that fails:

1. Try another email or mobile number you might have added and forgotten.
2. Check the spelling. For a phone number, include the country code. Facebook’s example is +1 for the United States.
3. If the email account itself is locked, ask that email provider to help you back in. Then reset the Facebook password from there.

On a familiar device, if you still cannot get in:

1. Open facebook.com/login/identify.
2. Enter an email or a mobile number. It can be the one you usually use, or any other that might be on the account.
3. If that fails, enter the account name or the username. A friend can open your profile and send you the username from the address bar.
4. Select No longer have access to these? You might see Forgot account? or Recover instead.
5. Follow the prompts. You may have to give a new email or phone. Facebook says that contact must not have been used for this Facebook account before.
6. Finish the checks, then reset the password. Pick one you can remember and someone else cannot guess.

Give them a mailbox only you can open. The address the other person just put on the account is the wrong one to use for the recovery.

Check the email before you click

Facebook’s email page says Facebook will never ask for your password in an email, and will never send a password as an attachment.

Mail from Facebook or Meta comes only from these domains, or a subdomain of them. Their examples of a subdomain are support.facebook.com and business.fb.com.

• fb.com
• facebook.com
• facebookmail.com
• instagram.com
• meta.com
• metamail.com
• global.metamail.com

A misspelling of one of those is someone pretending. In Gmail, Yahoo Mail, or Apple Mail, Facebook says you can trust the message if the Facebook logo appears next to the address.

You can also confirm that Facebook sent it.

1. Go to facebook.com/recent_emails/security, or open your profile picture, Settings & privacy, Settings, Accounts Center, Password and security.
2. Under Security checks, select Recent emails.
3. The SECURITY tab shows security emails from the last year, such as a password-change request. OTHER EMAILS shows other mail from the last two days.

If the message contains a special link or a security code, Facebook may hide that part inside settings. You still need the email inbox to read it. A business account can review status at Meta Business Support Home.

Clean up what they sent

Once you are in, delete posts and comments you did not write. Look through messages and see who was asked for money, a code, or a gift card. Tell those people from a channel that is not this account. If a friend already paid, they should contact their bank. How that dispute works depends on the country and the bank.

Change the password on any other site where you reused this one.

What to leave in place

Two-factor authentication stays on, with an authentication app or a security key if you can use one. The email and the phone number are ones you open. Where you’re logged in shows only your devices. Apps and websites, and Business integrations, show only names you chose. The 10 recovery codes are written down somewhere other than Facebook.

The recovery email has to be a mailbox you still control, with its own second factor. If that mailbox was part of this break-in, finish Personal email account hacked first. Otherwise the next reset goes straight back to the other person.

When the password is new and the device list is yours, open Social media account hacked and do the prepare list for the Facebook account.

Related playbooks

• Social media account hacked. Someone took over your Instagram, Facebook, X, or TikTok and is posting, messaging your friends, or holding it for ransom.
• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.