Facebook Account Hacked: How to Recover It and What to Do First

Start here: which situation are you in?

If your Facebook account was hacked, go to facebook.com/hacked, ideally on a phone or computer you have used to log in to Facebook before. Facebook’s page on recovering a hacked account gives that as the first step for every case, including when you are helping someone else.

What comes after depends on what the hacker managed to change. Find the line that matches yours:

• You can still log in, but something is wrong: posts you did not write, a new profile picture, a login alert from somewhere you have never been. Go to the section on locking the account down.
• You are locked out, but your email or phone still works: facebook.com/hacked and a password reset to that email or phone usually get you back in.
• The hacker changed your email and phone number: you still have a path, explained below, and it depends on a familiar device and possibly on an ID.
• A Page you manage was taken: that has its own form, covered near the end.
• Things were listed, sold or bought in your name on Marketplace: that cleanup has its own section, because it involves other people’s money.

The signs Facebook lists are worth checking even if you are not sure yet: a changed profile picture, posts, comments or messages you did not write, your two-factor method no longer working, and emails saying an email address, phone number or password was changed when you did not change it.

Why the phone or computer you used before matters

Facebook’s recovery works best on a device it already recognizes, so an old phone, your work computer or a family member’s laptop where you once logged in can open a door that a new device cannot. Facebook says this in so many words on its page for people who cannot access the email or phone on the account.

On that familiar device, the steps Facebook describes are:

1. Open your usual browser and type facebook.com/login/identify.
2. Enter any email address or phone number that might be on the account, including old ones you may have forgotten. For a phone number, try adding the country code, which is +1 in the United States.
3. If that fails, enter your name or username. If you do not know your username, a friend can open your profile and send you the web address, which contains it.
4. When the account appears, choose No longer have access to these? It may say Forgot account? or Recover instead.
5. Follow the prompts to confirm the account is yours and then set a new password.

If you have no device where you ever logged in, still try facebook.com/hacked from any browser. Facebook says it may work even if you are not sure the account was compromised.

When the hacker changed your email and phone number

Changing the email is one of the first things a hacker does, and Facebook has a way to undo it: when the email on an account changes, Facebook sends a message to the previous address with a link that reverses the change and secures the account. Look in the inbox you used before, not the new one.

If the link is gone or expired and you cannot reach the old email or phone, the recovery prompts ask for new contact information. Facebook requires that this email or number has never been used on your Facebook account before, so a fresh address you control is the right choice.

You may also be asked to confirm your identity with a document. According to Facebook’s list of IDs it accepts:

• One government ID is enough, such as a driver’s license, passport, national ID card or birth certificate.
• Without a government ID, you can send two non-government documents, such as a student card, library card, employment verification or diploma, and at least one of them needs your date of birth or photo.
• Do not blur or edit the image. Facebook rejects digitally altered photos, but it lets you physically cover information it does not need, such as the ID number, before taking the picture.

Facebook says it stores the ID securely, does not show it on your profile, and suggests deleting the photo of the ID from your phone’s gallery once the upload is done, as explained on its page about what happens to your ID.

Still logged in? Lock the account down now

If you can still get into the account, report it as compromised anyway, then remove the hacker’s access before they change the password. Facebook’s page on being phished says you can report the account as compromised even while you can still log in.

1. Report the account through facebook.com/hacked and follow the prompts.
2. Change the password to one you have never used on another site.
3. Log out of devices you do not recognize. Go to Settings, Accounts Center, Password and security, Where you’re logged in, select the device and log it out.
4. Turn on two-factor authentication in the same Password and security area. Facebook offers a security key, an authentication app or text message codes, and lets you save 10 recovery codes for when your phone is not with you, as its two-factor page explains. Our guide to two-factor methods compares the three.
5. Check your contact information and remove any email or phone number you did not add.
6. Open the activity log from Settings and privacy, and filter by date to find posts, comments, friend requests and messages from the hours the hacker was in. Facebook’s page on the activity log describes the filters.

Then secure the email account connected to Facebook. The FTC explains in its guide to recovering hacked accounts that whoever controls your email can request a password reset for your other accounts, and it recommends running updated security software first, because a harmful program on the device can hand the new password straight back. If you suspect that, the checks for a compromised phone help, and a password manager makes it easier to give each account its own password.

Marketplace listings and group posts made in your name

A hijacked Facebook account comes with your Marketplace profile and your place in local buy and sell groups, where neighbors already recognize your name, and that is what makes it useful to a scammer. Checking what was listed, sold, bought and posted is part of the recovery.

Here is how it can look. The scene is invented, and the scheme is real. Frank, who is 74, gets his account back on a Sunday and finds two things he never wrote: a Marketplace listing for a riding mower at half its usual price and a post in his town’s buy and sell group offering the same mower, “first to send a deposit gets it.” Three people have messaged about it, and one says she already sent 150 dollars through a payment app.

What to check, with the steps from Facebook’s Help Center:

• Your listings. Go to Marketplace, Selling, Your listings, then Options and Delete, as described on Facebook’s page on deleting a listing. A listing with a pending order, a shipping label or a completed sale cannot be deleted, so write those down to report.
• Purchases you did not make. Facebook’s page on unauthorized Marketplace purchases sends you to Marketplace, Buying, Purchased orders, where you select the order and use Contact seller for help, then I have another question.
• Charges on your card. For a Meta Pay charge you do not recognize, go to Orders and payments, then Activity, select the transaction and choose Get Help with this Payment, following Facebook’s page on unrecognized charges. Ad charges go through the Meta Business Help Center instead. Call your card issuer too.
• Group posts and comments. Use the activity log filtered by date, and delete what the hacker wrote.

People who paid a deposit to your account lost that money to the hacker, not to you, and they need to act on their side. Tell them to contact their bank or payment app right away and to follow the FTC’s guide on what to do if you were scammed, which covers each payment method. The FTC’s advice on buying from an online marketplace explains why: payments made outside the marketplace’s own system lose whatever protection the site offers. More on how these sales go wrong is in how to buy and sell on Marketplace without losing money.

Tell your friends and the people who messaged you

Post a short notice and reply to everyone who contacted the account while it was not yours, because the hacker was speaking to them in your name. The FTC recommends telling contacts about the hack and asking them to ignore links and requests for help or money that seem to come from you.

On Facebook, three groups need to hear from you: friends who may have received messages, members of groups where the hacker posted, and anyone who wrote about a Marketplace listing. A notice such as “My account was hacked on Saturday. I am not selling anything and I did not ask anyone for money or a code” covers all three.

Two requests deserve a direct warning. The first is money for an emergency, a common story when someone borrows a trusted name, as described in how impostor scams work. The second is a code. Scammers on Marketplace ask sellers for a Google Voice verification code to “prove they are real,” as the FTC describes in its alert on the Google Voice code scam, and Facebook’s own Marketplace scam page lists requests for verification codes as a sign of a scam. Nobody who is really you needs a code from them.

If a Facebook Page you manage was hacked

A Page has its own recovery form, separate from the personal account. Facebook’s page on recovering a hacked Page says the form is the fastest way, even for people with Meta Verified, and that Facebook aims to reply within a day, although some reviews take longer.

The form only works if you are logged in to your personal account and recently lost access to the Page. If you cannot log in at all, recover the personal account first through facebook.com/hacked. Facebook also notes it can only act when it can confirm the Page was compromised.

After you get the Page back, go through the Page and its business portfolio and undo any changes you do not recognize. If Facebook locked your personal account for security, open Facebook and follow the prompts to unlock it, and consider Advanced Protection, one of the steps Facebook suggests after a Page is recovered.

Report it, and ignore anyone selling recovery

Report the takeover to the FBI’s Internet Crime Complaint Center at IC3.gov if money moved or was requested in your name. Its page on account takeover fraud asks you to use the words “account takeover” in the description, to contact your bank as soon as you notice fraud, and to reset every password that may have been exposed. Report the scam to the FTC at ReportFraud.ftc.gov as well, and if your personal information was used to open accounts, IdentityTheft.gov builds a recovery plan.

Be wary of anyone who offers to get your account back for a fee, in comments, in messages or through ads. The FTC’s page on recovery scams says people who were just scammed are targeted again by someone promising to fix it for an upfront payment, and money paid to them is usually lost as well. The IC3 also warns that criminals buy search ads that imitate real companies, so a support number found at the top of a search result is not proof of anything. The official route stays the same: facebook.com/hacked, with the Help Center’s AI support chat for questions along the way.

Reports do not bring money back on their own. Banks and investigators use them as the record of what happened, and a buyer who paid a deposit has the best chance when their own bank hears about it the same day.

Hacked Facebook account FAQ