Facebook account hacked? Go to facebook.com/hacked on a device you have used before, secure it, and follow Facebook's steps if your email or phone was changed.

Quick answer: Go to facebook.com/hacked, the page Facebook's Help Center tells people to use if their account was hacked, and use a phone or computer you have logged into Facebook with before if you can. Follow the on-screen steps. If you can still log in, change your password, log out devices you do not recognise, remove apps you did not add and turn on two-factor authentication.

facebook.com/hackedThe recovery page Facebook names for hacked accounts, best used on a device you have used before

180 daysThe appeal window Facebook states for a suspended account before it is permanently disabled (it says the period varies by region)

10 codesRecovery login codes Facebook says you can get for two-factor authentication, for when you cannot use your phone

When a Facebook account is taken over, Facebook warns that the attacker may use it to send spam or inappropriate content to your friends and family. Facebook has an official recovery route, and this guide follows Facebook's own Help Center pages and tells you plainly where they stop.

What to do in 3 steps

Open facebook.com/hacked on a device you have used to log into Facebook before (your own phone or computer, or an old one you still have). Follow the prompts to find your account and secure it.
Check the email on your account. If Facebook emailed you that your email address was changed, it also sent a message with a special link to the previous email address. Facebook says you can click that link to reverse the change and secure the account.
Log out devices you do not recognise and change your password, as soon as you can get in (details below).

If you can still log in: secure it now

Change your password. Facebook's steps (written for the web): click your profile picture, then Settings & privacy, then Settings, then Accounts Center, then Password and security, then Change password. Use one you do not use anywhere else. Facebook says you can only reset a password a limited number of times a day, and if you hit that limit you wait 24 hours.
Log out other devices. In Accounts Center, open Password and security, then Where you're logged in, choose your account, then Select devices to log out. You can select several sessions or all of them. Facebook says that if someone else is logged in, you should log out and then secure the account by changing your password.
Remove apps you did not add. Go to Settings & privacy, then Settings, then Apps and websites, and click Remove next to any app or game you do not want.
Turn on two-factor authentication. In Accounts Center choose Password and security, then Two-factor authentication, pick your account and a method: a security key, login codes from an authentication app, or text message (SMS) codes. Facebook also offers passkeys, which it describes as safer than passwords because they are less vulnerable to phishing.

Facebook says it is gradually moving people to Meta Accounts, so you may see Accounts Center or Meta Account settings, and menu names can differ between web, iPhone and Android. If what you see is different, follow the on-screen prompts.

Facebook lists these signs of a hack: a changed profile picture, posts or messages you did not write, trouble logging in, an email or alert saying a login, new email, new phone number or password change was not you, or an unfamiliar device or place under Where you're logged in.

If you are locked out but still have your email or phone

Use Forgot password? on the login screen, enter the email address, phone number, full name or username on the account, and follow the instructions. Facebook sends a reset link or code. If it does not arrive, check spam, check you have signal, and wait a few minutes before asking again. Facebook says that if you have two-factor authentication on, you cannot use the same phone number to reset your password and may need to add a different number or email.

If Facebook locked the account for security, it will tell you by email or when you log in. Open Facebook, choose Get started and follow the steps; you may be asked to confirm your identity.

If the attacker changed your email, phone or password

Start at facebook.com/hacked on a device you have used before. Facebook says this may work even if you are not sure the account was hacked. If you cannot get in with the email or phone on the account, Facebook's page suggests:

Try other email addresses or phone numbers that might be on the account, and include the country code on phone numbers.
Contact your email provider if the email account itself is the problem. If your email is Gmail, see our guide to recovering a hacked Gmail account.
On a device you have used to log in before, go to facebook.com/login/identify and enter any email, phone number, name or username you think is on the account.
Select No longer have access to these? (it may say Forgot account? or Recover) and follow the prompts. Facebook says the new contact details you give must not have been used for your Facebook account before.
Complete the security checks that prove the account is yours, then set a new password.

Facebook may ask you to confirm your identity with an ID. It says you can send one government ID showing your name and date of birth, or your name and a photo. If you have none, you can send two non-government documents that include your name (matching your profile name), at least one showing a date of birth or photo. Facebook says an ID photo can be rejected if it is blurry, not well lit, missing information, not fully in frame, or a picture of a screenshot or photocopy. Meta says it has added an optional selfie video to its recovery methods, but Facebook's help page on video selfie verification showed us only that the feature "isn't currently available in your country", so whether you are offered it depends on where you are.

If the account is suspended or disabled

Facebook says it may suspend an account that may not follow its Community Standards, and that you can appeal within 180 days by logging in and following the prompts (it also says the appeal period varies by region). If you do not appeal in time, or the appeal fails, it says the account is permanently disabled and you cannot ask for another review. You will see "We suspended your account" or "We disabled your account" when you log in, and Facebook says it will email you. It also says it may disable an account without suspending it first in cases of severe or time-sensitive violations.

After you are back in

Check recent posts, comments and messages for anything you did not send, and delete it.
Check any payment methods, business tools or Pages linked to the account. If a Page you manage was hacked, Facebook has a separate Help Center page for recovering it.
Tell friends and family the account was hacked, so they ignore odd messages or links in your name, especially requests for money or codes.
Secure your email account as well, as Facebook sends reset links there.

Warning: fake recovery services and fake support messages

Never pay anyone who offers to "recover" your account, and do not hire a "recovery expert". Recovery goes through Facebook's own pages only. Facebook says Meta representatives will never ask for money, passwords or payment details over chat or email, and it will never ask for your password in an email. It lists the email domains that real Meta messages come from (facebook.com, facebookmail.com, fb.com, instagram.com, meta.com and metamail.com) and warns you to watch for misspelled lookalikes, and for threats such as "do this now or we'll close your account". Facebook also warns that some phishing links have arrived in notifications from its real facebookmail.com domain, so a genuine-looking sender is not proof on its own. Meta says phone numbers claiming to be Meta customer support are potentially scams. You can check whether Facebook really emailed you under Accounts Center, Password and security, then Security checks, then Recent emails. People who lost money to a fake "recovery" offer can read The Second Scam, our guide to fund-recovery fraud.

If someone is threatening you with images

If the person who has your account threatens to share private images unless you pay, do not pay and do not reply. Read our sextortion and blackmail guide and report it to the police.

If this is a child's account

If a child or teenager is locked out, sit with them and help with the steps. Facebook says that when you help someone else, they should use a device they have logged in from before, so use theirs. Do not blame them: these attacks catch adults too.

What Facebook does not promise

The Help Center pages we read do not promise that every account can be recovered and do not give a time frame for a recovery decision. Meta says it does not have a general public phone number for customer service (it notes it may offer specialised phone support in some places or for some products). The pages point to facebook.com/hacked and to the Account Recovery & Support Hub on meta.com.

Help Center pages also offer a chat with the Meta AI support assistant. Facebook says you need to be logged in to use it from the Help Center, and Meta says it has started offering it to people who cannot log in only in select cases in the US and Canada, so do not count on it if you are locked out.

We checked the steps against Facebook's own help pages on 26 October 2026; menus change, so follow the on-screen prompts if they differ. The recovery page itself is an interactive tool, so we describe it only as the Help Center does.

Sources

If you have been targeted, you are not alone. See our country-by-country cybercrime help hub for step-by-step reporting and recovery guides.

Hacked Facebook Account: How to Recover It (2026)