Facebook Account Hacked? A Step-by-Step Recovery Plan

Last Updated on September 10, 2026

Facebook recovery steps checked 29 July 2026. Meta changes menus frequently.

A hacked Facebook account can be used to impersonate you, ask friends for money, run advertisements or reset other accounts. Move quickly, but do not panic and do not trust a stranger who claims to offer paid account recovery.

First, use the genuine recovery route

1. On a phone or computer you have previously used for Facebook, type facebook.com/hacked into the browser yourself.
2. Follow Facebook’s prompts to identify the account and secure it.
3. If you can still log in, change the password immediately and review where the account is logged in.
4. If you cannot access the email address or phone number, use the recovery options shown by Facebook. Do not pay someone on social media to bypass them.

A familiar device, browser and location can help Facebook recognise you. Avoid repeated frantic attempts from several new devices because that can make a difficult recovery look even more suspicious.

Secure your email account at the same time

Email is often the master key. Change the email password from a clean, updated device, sign out unknown sessions and turn on multifactor authentication. Check forwarding rules, recovery addresses and deleted messages. If the same password was used elsewhere, change those accounts too.

If you are still logged in

• Open Accounts Center, then Password and security.
• Change the password to a unique one.
• Review recent login activity and sign out devices you do not recognise.
• Check the email addresses and phone numbers attached to the account.
• Turn on two-factor authentication, preferably with an authenticator app or passkey when available.
• Generate and store recovery codes safely.
• Review connected apps, Pages, ad accounts and payment methods.

Check what the intruder changed

Warn friends without spreading another scam

Contact close friends through another method, such as a phone call, text message or email. Tell them not to trust recent requests from the account and not to send money or codes. If the hacker posted a fake emergency, a short correction is enough once control returns.

If money or identity information was involved

• Contact the bank or card provider using the number on the card or official website.
• Save screenshots, transaction details, dates and usernames.
• Report fraud to the relevant national service, such as Scamwatch in Australia or ReportFraud.ftc.gov in the United States.
• Consider a credit report alert or freeze if identity information was exposed.
• Report threats, extortion or immediate danger to local police.

Avoid recovery scammers

Criminals search public posts for people asking Meta for help. They then recommend an “expert” on Instagram, Telegram or WhatsApp who supposedly has an inside contact. Meta does not require payment in cryptocurrency, gift cards or remote computer access to restore an ordinary account. Never send identity documents through an unofficial chat.

After recovery

1. Use a new unique password stored in a password manager.
2. Turn on strong multifactor authentication and save recovery codes.
3. Remove unfamiliar sessions, apps, administrators and payment methods.
4. Check email security and other accounts that reused the old password.
5. Tell friends the account is back under your control.
6. Review privacy settings and limit the personal details visible publicly.

If recovery does not work immediately

Use Facebook’s Help Center and Account Recovery pages, and keep a record of the steps taken. Interface options can differ by device and account. Be patient with legitimate verification, but remain suspicious of anyone who moves the conversation away from Facebook’s official pages or asks for payment.

Special problems that need separate attention

The hacker changed your name or birthday

Complete the main recovery first, then use Facebook’s account and profile settings to correct personal details. If Facebook requests identity confirmation, follow only the instructions shown inside the official Facebook site or app. Check the browser address before uploading any document.

A Page or business account was taken over

Personal-account recovery may not automatically restore a Page, advertising account or business portfolio. Review administrators, partners, payment methods and recent campaigns. Meta maintains a separate hacked-Page recovery route. Other administrators should secure their own accounts before access is restored.

The account was disabled after the hacker used it

A compromised account may be disabled because the intruder posted prohibited content. Use the review or appeal option presented by Facebook and explain that the account was compromised. Preserve security emails and screenshots that show unfamiliar access.

Build a recovery file before the next incident

Record the account email, recovery phone, approximate creation date and names of Pages you manage. Store Facebook recovery codes securely and ensure your email account has its own recovery plan. Do not store the Facebook password in the same unprotected document. A small amount of preparation can turn a future crisis into an inconvenient morning rather than a lost week.

The most important order is simple: use the official recovery page, secure email, remove the intruder’s access, protect linked accounts and warn friends. Doing those jobs calmly beats clicking every urgent-looking result on Google, which is how one compromised account occasionally acquires a companion.

FAQ: Hacked Facebook Account

How Long Does Facebook Account Recovery Usually Take?

It varies. Some people regain access in minutes if their email and phone number are still attached and working. If contact details were changed, recovery can take longer, especially if Facebook asks for extra verification. If you’re stuck, keep using the same device and method instead of retrying dozens of times.

Should I Tell My Friends And Family If I Was Hacked?

Yes, especially if messages were sent from your account. A short warning helps protect other people from clicking the same scam link or sending money to the hacker. If you asked friends to report your account, let them know once you’re back in so they stop reporting and can re-check anything suspicious.

What If The Hacker Turned On Two-Factor Authentication?

This happens, and it’s frustrating. Start recovery using Facebook’s official hacked-account flow and look for options like “no longer have access to these.” If you’re asked for a code you can’t receive, Facebook may offer identity checks or other verification steps. Keep screenshots of any error messages you see.

Can A Hacker Steal Money Through My Facebook Account?

They usually can’t take money directly unless you have a payment method connected for ads, Meta Pay, or Marketplace-related purchases. Check your payment settings and remove any cards you don’t need saved. Also review Ad Accounts or Meta Business settings if you ever ran ads, since that’s one place where charges can show up.

What’s The Best Way To Prevent This From Happening Again?

The best security available is to use 2 Factor Authentication or a Passkey. Only you have access to those and neither can be hacked. The first method, 2FA may require the use of an authenticator app or will send you a secure login code by text message or via email. A passkey is like a digital house key stored safely on your phone, tablet, or computer.