How to Recover a Hacked Facebook Account: A Step-by-Step Guide

When a Facebook account is hacked, the first hour matters most. The attacker usually changes the email address, the phone number and the password in quick succession, then turns on their own two-factor authentication. Every minute you wait gives them more time to lock you out for good, message your friends, or run ads on your card.

This guide walks through what to do, in order, using only Facebook’s own recovery tools.

1. Check your email for a message from Facebook

When someone changes the email on your account, Facebook sends a message to the old address saying the email was changed. That message usually contains a link along the lines of “If you didn’t make this change, secure your account”. That link is often the fastest way back in, because it was sent to you before the attacker took over.

• Search your inbox, spam and promotions folders for recent messages from Facebook or Meta.
• Only click links inside messages that came from Facebook’s real domains (facebookmail.com or facebook.com). Attackers send look-alike “security” emails too.

2. Use the official hacked-account page

Go to facebook.com/hacked from a browser and choose the option that matches what happened. Facebook will ask you to identify the account (email, phone number or username) and then offers the recovery options it has on file.

If none of your contact details work any more, use Find your account on the login page and look for the option that says you no longer have access to the email or phone. Depending on the account, Facebook may offer to verify you with:

• a code sent to a recovery email or phone you added earlier,
• confirmation from a device you have logged in on before,
• a video selfie or an official ID check.

3. Things that make recovery fail

• Trying again and again in a short time. Repeated attempts can temporarily block the recovery flow. Space your attempts out.
• Paying “recovery experts”. No outside person can reset a Facebook password for you. Anyone who promises that, especially in exchange for crypto or gift cards, is running a second scam.
• Sharing codes. Never send a login or recovery code to anyone, including someone claiming to be Facebook support. Facebook does not ask for codes over Messenger or WhatsApp.

4. Once you are back in

Work through these straight away, before you do anything else:

1. Change your password to a new one you have never used anywhere else.
2. Open Accounts Center → Password and security → Where you’re logged in and log out of every session you don’t recognise.
3. Check the email addresses and phone numbers on the account and remove any you don’t own.
4. Turn on two-factor authentication with an authenticator app, and remove any 2FA method the attacker added.
5. Check Page roles, Business Manager access and any ad accounts. Attackers often add themselves as an admin so they can come back.
6. Look at recent posts, messages and payment activity, and warn friends if messages were sent in your name.

Our post-recovery checklist covers every one of these in detail.

5. If Facebook’s automated flow does not work

Some cases do not fit the automated flow: the attacker changed everything, you no longer have the old phone number, or the account is a business asset. In those cases what helps most is a clear, consistent case: the account link, the date it was taken, what was changed, proof that you own it (old emails from Facebook, receipts for ads, photos of you on the profile), and screenshots of everything.

That is exactly what our Account Recovery service does with you: we organise the evidence, follow the official channels in the right order, and keep track of every step. We never ask for your password, and we will tell you honestly if a case cannot be won.