Facebook Hacked? What to Do in the First Hour
TL;DR · the short version
If your Facebook account is hacked, start at Meta's official hacked-account page (facebook.com/hacked) on a device you have used before. Once you are back in, change your password, sign out of every other device, turn on two-factor authentication, remove any email address or phone number that is not yours, and warn your contacts. Never pay anyone who offers to get the account back. Signs of a hack, per the US Federal Trade Commission, include being unable to log in, notices of changes you did not make, login alerts from unfamiliar devices and friends receiving messages you did not send.
If your Facebook account has been hacked, go to Meta's official hacked-account page, facebook.com/hacked, from a device you have used to log in before, and follow the recovery options there. Once you are back in, change the password, sign out of every other device, turn on two-factor authentication, remove anything on the account that is not yours, and tell your friends. The steps below are in the order that matters, and none of them cost money.
This guide uses the official advice from Meta's Help Center and the US Federal Trade Commission (FTC). Facebook's menus change often, so where a path is not stated by Meta itself, we point you to the official help page instead of guessing. Prefer to practise before you ever need it? The Facebook Hacked Recovery Lab walks you through a fictional takeover, one decision at a time.
How to tell your Facebook was hacked
The FTC lists four common signs of a hacked account:
- You cannot log in to your account.
- You get notices of a username or password change you did not make.
- You get login alerts from unfamiliar devices or locations.
- Friends or family receive messages or emails you did not send.
Other things worth a look, though they are not on the FTC's list, are posts you do not remember writing and friend requests you do not remember accepting. One sign on its own can have an innocent cause. Two or more together mean you should act now.
Do this now: the first hour
- Start at the official recovery page. Meta's Help Center sends people to facebook.com/hacked, and says to use a device you have previously used to log in to Facebook. The page has separate options for recovering your own account, for recovering it if you cannot reach your account email address or mobile phone number, for helping someone else, and for a hacked Facebook Page you manage. Type the address yourself rather than following a link in a message or an advert.
- Check your own device first. The FTC advises updating your computer's security software and running a scan, deleting anything suspicious and restarting. If something on your device is recording what you type, a new password can be taken again.
- Follow the steps Facebook gives you. Choose the option that matches your situation and use only the email address or phone number that you control. Never approve a login or read out a code you did not just ask for.
- Set a new password that you have never used anywhere else. The FTC says to change your password to a strong one. Long beats clever: a few random words, or a string from a password generator stored in a password manager. Do not add a number to the old password.
- Sign out of every other device. The FTC says to sign out of all devices after changing your password. This ends any session the intruder still has open. Facebook's menus change, so use the current path on Meta's hacked-account help page.
- Turn on two-factor authentication. Meta's help page gives this path: click your profile picture, then Settings and privacy, then Settings, then Accounts Center, then Password and security, then Two-factor authentication, and choose the account. Meta supports a security key, codes from an authentication app, and text message codes, and lets you generate 10 recovery login codes for when you cannot reach your phone. Keep those codes written down and offline, not in a screenshot that syncs to the cloud.
- Check the doors you did not open. The FTC says to make sure your recovery email addresses and phone numbers are yours. An intruder who adds their own can reset your password again later. Remove any email, phone number or connected app that you do not recognise.
- Look for what was done in your name. The FTC advises checking for messages or new friends you do not recognise. Delete posts you did not write, remove strangers, and make a list of who received messages from you.
- Tell your contacts. The FTC advises warning your contacts about the hack, asking them not to click links from you, and telling them to ignore any pleas for help or money. A short text or call reaches people who do not check Facebook. If you run a business Page, tell your customers too.
- Secure your email and reused passwords. The FTC notes that a hacked email account can be used to request password resets for your other accounts, so protecting it with a strong password and two-factor authentication is critical. If you used the old Facebook password anywhere else, change those too, one unique password each.
If you cannot get back in
Meta's Help Center lists a recovery option for people who can no longer access the email address or mobile phone number on the account, and it also mentions a Meta AI support assistant for real-time help. Use these official routes, from a device you have used before, and be patient. Do not look for shortcuts, because the shortcuts are where the scams are.
Useful next, if this was relevant to you
Beware of "recovery" offers
People who are locked out are an easy target. A stranger messages you, or a search result promises to get your account back for a fee, or asks for your login "so they can start". The Better Business Bureau warns against paying anyone to recover a social media account; in one reported case a person was told they could recover an Instagram account for $100, a common scam pattern (BBB, reported by News4JAX, November 2023). The BBB's advice is to visit the official help page of the platform instead of third-party sites.
- Never give your password or a login code to anyone who contacts you.
- Never install a "recovery tool" from a forum or a message.
- Be wary of a profile with many glowing comments that all appeared in the same week.
Prevent it next time: a checklist
- A long, unique password for Facebook, stored in a password manager. Check any password you are unsure of with the password strength tool.
- Two-factor authentication on Facebook and, above all, on your email account.
- A passkey if your device supports it. Meta's help page recommends creating a passkey as a faster, more secure login option. Practise in the Passkey Lab.
- Recovery email and phone numbers that are current and yours, checked every few months.
- No logging in through links in messages, even from friends. Type the address or use the app.
- Recovery codes written down and kept offline.
- One person you trust who can tell you quickly if your account starts acting strangely.
Frequently asked questions
What do I do first if my Facebook account is hacked?
Meta's Help Center says to go to its hacked-account page, facebook.com/hacked, from a device you have previously used to log in to Facebook, and follow the recovery options there. Then change your password, sign out of other devices and turn on two-factor authentication.
Can I get a hacked Facebook account back if I cannot reach my email or phone?
Meta lists a separate recovery option for people who cannot access their account email address or mobile phone number. Start at Meta's hacked-account page on a device you have used before and choose that option.
Should I pay someone to recover my Facebook account?
No. The Better Business Bureau warns against paying anyone to recover a social media account, as these offers are a common scam pattern (BBB, reported by News4JAX, November 2023). Recovery through Facebook's own pages costs nothing.
How do I know if my Facebook was hacked?
The US Federal Trade Commission lists these signs: you cannot log in, you get notices of username or password changes you did not make, you get login alerts from unfamiliar devices or locations, or friends and family receive messages you did not send.
How do I stop it happening again?
Use a long, unique password, turn on two-factor authentication with an authentication app or security key, and consider a passkey, which Meta recommends as a faster and more secure way to log in. Keep your email account just as protected, because it can reset your other accounts.
Do I need to tell my friends?
Yes. The FTC advises telling your contacts about the hack and asking them not to click links from you or respond to any pleas for help or money.
Practise before it happens
Knowing the steps is one thing; making the calls with a clock ticking is another. The Facebook Hacked Recovery Lab puts you in the first hour after a fictional takeover. You decide where to start, what to scan, which sessions to end and whether to answer a stranger who offers help, and you get a score and the reason behind each answer.
Sources
- Meta Help Center, Hacked Accounts and the recovery page at facebook.com/hacked
- Meta Help Center, Two-factor authentication on Facebook
- US Federal Trade Commission, How To Recover Your Hacked Email or Social Media Account
- News4JAX, Why the BBB says you should never pay to recover your social media account (16 November 2023)
- FTC fraud reporting: reportfraud.ftc.gov (US readers; use your national fraud agency elsewhere)