Facebook Account Hacked: Recovery Steps

If your Facebook account was hacked and the password changed, go to facebook.com/hacked on a phone or computer you've used for Facebook before. That one page starts Facebook's real recovery process, and it works even if the hacker changed the email and phone number on the account.

Take a breath, because this happens to a lot of people and it is usually recoverable. Do the steps in order. One warning before anything else: Facebook has no support phone number. Any number you find in a search ad, any stranger who comments "contact this recovery expert," and any account that messages you offering to get your account back is a second scammer hoping to catch you while you're panicking. The only real doors are the ones below.

Step 1: Go to facebook.com/hacked

Type facebook.com/hacked into the browser yourself, on a device you've logged into Facebook from before. The device matters, because Facebook recognizes devices it has seen with your account, and recovery goes much better from your own phone or home computer than from a borrowed laptop.

Pick the option that matches what happened (for example, that someone got into your account without permission), then follow the prompts. Facebook will walk you through proving the account is yours, setting a new password, and reviewing what the hacker changed.

Step 2: Check your email for the "email was changed" notice

When someone changes the email address on a Facebook account, Facebook sends a message to the old address with a special link that reverses the change. Search your inbox and spam folder for recent mail from facebookmail.com (that is Facebook's real sending domain) with a subject like "Your primary email was changed," and click the link in that message to undo the swap and secure the account. This one email is often the fastest way back in.

Step 3: If the email and phone were both changed

You can still get in. On that same familiar device, go to facebook.com/login/identify.

  • Enter any email or phone number that might ever have been on the account, and if none work, try your name or username.
  • When your account comes up, choose "No longer have access to these?" (it may say "Forgot account?" or "Recover" instead).
  • Follow the prompts. Facebook may ask for a new email address it can reach you at, and may ask you to confirm your identity, sometimes with a photo of your ID.

This route is slower and more annoying, but it exists exactly for the case where the hacker changed everything. Don't hammer it with rapid repeat attempts, and instead go through it once, carefully.

Step 4: Secure the email account behind Facebook

Ask yourself how they got in. Often the answer is your email, because whoever controls your email can reset almost anything. Before you consider this over:

  • Change your email password to something new that you've never used anywhere else.
  • In your email settings, check for forwarding rules or recovery addresses you didn't add, because hackers plant those to sneak back in later.
  • Sign out all other sessions if your email provider offers it.

If your email account itself is compromised, deal with that first. Our page My Password Was Compromised: What Do I Do? covers that situation step by step.

Step 5: Kick them out and undo their changes

Once you're back in, go to Settings, then Accounts Center, then Password and security, then Where you're logged in, and log out every device you don't recognize. Then check the email addresses and phone numbers on the account and delete any that aren't yours, and look for posts, Marketplace listings, or messages you didn't send.

Step 6: Tell your friends before the hacker does

The whole reason people steal Facebook accounts is to scam the victim's friends from a familiar name. That usually means stranded-and-need-money messages, gift card requests, crypto pitches, and links that steal their accounts next. Post that you were hacked, and text the people closest to you directly so they know to ignore anything that account asked for. A minute of embarrassment now can save a friend real money later.

Step 7: Turn on two-factor authentication

Go to Settings, then Accounts Center, then Password and security, then Two-factor authentication. An authentication app is stronger than text-message codes, but either beats nothing. With two-factor on, a stolen password alone no longer opens the door.

Once the account is safe

One honest question: was your Facebook password also your password anywhere else? If yes, the breach isn't over, because criminals try stolen passwords on every other site automatically. Here's how to actually stop reusing passwords without changing 200 accounts in one weekend, and if you got this page because a parent's account was taken, we wrote one for that too.

We're NuLenke, two people in Minnesota, and we make Lomenett, a password typer, which is a small offline USB stick that stores your logins and types them for you, so every account can have its own password without you memorizing any of them. It's launching soon, but get your Facebook back first, because that's today's job.