Facebook Account Hacked? How to Get It Back and Lock It Down

Signs your account was hacked (the first six are Meta’s own list)

• Your profile picture has been changed.
• There are posts, comments or messages you didn’t write.
• You’re having problems logging in, or your two-factor authentication method (for example your authentication app) isn’t working.
• Facebook sent you a message or notification that someone is trying to log in, or has logged in, and it wasn’t you.
• You got an email from Facebook saying an email address or phone number was added or removed, or your password was changed, and it wasn’t you.
• In Where you’re logged in in your Settings, there’s a device or location you don’t recognize.
• Your password, email address or phone number was changed and you didn’t do it.
• Friends say you sent them strange messages, links or requests for money.
• Posts, stories, comments or Marketplace listings appear that you didn’t make.
• Your name, profile photo or birthday changed.
• You received an email about a login from a new device or location you don’t recognize.
• Charges for Facebook ads you didn’t buy appear on your card statement, or you were added to a Business account.
• Facebook logs you out and your password no longer works.

iPhone & iPadAndroidComputer (browser)

Meta’s recovery screens vary by account, country and device, and Meta updates them regularly. The steps below describe what to look for; follow the wording on your screen.

The 5-minute emergency checklist

Do these in order, as quickly as you can. Each one limits the damage while you recover the account.

1. Don’t panic-click. Ignore any links in messages or emails about the hack. Open Facebook yourself.
2. Secure your email. Change the password of the email account linked to Facebook, and sign out of other sessions there. If the hacker controls your email, they control your resets.
3. If you’re still logged in, change your Facebook password now and log out of other devices (Path A).
4. If you’re locked out, go to facebook.com/hacked on a device you normally use (Path B). Meta also offers a Guided Help tool (external site, opens in a new tab) for hacked profiles.
5. Protect your money. If a card is saved for ads or payments on Facebook, watch your statements and contact your bank if you see charges you didn’t make.
6. Tell friends not to trust messages from your account for now (template below).

Why this happens: the possible causes

You don’t need to know exactly how it happened to recover the account, but knowing the likely route helps you close the gap so it doesn’t happen again.

• A fake login page (phishing)Possible

  A message or email says your account will be closed, has a copyright problem, or won a prize, and links to a page that looks like Facebook. Typing your password there hands it over.

• A code you were tricked into sharingPossible

  Hackers often message from a friend’s hacked account asking you to “send back” a code they “sent by mistake”. That code is the key to your account.

• A reused passwordPossible

  If your Facebook password was also used on another site that was breached, criminals may try it on Facebook automatically.

• A third-party app, browser extension or devicePossible

  Apps you logged in to with Facebook, untrusted browser extensions, or a shared or lost device can expose your account.

• A fake “recovery service”Possible

  Some people are hacked a second time by scammers posing as support after a first problem. Meta notes that hackers will keep trying to exploit account recovery tools.

Path A: You can still log in

This is the best position to be in. Work quickly through Fix 1 to Fix 4 below; together they remove the intruder and close the most common doors back in.

Path B: Your password was changed

If you can’t log in but the account still has an email address or phone number you control, use Fix 5. Facebook will send a code to a contact method it has on file and help you secure the account.

Path C: The hacker changed your email and phone

Start with your old email inbox. Meta says that when an account’s email address is changed, it sends a message to the previous email address with a special link, and that you can click this link to reverse the email change and secure your account.

1. Open the email account that used to be on Facebook and search for a recent message from Facebook about an email change (check spam/junk too).
2. Before clicking, check it’s genuine: Meta says its emails only come from domains such as facebookmail.com, facebook.com, fb.com, meta.com or metamail.com — watch for misspellings (full check).
3. Click the link in that message to reverse the email change and secure your account, then follow the steps.
4. If you can’t find that email, or you no longer have access to your old email or phone either, use Fix 5 and then Meta’s step-by-step route for when you can’t access your email or phone — when asked for new contact details, use an email or number that has never been used on your Facebook account before.

How to fix it, step by step

Work through these in order. They start with the quickest, safest checks and only move to steps that sign you out or remove data later.

1

Fix 1: Change your password and log out everywhere else (if you can still log in)

May sign you out3 miniPhone & iPadAndroidComputer (browser)

A new password stops the hacker using the old one, and logging out other sessions kicks them out of devices where they’re already signed in.

1. Open Menu (☰: top left on iPhone, top right of the Home screen on Android) > Settings and privacy > Settings > Accounts Center (called Meta Account on some accounts) > Password and security (Login and security under Meta Account) — Meta’s path; if you don’t see either, choose Password and security directly (on a computer, start from your profile picture).
2. Choose Change password, then fill in Current password, New password and Re-type new password. Facebook asks for at least 6 characters mixing numbers, letters and special characters, but make it long and unique, not used anywhere else.
3. Check Log out of other devices (the screen says to choose it “if someone else used your account”), then tap Change password.
4. Further down Password and security, under Security checks, open Where you’re logged in and log out of every session you don’t recognize. If you’re unsure, log out of all except the device you’re holding.
5. Accept any prompt to review other security settings.

Did it work? The devices list shows only the device you’re using (and others you recognize).

3

Fix 3: Remove unknown apps, extensions and admins

Safe & reversible5 miniPhone & iPadAndroidComputer (browser)

Connected apps and browser extensions can keep access even after a password change.

1. Open Settings & privacy > Settings, scroll to Your activity, and tap Apps and websites.
2. Each app shows the date it was added and whether it’s Active or Expired. Tap any app you don’t use or recognize and remove it. Pay most attention to Active ones.
3. Tap View removed apps and websites to check nothing was removed that you rely on (and nothing odd was added and removed).
4. On your computer, review browser extensions and remove any you didn’t install on purpose.
5. If you manage Pages or groups, check the admin list and remove people you don’t know.

How Facebook explains it on that screen: an app can always see your public information, but it only gets non-public information if you share it when you log in with Facebook. If you haven’t used Facebook to log in to an app for 90 days, its access to your non-public information expires and the app changes from Active to Expired. Even then, the app may still hold information you shared while it was Active. To stop all logins with Facebook, use Preferences > Apps, websites and games > Turn off at the bottom of the same screen; only do this if you don’t use Facebook to sign in anywhere.

Did it work? Only apps, extensions and admins you trust remain.

Remove saved logins from old or shared devices

Meta says that if a device or browser has saved login info, it can open Facebook without your password. Removing it means a password is needed next time on that device or browser. Our advice: do this for any lost, sold or shared device once your account is safe.

• Computer: click your profile picture (top right) > Settings & privacy > Settings > Accounts Center > Password and security > Saved login, then select the saved login info you want to remove.
• Android or iPhone app: tap Menu (top left) > Settings & privacy > Settings > Password and security > Saved login, then select the saved login info you want to remove.
• Mobile browser and Facebook Lite: tap Menu (top right), scroll down and tap Settings & Privacy > Settings > Password and security > Saved login, then select the saved login info you want to remove.
• iPad app: tap Menu (bottom right), scroll to the bottom and tap Settings & privacy > Settings. Below Account, tap Password and Security > See all next to Where you’re logged in, tap Options next to the device or browser, then Log out.
• Don’t see it? Meta says not everyone can access this setting in Meta Account or Accounts Center yet. Computer: go to Settings > Security and Login, click Edit next to Save your login info, and select the device or browser to remove. Android or iPhone: go to Settings > Password and Security (below Account), tap See all next to Where you’re logged in, tap the device or browser, then tap Log Out.

Tell your friends (copy this message)

Send this by text, WhatsApp or another account so friends don’t fall for messages sent in your name:

If the hacker posted or messaged from your account, you can also report those messages so Facebook can remove them.

Check what the hacker may have done

Once you’re back in, look around carefully. Hackers often try to make money from an account or keep a way back in.

Facebook’s Activity log lets you view and manage posts, tags, comments and likes. You can move a post to your Archive, where only you can see it, or to Trash, where Facebook says it is automatically deleted after 30 days. That gives you a window to restore a post you removed by mistake.

Messages you might see (reported wording; yours may differ)

These are the messages as people report seeing them. The exact wording on your screen can differ by app version, language and region, so match the meaning, not every word.

How to know it worked

• You can log in with a new password that only you know.
• Only your own email addresses, phone numbers and two-factor methods are on the account.
• The devices list shows only your devices.
• Unknown apps, Page admins and payment methods have been removed.
• Friends confirm they’ve stopped receiving strange messages from you.
• Your email account is also secured with a new password and two-step verification.

Still not working? Your next steps

1. Repeat the facebook.com/hacked steps from a device and network you’ve used Facebook on before.
2. Check the original email address for Facebook’s security notices; some include a way to secure the account.
3. Use Meta’s Account Recovery Hub (external site, opens in a new tab) for the latest official options.
4. If your account shows a suspension or disabled notice, follow account disabled or suspended.
5. If you paid a “recovery service” or shared a code or ID with someone, follow what to do if you were scammed.

Helping someone else, or is it a fake account?

• Helping a parent, partner or friend? Meta recommends helping them visit its Account Recovery (external site, opens in a new tab) page to find the right solution, and helping them use the device they usually use to log into Facebook, so do it on their phone or computer, not yours. See Meta’s page on helping someone else recover their account (external site, opens in a new tab). Our advice: let them type their own password and codes; don’t ask them to share them with you.
• Someone made a fake profile pretending to be you (but your own account is fine)? That’s an imposter account, not a hack. See Someone made a fake Facebook account of you for Meta’s reporting steps.
• A Page you manage was taken over? See Facebook Page hacked or lost admin access.

Frequently asked questions