Facebook Account Hacked? The Recovery Routes Meta Actually Offers

Why the email account comes first

People who lose a Facebook account usually head straight for the login screen. That skips the question that decides whether any of it will stick. A reset code, a login link and a “secure your account” email all go to your inbox. If someone else can read that inbox, they see the code at the same moment you do, and they can reset Facebook straight back.

So spend five minutes on the email account first. Sign in, change its password, check its recent sign-in activity, and look for forwarding rules or filters you didn’t create. Attackers add these so copies of your mail keep reaching them. If you can’t get into the email account, recover that before anything else; our guide to getting a hacked email account back covers Gmail, Outlook and Yahoo.

Do the same check for your phone number if it’s on the account. If your phone suddenly lost signal around the time of the hack, ask your mobile provider whether your SIM was swapped or your number moved. A number the attacker controls receives your SMS codes.

Route 1: the security email and its reversal link

When the email address, phone number or password on a Facebook account changes, Facebook sends a notice to the contact that was there before. If an attacker swapped your email for theirs, that notice went to you. It includes a link, usually worded as a way to secure your account if you didn’t make the change, which reverses it and starts a password reset.

These links only work for a limited time, so this is the one step where speed really matters. Search every folder for “facebook”, including spam and any older address you used when you first signed up.

Check the sender before you click. Genuine security email from Facebook comes from an address ending in @facebookmail.com. Phishers use near-misses with extra hyphens or different domains, and fake “your account will be deleted” warnings are a common way accounts are taken in the first place. When you’re back in, Accounts Center shows a list of the recent emails Facebook actually sent, which is the reliable way to confirm a doubtful one.

Route 2: Forgot password? with a contact you still own

If there’s no security email, or the link has expired, go to the Facebook login page and tap Forgot password?. On a computer you can go straight to facebook.com/login/identify. Enter an email address or phone number linked to the account. If Facebook doesn’t find it, try the other one, or search by name.

The next screen offers to send a code and shows each contact partly hidden, such as “s•••••@mail.com”. Read it carefully, because it tells you what the attacker changed. If both are yours, send the code, set a new password and go straight to the lockdown below. If only one is yours, use that one. If neither is yours, don’t request anything: every code will be delivered to the attacker. Tap No longer have access to these? instead, or move to Route 3.

Route 3: recover a hacked Facebook account when the email and phone were changed

This is where most people who search for help are stuck. The attacker has replaced both contacts, so Facebook can’t send a reset that reaches you. Its answer is the compromised-account flow at facebook.com/hacked.

1. Type facebook.com/hacked into the browser on a device you have used Facebook on before, ideally on your usual Wi-Fi.
2. Choose the option saying someone got into your account without permission.
3. Find your account by an old email, old phone number or your name, and select the right profile.
4. Enter an old password if asked, then follow the prompts for when you no longer have access to the listed contacts.
5. Give an email address you control now, and make sure its own security is sorted, because Facebook’s replies go there.
6. Complete the identity check you are offered, then wait for the reply, checking spam.

Two habits help. Submit once and then leave it; Facebook doesn’t publish a timeframe, and repeated submissions can trigger “try again later” blocks that push you further back. And keep your details consistent across attempts: the same account, the same contact email, the same name.

Passing the identity check: video selfie or ID

Facebook confirms your identity in one of two ways. The newer one is a video selfie: you record a short clip turning your head, and Meta compares it with the profile pictures on the account. In its October 2024 announcement of the test, Meta said the video is encrypted, never shown on your profile, and that facial data is deleted straight after the comparison whether or not it matches. It has been introduced market by market, so you may not be offered it.

The older route is a photo of official ID, such as a passport or driving licence. The most common reason it fails is a name mismatch. If your profile says “Sammy R” and your passport says “Samantha Rivera”, explain that the profile name is a nickname when asked. Photograph the whole document in good light, with all four edges showing and no glare.

Route 4: the attacker added their own two-factor authentication

More and more takeovers end with the attacker turning on two-factor authentication using their own app. Now even the right password leaves you facing a code prompt you can’t answer.

Work through the options in order. If you had set up two-factor yourself before the attack and saved the recovery codes, one of them still works. Next, look for any device that still has Facebook open, such as an old phone, a tablet or a work browser, and approve the login from there. If neither exists, tap Try another way on the code screen. It leads to the same selfie or ID review as facebook.com/hacked.

Ignore anyone selling a “2FA bypass”. There isn’t one outside Meta’s own review, and those tools are scams or malware.

Hacked, cloned or disabled: make sure you are fixing the right problem

A friend saying “you just sent me a weird message” doesn’t always mean a hack. If you can still log in and nothing on your account has changed, check whether the message came from a second profile using your name and photos. That’s impersonation. The fix is to report the fake profile as pretending to be you, and to make your friend list less visible so the next copy is harder to build.

If the attacker’s spam got the account disabled, you’ll see a notice when you try to log in, usually with an option to request a review. Say plainly that the account was compromised and the activity wasn’t yours. If the attacker requested deletion, Facebook holds the account for 30 days before permanent deletion, and logging back in during that time lets you cancel it. After that, it’s gone.

When recovery goes in circles

Once you are back in: close every door the attacker opened

Getting the login back doesn’t undo what the attacker set up. Do all of this in one sitting, starting from Menu › Settings & privacy › Settings › Accounts Center › Password and security:

1. Where you’re logged in: log out every device you don’t own.
2. Change password: choose one you’ve never used anywhere else. If the old one was reused, change it on those sites too. Our passphrase method makes a unique one easy to remember.
3. Personal details: remove any email address or phone number that isn’t yours.
4. Two-factor authentication: delete the attacker’s method, add an authentication app or a passkey, and store the recovery codes away from your phone.
5. Apps and websites: remove anything you didn’t connect.
6. Pages and business assets: if you manage a Page or ad account, check who has access and whether any ads or payment methods were added.
7. Posts, Messenger and Marketplace: delete anything the attacker posted or sent in your name.

Warn your friends, and watch for the recovery scam

A hacked profile is valuable because people trust it. Attackers use it to ask friends for urgent money, to post fake Marketplace listings or investment “tips”, and to ask for a code “sent by mistake”. That code is usually a reset code for the friend’s own account, which is how one hack becomes several.

The second scam targets you. Posting publicly that you were hacked brings “recovery experts” into your comments, and search results are full of fake “Facebook support” phone numbers. None of them can start or speed up Meta’s review, and many want a fee, your password or a login code. Meta’s personal-account recovery is free. If you subscribe to Meta Verified, its account support is reached from inside the app, not through a number found online.

How this page was put together

We checked the routes against Facebook’s help centre pages on hacked accounts and account recovery and Meta’s announcement of video selfie verification in September 2026. Where Facebook’s labels differ between the app, the website and different regions, we describe what each step does. Search Settings for the same word if a label isn’t exactly where we say.

We don’t link to or recommend any paid recovery service; every route here is free. You can read about how we research and correct our guides.