If someone has taken over your Facebook account, start at facebook.com/hacked, on a phone or computer you have used to log in to Facebook before. That is Meta’s official route, and you can use it even if you aren’t sure the account was hacked.
Before you open it, spend two minutes on your email. Attackers often go after the inbox too, and any recovery link you request is only useful if they can’t read it first.
First, make sure “hacked” is the right word
The right route depends on what happened. These situations can look alike from the outside, but they are handled differently.
| What you’re seeing | What it usually means | Where to start |
|---|---|---|
| Posts or messages you didn’t write, or a changed email, phone or password | Hacked: someone else got in | facebook.com/hacked |
| A forgotten password, or codes that no longer reach you | Locked out: you’ve lost a way to log in | Facebook’s account recovery page |
| Some features are blocked, but you can still log in | Restricted: Meta has limited what you can do | The notice in your account |
| A notice says your account is suspended or disabled | Suspended or disabled: Meta has acted on the account | The review option in the notice, if one is offered |
Attackers can also cause a restriction or suspension by using your account to break the rules. If you see that kind of notice and also signs of a takeover, mention the takeover when you follow the steps in the notice.
What to do first
Work through these in order.
1. Secure your email
Change the password on the email address linked to Facebook, and turn on two-factor authentication there. Check that no forwarding rules or recovery details have been added without your knowledge.
Do this from a device you trust. If the same password was used anywhere else, change it there too.
2. Look for Facebook’s “email changed” message
When the email on an account is changed, Facebook sends a message to the previous address with a link that reverses the change. Search your inbox and spam folder for it. If the email is genuine, this can be the fastest way back in, so use it as soon as you find it.
Be careful here, because fake security emails are a common way accounts get hacked in the first place. If anything about the message looks wrong, don’t click. Type facebook.com/hacked into your browser instead.
3. Start the official recovery
On a device you’ve used with this account before, go to facebook.com/hacked and follow the prompts. A familiar device is one of the few things you control that can help. If you still have a logged-in session on an old phone, tablet or laptop, keep it and don’t log out.
If that device still has access, go to Where you’re logged in in your settings and log out anything you don’t recognize.
4. If your email and phone were changed or you’ve lost them
This is the situation most people are worried about, and there is a separate route for it. Facebook’s guidance comes down to this:
- Try any other email address or phone number you may have linked over the years. Include the country code with phone numbers.
- On a familiar device, go to facebook.com/login/identify and search using those details. If that fails, use your name or username. A friend can find your username in your profile address.
- Select No longer have access to these? If you don’t see it, look for Forgotten account? or Recover.
- If asked for new contact details, give an email address or phone number that has never been used with your Facebook account.
- Complete the checks that confirm the account is yours, then set a new password.
If you’ve only lost the email account, it’s also worth asking your email provider whether they can restore it. That sometimes opens up the simpler routes above.
5. Be ready to confirm your identity
Facebook may ask you to confirm who you are. Depending on the account, that may mean a government ID or a video selfie, and not every account is offered the same option.
This is where accurate details on the profile make a real difference. A selfie check, for example, is hard to pass if the account has no clear photos of you. You can’t change that now, but it’s a good reason to keep the profile accurate once you’re back in.
What slows recovery down
A few common reactions can make things harder.
- Using a new device for every attempt. Stick to devices the account already knows.
- Giving different information each time. Keep names and dates consistent with the account.
- Replying to the attacker. If they message you offering the account back for money, don’t pay. Paying doesn’t guarantee they’ll return it.
- Trusting “recovery experts” in comment sections. Replies promising instant access are a common follow-up scam, especially under public posts about hacked accounts.
There’s no reliable timeline, and some accounts can’t be recovered. It depends on what the attacker changed, what proof the account still holds, and which checks Facebook offers you. Try the official routes properly, and keep a note of what you’ve tried and when.
Once you’re back in
Getting access back is only half the job, because an attacker may have left a way back in.
- Set a new, unique password. Don’t reuse one from any other site. Consider a passkey if it’s offered to you.
- Turn on two-factor authentication and login alerts. The Security Checkup in your settings walks you through both.
- Check your contact details. Remove any email address or phone number that isn’t yours.
- Log out of unknown devices in Where you’re logged in.
- Remove suspicious apps and browser add-ons, on your computer as well as in your account.
- Delete what the attacker posted, and tell friends to ignore any messages sent while you were locked out.
If the account runs a business
Check these as well:
- Who has admin access to your Pages and business tools
- Whether any ads were created or run
- What payment methods are on your ad accounts, and any recent charges
If a Page was taken over separately, Facebook has a hacked Page recovery guide. If unexpected charges appear, contact your bank or card provider as well. Once things are stable, I’d also check that your tracking is still set up correctly, since a takeover can leave changes you won’t notice right away.
When outside help makes sense
Most people should try the official routes themselves first, as they’re free and you don’t need anyone’s permission to use them. Help can be useful when you’ve tried them and you’re stuck, or when the account holds a business you can’t afford to lose.
Whoever you speak to, a legitimate helper still works through Meta’s routes with you, and has no special access to Meta. Be wary of anyone who guarantees recovery or asks for your password or login codes.
That’s how I work as an independent specialist. I’m not affiliated with Meta, I only help rightful owners or their authorized representatives, and I can’t promise an outcome. You can read how my account recovery work runs or look through past recovery cases.
Frequently asked questions
Can I recover a hacked Facebook account if the email and phone were changed?
Often it’s worth trying, yes. Look for the reversal link sent to your old email address first. If there isn’t one, use facebook.com/hacked or the “No longer have access to these?” route from a familiar device. Whether it works depends on the checks Facebook offers your account.
How long does Facebook account recovery take?
There’s no fixed time. A genuine reversal link can work right away, while cases that need identity checks can take much longer. Be careful with any source that gives an exact timeline.
Does Facebook have a phone number or live support for hacked accounts?
Don’t rely on phone numbers you find through a search, because fake support numbers are a known scam. Use the routes on Facebook’s own site, starting with facebook.com/hacked and Meta’s Account Recovery Hub.
Can a friend or family member recover it for me?
They can help you through it, but you should complete the steps yourself on a device you’ve used with the account. Facebook’s guidance says the same. Don’t share your password or login codes to make it easier.
My account was hacked and then disabled. Is that the same process?
Not quite. Secure your email first, then follow the review option in the disabled notice if one is offered, and explain that the account was compromised. The outcome is Meta’s decision.
What should I do if the hacker is messaging my friends?
Warn them from another account or by phone, so they know to ignore any requests, especially for money or codes. You can also ask them to report the account’s messages. Meanwhile, keep working through the recovery steps.
The short version
Secure your email, look for the reversal link, then use facebook.com/hacked from a familiar device. If your contact details are gone, use the “No longer have access” route. Once you’re back in, remove whatever the attacker left behind.
If you’ve tried those routes and you’re still locked out, you can request a recovery review. Tell me what happened and what you’ve tried, and I’ll tell you honestly whether I can help. Please don’t send passwords, login codes or ID documents in your first message.