How to Recover a Hacked Facebook Account Before Damage Spreads
To recover a hacked Facebook account, go directly to facebook.com/hacked, select the option that matches what happened, and follow Meta’s guided flow to verify your identity, reset your password, and undo the hacker’s changes. Speed is the whole game: in the first hours after a takeover, attackers change contact details to lock you out, message your friends with scam links, and reach for any Pages, ad accounts, or payment methods connected to your profile. Recovery is therefore two jobs at once — getting back in through official channels, and containing what the intruder does in the meantime.
Act in the First Hour and You Keep the Advantage
A Facebook takeover unfolds on a timeline, and the earlier you interrupt it, the less there is to clean up. Most hackers follow the same playbook: change the password, then the email and phone number, then enable their own two-factor authentication to cement control — and only then start exploiting your profile and anything attached to it. Every step they haven’t finished yet is a door still open to you.
Move through this sequence immediately:
- Go to facebook.com/hacked from any device and select “My account is compromised.” The flow will help you identify the account and secure it.
- Check your email inbox — including spam — for messages from Facebook about a changed email or password. These notices often include a “secure your account” link that can reverse the change directly, and it works for a limited time.
- Reset your password to something long, unique, and never reused from another site.
- If you’re able to get in, open Settings → Password and Security → Where you’re logged in, and log out all unrecognized sessions.
- Re-verify your contact details: remove any email address or phone number the hacker added, and confirm your own.
- Turn on two-factor authentication, preferably with an authenticator app, and save your recovery codes offline.
If the hacker has fully locked you out — new email, new phone, new 2FA — the facebook.com/hacked flow can still identify your account by your name, username, or the email you used previously, and route you into identity verification, typically a government-ID upload through Meta’s secure form. That path is slower, but it exists precisely for this scenario.
What Is the Hacker Doing With Your Account Right Now?
Understanding the attacker’s incentives tells you where damage spreads first. The most common exploitation is contact scamming: messages to your friends list impersonating you — fake emergencies, crypto “opportunities,” phishing links — because a message from a trusted face converts far better than a stranger’s. Warn your close contacts through another channel (text, email, another platform) as soon as you know you’ve been compromised, so the hacker’s messages fall flat.
The second target is anything with commercial value. If your profile administers a Facebook Page, sits in a Business Manager, or has an ad account with a saved payment method, expect the intruder to probe those next — running rogue ads on your card, demoting other admins, or hijacking the Page outright. Check your ad account activity and Page roles as soon as you regain access, and if business assets were touched, move quickly through the containment steps in our guide to Facebook Business Manager hacked: containment and recovery.
Third is identity leverage: your DMs, photos, and personal details can fuel later phishing or impersonation. This is why recovery does not end at the password reset — it ends when you have reviewed what changed, what was sent, and what was accessed, and closed each of those loops.
How Do You Get Back In When the Hacker Changed Everything?
The fully-locked-out scenario feels hopeless, but Meta’s flows anticipate it. Start at facebook.com/hacked and identify the account using information you still have — your name and profile, a previous email or phone number, or a friend’s help locating the profile URL. When standard code-based verification is impossible, the flow can offer ID verification: you upload a government-issued ID with a name matching the account, and Meta’s team reviews it. Submissions fail most often on avoidable details — blurry photos, cropped edges, or a profile name that never matched your legal name — so take the upload seriously.
Two more levers help. First, the email trail: Facebook notifies your original email address when login details change, and those notices frequently include links to reverse the change or report that you didn’t authorize it — check every folder before assuming you have nothing. Second, devices where you’re still logged in: a session on an old laptop or tablet can be enough to change the password from inside and eject the intruder, so check your devices before starting the hardest flow.
Expect the process to take anywhere from minutes (caught early) to days or weeks (full lockout with ID review). During that window, resist “shortcuts.” No third party can bypass Meta’s verification, and the people who claim they can — the “recovery hackers” who appear in your mentions the moment you post about being hacked — are scammers who will take payment, harvest your personal data, and disappear. Legitimate professional help works with the official process, not around it.
Should You Report the Hack Anywhere Else?
Often, yes. If the hacker used a saved payment method, contact your bank or card issuer to dispute charges and watch the account. If the takeover involved identity theft or financial loss, filing a report with the FTC (reportfraud.ftc.gov or identitytheft.gov) and, for significant losses, the FBI’s IC3 creates an official record that supports disputes. If the same password was reused elsewhere — a common root cause — change it everywhere and assume those accounts are also at risk.
Also report inside the platform ecosystem: flag impersonation accounts cloned from your photos, and make sure friends who received scam messages report them too, which helps Meta’s systems contain the campaign. For public figures, creators, and businesses, consider a brief public note on your other channels acknowledging the compromise — it protects your audience from further scams and your reputation from the fallout of messages sent in your name.
Rebuild Security So One Password Never Costs You This Much Again
Once you’re back in control, invest an hour in making the account genuinely hard to steal. Use a unique password from a password manager, keep two-factor authentication on an authenticator app, store backup codes offline, and prune old sessions and third-party apps quarterly. Review the email account behind your Facebook login with the same rigor — it is the master key, and it deserves its own strong password and 2FA.
For businesses and creators, go a level further: separate personal and business access, keep at least two trusted admins with hardened accounts on every Page and business asset, and reduce your dependence on any single platform. A brand whose customers can find it through its website, email list, search results, and AI-driven recommendations survives an account crisis; a brand that lives entirely inside one Facebook login does not. Viral Spike Marketing supports clients on both sides of that equation — documentation-driven account recovery through official Meta channels, and the visibility strategy that makes the next incident survivable. Our first 48 hours checklist is a practical companion to this guide.
FAQs About Recovering a Hacked Facebook Account
What Is the First Thing to Do When Your Facebook Is Hacked?
Go straight to facebook.com/hacked and start the guided recovery flow, then check your email for Facebook’s security notices, which often let you reverse a password or email change directly. Acting within the first hour, before the hacker finishes changing your contact details, dramatically improves your position.
Can I Recover My Facebook Account if the Hacker Changed My Email and Phone?
Yes, in many cases. The facebook.com/hacked flow can identify your account without current login details and route you into identity verification, usually a government-ID upload reviewed by Meta. Facebook’s notice to your original email about the change may also include a time-limited link to reverse it.
How Long Does Hacked Facebook Account Recovery Take?
It ranges from minutes to several weeks. Early-caught takeovers where you still control your email resolve quickly; full lockouts requiring ID verification take days or longer depending on review queues and whether your submission is complete and legible the first time.
Should I Pay Someone Who Says They Can Hack My Account Back?
No. “Recovery hackers” who promise guaranteed access are scams — no one outside Meta can bypass its verification systems, and hiring someone to break into an account is also a terms violation. Legitimate help means support navigating Meta’s official recovery and appeal channels, with no guaranteed outcome.
Do I Need to Tell My Friends My Facebook Was Hacked?
Yes, through a channel other than Facebook. Hackers commonly message your contacts with scam links or fake emergencies while impersonating you, and an early warning by text, email, or another platform prevents your friends from becoming secondary victims.
The faster and cleaner your response, the less a hack ultimately costs you. For a free consultation, contact us — we’ll help you assess what was compromised, organize the documentation Meta’s flows require, and contain the damage across every connected asset.
Related services
