A hacked Facebook account is stressful, especially once you realize someone else might be posting, messaging your friends, or spending money as you without your knowledge. This complete recovery guide walks through every scenario, from a simple password compromise to being fully locked out, so you can get your account back as quickly and safely as possible.
How to tell if your account was hacked
- Posts, comments or friend requests you did not make appearing on your timeline.
- Your name, birthday, email or profile picture changed without your input.
- You are suddenly logged out and your usual password no longer works.
- Friends report receiving strange messages or suspicious links from you.
- You receive a login alert from a device or location you do not recognize.
Scenario 1: You can still log in
- Go to Settings and Privacy, then Settings, then “Password and security”.
- Change your password immediately to something unique that you do not reuse anywhere else.
- Check “Where you’re logged in” and log out of any device or session you do not personally recognize.
- Turn on two-factor authentication so a code from your phone is required for any future login attempt.
- Review recent posts, messages and friend requests for anything you did not do, and remove or report it as needed.
Scenario 2: You cannot log in anymore
Use the “Forgot password” option on the Facebook login page and choose to receive a reset code by email or phone, whichever is still linked correctly to your account. If the hacker changed your contact details before you noticed, use Facebook’s dedicated “My Account is Compromised” form in the Help Center, which walks you through an identity verification process instead of a standard password reset that would otherwise fail because the linked email or phone number no longer belongs to you.
Scenario 3: You got a suspicious login alert but nothing else looks wrong
Do not ignore it, even if everything appears normal at first glance. Change your password as a precaution, review your active login sessions, and enable two-factor authentication even if nothing seems to be missing yet, since some account compromises are used quietly for weeks before anything visibly changes, such as harvesting personal information or waiting for a good moment to run a scam through your profile.
Scenario 4: A friend’s account messaged you a strange link
Do not click it, no matter how convincing the message sounds. Their account is very likely compromised, not yours, and clicking the link could compromise your own account in turn. Let them know through another channel entirely, such as a text message or phone call, since they may not realize what is happening on their own account yet and are unlikely to see a Facebook message from you warning them about it.
After you regain access
- Check connected apps under Settings and remove anything you do not recognize or no longer use.
- Warn friends not to click any links sent from your account while it was compromised.
- Consider changing your email password too, in case it was also affected, since email access is often the actual starting point for a Facebook account takeover.
- Review your privacy and blocking settings in case the hacker changed anything there, such as who can see your posts or send you friend requests.
How accounts typically get hacked
| Cause | How to prevent it |
|---|---|
| Reused password from another leaked site | Use a unique password for Facebook |
| Phishing link or fake login page | Only log in through facebook.com or the official app |
| Unsecured device left logged in | Log out of shared or public devices |
| No two-factor authentication | Turn it on under Password and security |
Protecting your account for the future
The single most effective step you can take is enabling two-factor authentication, which requires a code from your phone in addition to your password for any new login. This alone stops the vast majority of account takeovers, even if your password is later leaked in an unrelated data breach somewhere else online. Pair it with a unique password stored in a password manager rather than reused across multiple sites, and be cautious of any link asking you to “confirm your Facebook login” that did not come directly from facebook.com.
Once your account is secure again, get back to normal with our Facebook font generator and emoji library.
Frequently asked questions
Will Facebook restore posts or messages a hacker deleted?
Not always. Facebook can help recover account access, but it does not guarantee restoring content that was deleted during the compromise, which is another reason to act quickly the moment you notice something is wrong.
How long does Facebook account recovery take?
It varies considerably. A simple password reset can take minutes, while identity verification through the compromised account form can take longer, sometimes several days depending on the volume of requests Facebook is processing.
Should I delete my account if it keeps getting hacked?
Usually not necessary. Enabling two-factor authentication and using a unique password solves the underlying issue in most cases. If you do decide to leave regardless, see our guide on how to delete your Facebook account.
Is it true that no one can see who viewed my profile even after being hacked?
Correct, that remains true regardless of any compromise. See our explainer on who viewed my Facebook profile for the full picture on that particular myth.
Can two-factor authentication itself be hacked?
It is far more resistant than a password alone, though it is not entirely immune to sophisticated attacks, which is why avoiding phishing links in the first place still matters even with it enabled.