My Facebook account has been hacked: what to do, in order

A hacked Facebook account is not one problem, it is about five different problems that look identical from the outside. What decides your next move is not that you were hacked, it is exactly which details the other person changed on the way past. This page walks through each case in the order they actually happen, gives you the official Facebook page for that case, and tells you honestly which ones are quick and which ones are not.

Last checked: 15 August 2026. Every official Facebook, Instagram and Australian government link on this page was opened and confirmed working on that date. If you find one that no longer works, please tell us and we will fix it, because a dead link on a page like this is worse than no page at all.

First, work out which of these you are in

Read down this list and stop at the first one that matches. The rest of the page follows the same order.

• I can still log in, but something is wrong. The easiest case, and you can fix it yourself in ten minutes.
• My password does not work, but my email and mobile are still on the account. Still straightforward, because Facebook can send you a code.
• My password, email address and phone number have all been changed. The hard case. Slower, and honestly it does not always work.
• I am stuck on a two factor code I cannot get, usually because the phone number is old.
• Facebook says the account is disabled or suspended. A different process again, often triggered by what the attacker did with it.
• It is a business Page with advertising attached. Urgent, because money is very likely going out right now.

If you can still log in

Do not wait, and do not assume that because you can still get in, nothing happened. Whoever got in may still be logged in on their own device this minute. Go to your password and security settings, change the password, sign out of all other sessions, then look carefully at the email addresses and phone numbers listed on the account and delete anything you did not put there.

If your password no longer works

This is the common case and the recoverable one. Facebook can send a code to the email address or mobile number still attached to the account, and you set a new password from there.

If you cannot even get far enough to reach that form, identify the account first at facebook.com/login/identify, which finds an account from your name, an old email address or a phone number that used to be on it.

Full walkthrough: someone changed my Facebook password.

If the email address and phone number were changed as well

This is the case worth being straight with you about. When somebody replaces the contact details, Facebook has no way to send you a code, so recovery moves to confirming who you are. That is slower, it commonly takes several days, and it does sometimes fail. It is still absolutely worth doing, and doing today, because the older the change is the harder it becomes.

Full walkthrough: the hacker changed my email and phone number too.

If you are stuck on a two factor code

Two factor authentication is a good thing that is currently working against you. If you saved recovery codes when you turned it on, this is the moment they exist for. If you did not, the way back is the same identity confirmation route.

Full walkthrough: I cannot get my Facebook two factor code.

If Facebook says your account is disabled

Being disabled is not the same as being hacked, though the two often arrive together, because somebody who takes an account tends to use it for exactly the things that get accounts disabled. There is a review process, and it is the only route.

If it is a business Page

Treat a compromised Page with a live advertising account as an emergency the same day, not a job for the weekend. If a card is attached, somebody is almost certainly spending on it right now, in your name, and the amounts can be large. Ring your bank and stop the card without waiting for Meta to answer anything.

Full walkthrough: my Facebook business Page has been hacked.

Close the door behind you

1. Change the password, and change it anywhere else you used the same one. If that password was also on your email or your banking, those come first, before the social account.
2. Check the recovery email address and phone number on the account and remove anything you do not recognise. This is the step people skip, and it is the reason accounts get taken a second time a week later.
3. Sign out of all other sessions, so a device the attacker is still holding gets kicked off.
4. Turn on two factor authentication, so a stolen password on its own is no longer enough.
5. Look at what was posted or sent while they had it, so you know what your friends and family received.
6. Tell the people who were messaged, ideally somewhere other than the account that was taken.

The people who will offer to help you

Within hours of posting that you have been hacked, you will be contacted by somebody offering to fix it. Every one of these is a warning sign.

• Anyone offering a phone number. There is no Meta support line. A number is the clearest single sign you are being scammed.
• Paid recovery agents. Services that promise to get your account back for a fee. They have no access Meta does not give you for free, and the usual outcome is that you pay and nothing happens.
• Anyone who messages you offering to help after you post that you have been hacked, especially on Instagram. Watching for those posts is exactly how they find people.
• Anyone asking for an upfront fee, a gift card, a voucher or a cryptocurrency payment. No legitimate service is paid this way.
• Anyone asking for your password or your two factor code. No real Meta process ever asks a person for these. Sharing the code is how the second theft happens.
• Anyone asking to remote control your computer to fix it for you, unless it is somebody you already know and trust.
• A friend asking you to receive a code for them. That friend has already been taken over, and the code is for your account.

Related pages on this site

• Start at the router , if you are not sure which case you are in.
• Facebook account recovery , the recovery routes explained.
• There is no Facebook phone number .
• Instagram hacked , if it is that as well.