The hacker changed my Facebook email and phone number too
This is the difficult one, and you deserve a straight answer rather than a cheerful one. When somebody replaces both the email address and the phone number on an account, Facebook has nowhere left to send a code, so recovery moves to proving who you are. That route exists and it does work, but it commonly takes several days, and sometimes it does not succeed. It is still worth starting, and it is worth starting today, because these get harder the longer the changes have been in place.
Last checked: 15 August 2026. Every official Facebook, Instagram and Australian government link on this page was opened and confirmed working on that date. If you find one that no longer works, please tell us and we will fix it, because a dead link on a page like this is worse than no page at all.
Look for the reversal email first
Before anything else, search your email, including the junk folder, for a message from Facebook about a changed email address. Facebook generally notifies the old address when the contact details change, and that message can contain a link that reverses it. If it is there, that is much the fastest way out of this. These links expire, so look now rather than later.
The official route
The official page for this situation:
Find your account at facebook.com/
https://www.facebook.com/login/identify
This identifies which account you mean, using your name or details you used to have on it. It is the entry point when you cannot reach the account at all.
The official page for this situation:
Facebook: confirm your identity
https://www.facebook.com/help/582999911881572
The official explanation of the identity step, what it asks for, and how it is assessed.
What to expect, honestly
- It is slow. Several days is normal. There is no queue you can pay to jump, because no paid route exists at all.
- It sometimes fails. If Facebook cannot establish that the account is yours, that is a real outcome. It is not something you did wrong.
- Repeating it does not help. Submitting again and again can muddle the review rather than hurry it.
- It all happens on Facebook's own pages. If anybody contacts you asking for identity documents, that is a scam using your situation as cover.
The more urgent problem underneath
If somebody was able to change the email address on your Facebook account, ask how they did it. Very often the answer is that they already had your email account, which is far more serious than the Facebook one. Your email is the master key to everything else you own, including banking.
So while you wait, change your email password from a device you trust, turn on two factor authentication there, and check the email account's own settings for forwarding rules or recovery addresses you did not add. That is genuinely more important than the Facebook account.
The people who prey on exactly this moment
This is the situation recovery scammers hunt for, because you are stuck, waiting, and willing to try anything. Everything below means walk away.
- Anyone offering a phone number. There is no Meta support line. A number is the clearest single sign you are being scammed.
- Paid recovery agents. Services that promise to get your account back for a fee. They have no access Meta does not give you for free, and the usual outcome is that you pay and nothing happens.
- Anyone who messages you offering to help after you post that you have been hacked, especially on Instagram. Watching for those posts is exactly how they find people.
- Anyone asking for an upfront fee, a gift card, a voucher or a cryptocurrency payment. No legitimate service is paid this way.
- Anyone asking for your password or your two factor code. No real Meta process ever asks a person for these. Sharing the code is how the second theft happens.
- Anyone asking to remote control your computer to fix it for you, unless it is somebody you already know and trust.
- A friend asking you to receive a code for them. That friend has already been taken over, and the code is for your account.
If it does not work
If identity confirmation fails, the practical path is a new account, telling your friends and family what happened so they are not taken in by the old one, and reporting the old account as an imposter using Facebook's imposter account process. That is a bad outcome and it is worth saying plainly that it happens to people who did everything right.
Related pages on this site
- Start at the router , if this is not quite your situation.
- There is no Meta phone number , and what the numbers really are.
- Paid recovery services , why none of them are real.
- All four Facebook recovery routes .
- If money has gone , the order to do things in.
Frequently asked questions
Can I get my Facebook account back if the hacker changed the email and phone?
Often yes, through identity confirmation, but be prepared for it to take several days and to sometimes fail. Start at facebook.com/login/identify, use a device you have logged in from before, and check your old email for a Facebook notice about the change, which may contain a link that reverses it outright. Starting early genuinely improves your chances, because the longer the new details sit on the account, the more they look like the legitimate ones to an automated review.
How long does Facebook identity confirmation take?
Commonly several days, and there is no way to speed it up. Nothing you can buy shortens it, because Meta sells no such service to anybody. Submitting the request repeatedly tends to confuse the review rather than accelerate it, so send it once and watch the email address you gave them, junk folder included, for the reply. Nothing you can buy shortens this, because Meta sells no such service to anybody at any price.
Facebook is asking for my ID. Is that safe?
It is safe when it happens inside Facebook's own pages, having started from facebook.com, and that is the only place it should ever happen. It is never safe when somebody messages or emails you asking for documents, even if they claim to be from Meta. We will never ask you for identity documents either, and no genuine helper needs to see them.
Should I make a new Facebook account while I wait?
It is reasonable, particularly if you need to reach people, but do the recovery as well rather than instead. While the old account is in somebody else's hands it is being used to message your friends in your name. Tell your contacts what has happened from the new account, and report the old one if it is impersonating you. Keep the recovery request open in the background, because these are sometimes granted weeks later.
They got into my email as well. What comes first?
The email account, without question, and before the Facebook one. Whoever controls your email can reset the password on almost everything else you own, including banking. Change that password from a device you trust, turn on two factor authentication, and check the account settings for forwarding rules or recovery addresses somebody else added while they were in there. A forwarding rule is the one people miss, and it quietly copies every future message to somebody else.