Your Facebook or Instagram has been hacked: here is the official way back in

If you have just found out that your account is not yours any more, take a breath. Most of these end well. The trouble is that the correct next step is completely different depending on what the person who took it actually changed, and the internet is full of pages that give you the wrong one, or worse, a phone number to ring. So this page asks you two questions and then sends you to the exact official Facebook or Instagram page for your situation. It is free, it takes a few minutes, and you do it yourself.

Last checked: 15 August 2026. Every official Facebook, Instagram and Australian government link on this page was opened and confirmed working on that date. If you find one that no longer works, please tell us and we will fix it, because a dead link on a page like this is worse than no page at all.

The one thing to know before anything else

There is no Facebook phone number. There is no Instagram phone number. Meta does not run a telephone support line for ordinary accounts, in Australia or anywhere else.

This matters more than any other advice on this page, because the moment you search for help while you are frightened, you will be offered one. There are search results, videos and forum posts that exist purely to put a phone number in front of somebody who has just been locked out. Every one of those numbers belongs to a scammer. They will sound calm and professional, they will ask for a fee, and often they will ask for the very code that lets them finish taking the account.

We have written a separate page about this, because it is the single most dangerous moment in the whole business: why there is no Facebook support phone number, and what the numbers you find really are.

Start here: which account is it?

Open the one that applies, then open the line inside it that matches what happened. Every branch is on this page already, so you can read all of them if you are not sure which you are in.

The trick that resolves more of these than anything else

Once you are back in, close the door behind you

Getting back in is only half of it. If you stop there, a good number of people are back in the same position within a fortnight, because the way in is still open. Work down this list.

1. Change the password, and change it anywhere else you used the same one. If that password was also on your email or your banking, those come first, before the social account.
2. Check the recovery email address and phone number on the account and remove anything you do not recognise. This is the step people skip, and it is the reason accounts get taken a second time a week later.
3. Sign out of all other sessions, so a device the attacker is still holding gets kicked off.
4. Turn on two factor authentication, so a stolen password on its own is no longer enough.
5. Look at what was posted or sent while they had it, so you know what your friends and family received.
6. Tell the people who were messaged, ideally somewhere other than the account that was taken.

The second item is the one almost everybody skips. If the attacker added their own email address as a recovery address, they can simply reset your password again whenever they like, and you will never work out why it keeps happening.

How to recognise the people who prey on this

Recovery scams are their own industry, and they work because they arrive exactly when you are worried and looking for a person to help. Any of these means walk away.

• Anyone offering a phone number. There is no Meta support line. A number is the clearest single sign you are being scammed.
• Paid recovery agents. Services that promise to get your account back for a fee. They have no access Meta does not give you for free, and the usual outcome is that you pay and nothing happens.
• Anyone who messages you offering to help after you post that you have been hacked, especially on Instagram. Watching for those posts is exactly how they find people.
• Anyone asking for an upfront fee, a gift card, a voucher or a cryptocurrency payment. No legitimate service is paid this way.
• Anyone asking for your password or your two factor code. No real Meta process ever asks a person for these. Sharing the code is how the second theft happens.
• Anyone asking to remote control your computer to fix it for you, unless it is somebody you already know and trust.
• A friend asking you to receive a code for them. That friend has already been taken over, and the code is for your account.

If money has gone missing

If someone is threatening to share private photographs

This happens, it happens to adults of every age, and it is a crime committed against you rather than something you have done. The short version is: do not pay, do not send more, and do not delete the evidence. There is a calm page for this at someone is threatening to share my private photos, with the Australian services that deal with it.

If you would rather not do this on your own

None of this is difficult, exactly, but doing it while upset, on a phone, with a clock running, is horrible. If you would like somebody patient sitting beside you while you work through the official steps, that is something we do. To be completely clear about how that works: we will sit with you and read the screen and explain what it is asking, and you type your own password and hold your own phone. We do not take over accounts, we do not ask for your login, and there is no such thing as a fee for recovering an account, from us or from anyone.

Related pages on this site

• My Facebook account has been hacked , the Facebook side in full.
• My Instagram account has been hacked , the Instagram side in full.
• There is no Facebook support phone number , and what the numbers really are.
• Paid account recovery services , why none of them are real.
• Money has been taken , the order to do things in.
• How to spot a scam , the general guide.
• Password managers explained simply , so this does not happen again.