If your Facebook profile was hacked, start with your email. Ignore offers of help in comment threads. If you are still logged in on any device, change the password, end unfamiliar sessions and open Facebook’s official facebook.com/hacked flow. Even when the attacker has changed both the email and phone number, preserve evidence and follow Facebook’s instructions in sequence.
Lost access to Facebook: the first 60 minutes
During the first hour, protect your primary email, preserve the trail and use one official route. Never send a password, two-factor code or backup code to anyone. We never ask for those details either.
- Secure the email address that was connected to Facebook. Sign in to the mailbox directly, give it a unique new password, then review active devices, forwarding rules and the backup phone number. Control of that mailbox lets someone undo changes you make on Facebook.
- Search for notices about a new login, changed email address, phone number or password. Save them, take screenshots and see whether the genuine message offers a way to undo the change. Leave suspicious messages that merely look like they came from Meta unopened.
- If Facebook still lets you in, open Settings & privacy, then Password and security. Change the password, sign out unfamiliar devices and check whether someone added an email address, phone number, passkey or two-factor method you do not recognise.
- Type facebook.com/hacked into the browser yourself. Enter the old email, phone number or username and follow the verification screens. Do not rely on a chat link sent by someone calling themselves “support”.
- Warn people you know through another channel. Briefly say that your profile may send scam messages and ask them not to respond to requests for money, links or codes.
If the profile administers a page, group or ad account, check whether another trusted administrator still has access. Review roles and access inside Business settings without sending them your password. Where business assets are at risk, read our guide to types of restrictions to distinguish a takeover from a sanction.
How to tell whether the profile was actually taken over
Being unable to sign in does not by itself prove a takeover. It can be a password problem or a security check after a login from a new device. Stronger signs include a changed profile photo or name, unusual messages to your contacts, notices about unknown devices, or removal of your old email.
Open Facebook from its app or by typing the address yourself. Fake pages often use a familiar logo and urgent wording: “last chance”, “confirm your identity” or “your profile will be deleted”. Read our explanation of fake verification links before entering any details.
Be particularly wary of comments and direct messages from accounts posing as Meta Support. They may ask for an ID image, a code or payment. Open the process from Facebook itself, where no one asks for your password in a chat.
When both the email and phone number were changed
This is the harder scenario. Check every old mailbox, including Spam, for Facebook notices before giving up or creating a new profile. They may show the date of the change and an account-protection action. Screenshot the login screen, unfamiliar email or phone number if visible, and note the approximate time you lost access.
Then use facebook.com/hacked from a device and browser you used with that profile before. A familiar device, network and old account details may help the automated checks connect the request to you. Facebook may ask for identity documentation. Upload it only in the screen opened by the official flow, and only when that screen requests it.
Trying many passwords every minute or submitting conflicting requests from other profiles may create extra security blocks. If you cannot tell whether this is a takeover or a platform sanction, see our cross-platform overview of a deleted or suspended account.
Identity checks and what to prepare
Facebook may ask you to establish that you are the account holder. Follow the form on screen exactly: name, old email, phone number or identity document. Keep required fields visible unless the form specifically tells you otherwise. Keep a copy of what you submitted and of any screen showing a reference number or request date.
Your own traces can also help, without sharing sensitive codes: old login notices, earlier Facebook emails, the approximate creation date, former names and devices you used. They help you put the facts in order if official support asks for more information. A “service” from an unknown profile claiming it can delete a hacked Facebook profile cannot return control of the account that was taken over.
When the profile has business value or the official route has ended without a resolution, we can organise the facts and evidence for your case through a diagnostic review. This review does not replace Meta’s review. We do not ask for passwords, 2FA codes or backup codes.
After you get back in
After you get access back, review the profile’s security. Change the password once more from a clean device, sign out every session and turn on two-factor authentication with an authenticator app. Check the email address, phone number, recovery details, connected apps, administrator list and any posts or messages made during the breach.
Tell your contacts that you control the profile again and ask them to ignore earlier messages. If payments were made or financial requests were sent in your name, retain screenshots and speak to your bank or relevant institution. For prevention, review the rules for organic content and access to pages you manage.
Official sources
Checked on 23 October 2026.