If Facebook is sending messages you did not write, posting links you do not recognize, or rejecting yesterday’s password, assume someone else has access. Use Meta’s official recovery tools and ignore anyone offering account recovery through DMs.
Does this affect you?
Use this for personal Facebook accounts in the app, on a tablet, or at facebook.com when you can still sign in but see suspicious activity, or when the password and recovery details no longer work.
If you can still log in
Secure the account first, then clean up what the intruder changed.
- Open Facebook or facebook.com and sign in.
- Go to Settings & Privacy > Settings > Password and Security.
- Choose Change Password and set a new password you have never used anywhere else.
- Open Where You’re Logged In or Security and Login and review devices and locations.
- Log out sessions you do not recognize, or use Log Out of All Sessions to force every device to sign in again.
- Turn on two-factor authentication from the same security area.
- Open Apps and Websites and remove apps you do not recognize. Attackers sometimes connect an app so access survives a password change.
If you are locked out
Use Facebook’s recovery flow from a browser when possible.
- Go to facebook.com and select Forgot Password on the login screen.
- Search for the account using the email, phone number, name, or username tied to it.
- Choose a recovery code by email or SMS if Facebook still shows a method you control.
- Enter the code and create a new password.
- If the hacker changed the contact details, choose No longer have access to these if the option appears.
- Follow Facebook’s identity prompts. It may ask for photo ID or another proof method.
- Once you are back in, immediately change the password, log out other sessions, check connected apps, and turn on two-factor authentication.
Turn on two-factor authentication
This is the strongest prevention step after recovery.
- Go to Settings & Privacy > Settings > Password and Security > Two-Factor Authentication.
- Choose an authentication app, SMS code, or security key. An authentication app is usually the best balance of security and convenience.
- Follow the setup prompts, such as scanning a QR code or entering a text code.
- Save the backup codes Facebook provides in a password manager or another safe place.
More control
Report the hack directly
Use facebook.com/hacked to formally mark the account as compromised. This can help if the attacker changed linked contact details before you regained control.
Warn recent contacts
If scam links, fake giveaways, or urgent-money messages went out, post a short notice telling friends to ignore anything unusual sent recently.
Change reused passwords elsewhere
Many Facebook takeovers begin with a password leaked from another site. If that password was reused for email, banking, shopping, or other accounts, change those too.
Sources
- Meta Help Center – My Facebook account is compromised (2025)
- Meta Help Center – What to do if you think your Facebook account was hacked (2025)
- Meta Help Center – Recover your Facebook account if you cannot access it (2025)