Quick Answer: Open Facebook’s hacked-account recovery tool on a familiar, trusted device. Secure the email account used for recovery, follow the options offered for your account, then review passwords, sessions and recovery details. Getting back in is not guaranteed, and there is no single review time or identity-check method for every case.
Recovering a hacked Facebook account has two parts: proving that the account is yours and removing the ways someone else can still use it. This guide helps you choose the right route, protect your remaining access and check the account after you get back in.
Where Should You Start?
Use the official hacked-account route when you suspect someone else has access. If you simply forgot a password and have no sign of compromise, the ordinary forgotten-password option may be appropriate. A disabled account or an impersonating profile is a different problem; choose the matching official help route.
Use Facebook’s Official Hacked-Account Route
Type facebook.com/hacked yourself or use Meta’s account recovery hub. Follow the questions and checks you actually receive. Do not use a recovery address or telephone number supplied by an unsolicited message or a search advertisement.
Use a device you normally signed in with when it is safe to do so. Meta says its recovery systems recognise familiar devices and locations. If you suspect malware or remote access on that device, secure it or use another trusted device; familiarity is not a reason to enter a new password into a compromised computer.
Keep a Working Session Open and Secure Your Recovery Email
Check whether a trusted phone, tablet or browser still has a working Facebook session. It may let you inspect account information or start security checks, but it does not guarantee you can change every setting or bypass identity verification.
Do not casually sign out of your only working session before you know your recovery options. Secure a compromised recovery email through its own provider, ideally on a trusted device. See our email-security guide. If the working session is on a device controlled by someone else, prioritise a safe device and the official recovery process.
Choose the Next Step Based on What You Can Still Access
Identify what still works: a signed-in session, a recovery email or phone, and any saved second-factor method or recovery code. These are separate routes. A working email address does not necessarily overcome an attacker’s changes to Facebook authentication.
What If You Are Still Able to Log In?
If you can still sign in, act promptly. Review the account’s security settings and use the official hacked-account guidance rather than assuming a password change alone has removed the attacker. Menu wording can vary between app versions and account experiences.
Check Your Contact Details Before Changing Anything
Inspect the recovery email addresses and phone numbers. Add or confirm a contact method you control before removing a necessary working route, where the service permits it. Remove unfamiliar details through Facebook’s controls. If an action asks you to confirm using a contact method you do not control, return to the official recovery flow rather than guessing codes.
Change Your Password and Review Unfamiliar Sessions
Set a new, unique Facebook password through the app or website’s account-security settings. Do not reuse the old password with a small change. Updating the saved entry in a password manager is not the same as changing the password at Facebook.
Review signed-in devices and use the available logout controls for sessions you do not trust. Do not assume that changing a password ended every session or removed every connected app. Location names can be approximate, so consider the device, time and your own activity together rather than treating an unfamiliar city alone as proof of hacking.
Check for Changes You Did Not Make
Look for posts, messages, profile changes, friend requests or other actions you did not make. Keep the minimum evidence needed for a report before removing harmful material. A restored login does not undo what contacts already received or recover money someone sent.
What If You Are Locked Out?
If you cannot sign in, use the recovery options presented for your account. Distinguish a wrong password from loss of an email or phone, a second-factor problem, or an account suspension. Repeatedly guessing passwords or codes is not a recovery plan.
Important: recovery can fail when Facebook cannot establish ownership. Do not pay someone who promises guaranteed restoration or asks for your password, authentication code or identity documents outside an official process.
If Your Password Was Changed but You Control Your Email or Phone
If you still control a linked email or phone, follow the official password-reset or hacked-account prompts as appropriate. Request a code only through the app or address you opened yourself, and enter it only in that same recovery process. Check which destination is displayed before assuming a message will arrive at your current address.
If Your Email Address or Phone Number Was Changed
If the attacker changed your email or phone, continue through the hacked-account flow and select the options matching that loss of access. Meta describes adaptive checks and, for eligible cases, identity verification such as an optional video selfie. Use only the method offered to your account; do not assume every account can upload an ID or that any method guarantees success.
If You Cannot Pass a Two-Factor Authentication Check
If a second-factor check blocks you, use an available method you already control, such as a saved recovery code, when the official flow offers it. If no usable method remains, follow the recovery choices shown. Never give a code to someone claiming they need it to repair the account. Our recovery-code scam guide explains that trap.
If Facebook Cannot Verify Your Identity or the Recovery Flow Stalls
If the flow stalls, read the error or next-step instruction and keep a private note of what you submitted and when. Use the support options shown in the official app, Help Center or Meta recovery hub. Support features vary by account and availability. Meta’s March 2026 announcement described login-assistant access starting with selected cases in the US and Canada; do not assume it is available for every locked-out account. Avoid repeated identical submissions while a review is pending.
How Do You Secure the Account After Regaining Access?
After regaining access, review both account control and any harm caused while you were locked out. A new password, session logout, connected-app removal and recovery-contact change do different jobs. Complete each relevant check rather than treating one success screen as the end.
Remove Unfamiliar Sessions, Contact Details and Connected Apps
Review unfamiliar sessions, recovery contacts and apps or websites connected to Facebook through the available account settings. Remove access you no longer trust. Removing a connected app does not necessarily delete information it previously received; use that provider’s privacy or deletion process separately if needed.
Set Up Two-Factor Authentication and Save Recovery Options
Review the second-factor methods registered to the account, removing unfamiliar methods where possible and setting up a supported method you control. An authenticator app avoids dependence on SMS delivery, but it still needs its own recovery plan. Save recovery codes privately and separately from the device they help recover. Do not share them with a helper.
Check for Harmful Activity and Warn Affected Contacts
Warn affected contacts through a trusted route if the attacker sent messages or payment requests. Tell them to ignore the requests and verify any later request independently. If a Page, advertising account or business asset was affected, review its roles, access and billing separately; recovering the personal profile does not prove those assets are secure.
Replace Reused Passwords and Protect Your Email Account
Change a reused Facebook password at other services where it was used. Protect recovery email with its own unique password and supported strong authentication. If a recovery code or payment information was exposed, address that specific exposure too; a Facebook password reset does not replace another service’s code or resolve an unauthorised payment.
Regaining Access Is Only the First Step
Getting back into a hacked Facebook account resolves the immediate problem, but not how the hacker got in. If your password was reused elsewhere, taken through a phishing message or exposed in a data breach unrelated to Facebook, the same weakness could be used against you again.
Review your Facebook privacy settings once your account is secure. Limiting who can see your friends list, email address and phone number can make it harder for someone to target you with a convincing phishing attempt. If you’re unsure how the breach happened, check whether your email or other accounts show signs of compromise, since attackers often move between linked accounts after gaining access to one.
Frequently Asked Questions
Is it possible to get a hacked Facebook account back?
You may be able to recover it through Facebook’s official hacked-account process, but success depends on verifying ownership and the available options. Avoid anyone offering guaranteed recovery, and do not rely on a fixed completion time.
Can I recover my Facebook account without access to my email or phone?
Start with the official hacked-account process on a familiar, trusted device and follow the alternatives offered. Identity-check options vary. An ID upload or video selfie may be offered in an eligible case, but neither is a universal fallback.
What should I do if a hacker changed my password, email and phone number?
Use facebook.com/hacked and identify which contact details or security methods you no longer control. Follow the checks offered and preserve the confirmation or instructions you receive. Review times vary; follow the instructions and status shown for your case.
How can I tell whether my account was hacked or someone made a fake profile?
A hacked account means someone has gained access to your actual login, so you may be logged out or see posts and messages you didn’t create. A fake or imposter account is a separate profile using your name and photos. Facebook handles these through its impersonation reporting tools, not the hacked-account recovery flow.
What if my Facebook Page was also taken over?
Treat the Page or business asset as a separate access problem. Use the matching Page or business support option offered by Meta and review administrators, permissions and billing after recovery. Restoring a personal profile does not automatically restore Page control.
Sources
Meta: official account recovery and support; Meta: adaptive recovery and support availability, updated March 2026; Meta: identity-verification options and regional rollout.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.