If you cannot log in, your password has changed, or your account is posting things you did not write, act quickly. The longer a hacker has the account, the more likely they are to change the email and phone number on it.
People who message or comment offering to "recover your account" for a fee are scammers, every time. Recovery only happens through Meta's own pages below, and it is free.
If you can still log in
- Change your password immediately, to one you have not used anywhere else.
- Go to Settings, Accounts Center, Password and security, Where you're logged in and log out of every device you do not recognise.
- Check Personal details: make sure the email and phone number are yours. Remove any you do not recognise.
- Turn on two-factor authentication in the same Password and security section. See two-step verification.
- Check Apps and websites connected to the account and remove anything unfamiliar.
If you cannot log in
- Facebook: go to facebook.com/hacked on a browser and follow the steps.
- Instagram: go to instagram.com/hacked, or on the login screen tap Forgot password and then Need more help.
Meta will try to reach you through the email or phone number that was on the account. Look for an email from security@facebookmail.com or security@mail.instagram.com telling you the email was changed; it usually contains a link to secure your account and reverse the change. That link works even after the hacker has changed your password.
If the hacker changed both the email and the phone, Instagram and Facebook may ask you to confirm your identity with a video selfie or a photo of an ID. This is legitimate when it happens inside the app or on the facebook.com or instagram.com websites.
If your account is posting scams to your friends
While you recover it, post from another account or send a message: "My account was hacked. Do not send money or click any link from it." Hacked accounts are commonly used to sell fake investments, sell items that do not exist, or ask friends for money and codes.
How it usually happened
- A message saying your page will be disabled for a copyright violation, with a link to a fake login page.
- A friend's hacked account sending you a link or asking for a code.
- The same password as another site that leaked.
- A "free followers" or "see who viewed your profile" app that asked you to log in.
Keep it from happening again
- A unique password for Facebook and Instagram. A password manager makes this painless. See passwords you can remember.
- Two-factor authentication with an authenticator app rather than SMS where possible.
- Only log in on facebook.com, instagram.com or the official apps. Check the address before typing a password.
- For a business page, give colleagues their own access through Meta Business Suite instead of sharing your password.