Has someone taken over your Facebook account or changed your login details?

A friend calls to ask why you are requesting money on Facebook. You open the app and find a message you never sent, or worse, your password no longer works. Move quickly, but do not pay a stranger who promises to recover the account for you.

Start at Facebook’s official recovery page using a device you have signed in with before. If you still have access, change the password and review active sessions. If you are locked out, follow the recovery prompts and protect the email address or phone number connected to the account.

First, check whether the account was actually compromised

A post you did not write, a changed profile picture or an unfamiliar password change can indicate that someone has access. Facebook also lists unrecognised login alerts, changed contact details and messages you did not send as warning signs.

A friend receiving a message from an account with your name does not always prove your own account was hacked. Someone may have created a separate fake profile using your photos. Ask your friend to compare the profile link with yours. A fake account should be reported through Facebook’s impersonation process; your original account still needs securing if you notice unauthorised activity there.

Do not click a recovery link sent by a stranger in a comment or message. Open the Facebook app or type the official address into your browser yourself. Fake “support agents” often use the urgency of a takeover to ask for passwords or verification codes.

Use Facebook’s hacked-account recovery page

If you believe someone accessed the account, visit facebook.com/hacked and follow the instructions. Facebook recommends using a phone or computer you have previously used to log in, if you can.

Open the official recovery page in your browser.
Follow the prompts to identify the account and describe the problem.
Enter the requested details and choose an available way to receive a recovery code.
Complete any identity or security checks Facebook offers.
Set a new, unique password when the process allows you to do so.

The exact prompts depend on the account and what information is still available. A familiar device may help, but it does not guarantee recovery. Keep your phone and email available, and read the screen carefully before submitting information.

If Facebook asks you to confirm your identity, use its official on-screen process. Do not send identity documents to a random person claiming to work for Meta. If you cannot establish that a page is genuinely Facebook, stop and return to the official help centre.

If you can still sign in

Open Facebook settings and look for Accounts Center, then Password and security. Menu labels can change between app versions. Change the password to one you have not used elsewhere. Our guide on creating a strong password explains how to make one that is harder to guess.

Next, look for Where you’re logged in and review sessions. Sign out of devices you do not recognise. An approximate location is not always exact, especially on mobile networks, so consider the device and time as well. If you are uncertain about a session, signing it out and signing back in on your own device is usually a sensible check.

Review the email addresses and phone numbers listed on the account. Remove any you did not add and confirm that your own contact details are correct. If an attacker controls your email account, changing only the Facebook password may not be enough. Secure that email too. Our guide explains how to check whether your email has been hacked.

What if the password, email or phone number was changed?

Try the hacked-account recovery page first. Search for your account using information Facebook accepts, such as an email address, phone number or name. If you have lost access to an old number or inbox, follow any alternative recovery option shown rather than repeatedly requesting codes you cannot receive.

Facebook says that when an account’s email address is changed, it sends a message to the previous address with a link that may let you reverse the change. Check that inbox, including spam, but verify that the message is genuinely from Facebook before opening a link. You can start from Facebook’s Help Center if you are unsure.

Recovery can take time or fail if you cannot complete the checks. There is no legitimate guarantee that a third party can override them. Do not give a recovery service your password, code, identity documents or money simply because it contacted you on social media.

Warn people who may have received messages

Tell friends, relatives and business contacts through another channel that they should ignore unexpected requests for money, codes or links from your account. If you manage a business page, alert colleagues who also have access and ask them to check for unauthorised posts or advertising activity.

Do not assume a message is safe because it comes from a familiar profile. If someone received a payment request, ask them to confirm with you by calling a number they already have. If money or banking details were involved, contact the bank or payment provider through its official channel promptly.

Once you regain access, review recent posts, messages, profile changes and connected accounts. Remove content you did not author where you can, and save evidence of fraudulent transactions before deleting anything that may be needed for a report.

Check pages, apps and payment activity

If your Facebook account manages a Page or advertising account, review the people and permissions associated with it. An intruder may have added another administrator or created an ad. Facebook has a separate process for recovering a hacked Page, so follow that route if the Page itself is affected.

Review connected apps and websites in Facebook settings. Remove unfamiliar access, but check with your employer before removing an app used for work. Inspect payment or advertising activity and contact the relevant payment provider if you find charges you did not authorise.

Check your phone and computer for suspicious apps or browser extensions. Update the device and use reputable security tools where appropriate. If you think the device itself is compromised, use another trusted device to change passwords.

Make it harder for someone to get back in

After recovery, turn on two-factor authentication in Facebook’s security settings. Choose an available method you can use reliably and store recovery codes safely if Facebook offers them. Do not approve a login prompt you did not initiate or share a one-time code with anyone.

Use a unique password for the email account connected to Facebook, too. If you reused the old Facebook password elsewhere, change it on those services. Review your recovery contact details once more after you finish.

A successful password reset is a start, not the whole job. The useful final check is whether your own contact details are present, unfamiliar sessions are closed and the people who received suspicious messages know what happened.