Facebook hacked and then disabled: proving the violations were not yours

When a Facebook account is hacked and then disabled, the appeal has one job: to show that the violations happened while someone else controlled the account, and that you are its rightful owner. Facebook does not publish a separate route for this case. You use the review offered on the login screen and put the takeover at the center of it, with dated security emails, a short timeline and an ID that matches the profile.

Two ways a hacked account ends up disabled

The hacker broke the rules. Takeovers are usually followed by scam posts, fake investment offers, messages to your friends or ads. Any of that can trigger enforcement, and the notice then names a violation you never committed.

Facebook could not confirm the account was yours. Meta’s Terms of Service say it may disable or delete an account “if we detect that someone may have used it without your permission and we are unable to confirm your ownership of the account.” Meta’s Account Integrity policy also lists compromised accounts as a case where Meta may ask for additional information to establish ownership.

The evidence is largely the same in both cases. Only the emphasis changes: in the first, you show the content was not yours; in the second, you show the account is.

The short answer

• Read the screen first. A security check is a recovery; a suspension or disable notice is an appeal.
• Build a dated timeline: when you lost access, what changed, what was posted.
• Collect proof of the takeover: Facebook’s security emails, screenshots from friends, your own reports.
• Appeal once, with the takeover in the first sentence.
• Watch the clock: Facebook allows 180 days to appeal a suspension.
• Secure your email before anything else, or you may lose the account again.

Step 1: Work out which screen you are on

Try to log in on a device you have used before. There are three likely outcomes.

• A security check or hacked-account flow. Follow it to the end. Our guide to recovering a hacked Facebook account covers each step, including what to do when the email and phone were both changed.
• A suspension notice. Facebook’s article on suspended or disabled accounts says you can appeal a suspension within 180 days, a period that varies by region, by logging in and following the prompt.
• A disable notice with no review option. Meta’s page on disabling accounts says it tells you whether you can request another review. If none is offered, the routes are narrower.

If you cannot get past the password because the hacker changed it, start at facebook.com/hacked on a familiar device and see which of these screens appears once you are through.

Step 2: Collect the proof of the takeover

Facebook’s own list of signs that you have been hacked, in its article on recovering a hacked account, works as an evidence checklist:

• emails saying an email address or phone number was added or removed, or your password was changed, when you did not do it;
• messages or notifications that someone logged in, or tried to, and it was not you;
• a profile picture you did not change;
• posts, comments or messages you did not write;
• a two-factor authentication method that suddenly stopped working.

Save the security emails from the inbox that was on the account before the hack, with their dates visible. Facebook says that when the email on an account is changed, it writes to the previous address, so start your search in that inbox. Check each sender against Facebook’s list of genuine email domains so you do not attach a phishing email as evidence.

Add what other people saw. Friends can screenshot the scam posts or messages sent in your name, with dates. If you reported the hack to Facebook, your bank or the police, keep the reference numbers.

In our experience, the most persuasive single item is the first security email. It fixes the moment control changed hands, and every violation dated after it belongs to someone else.

Step 3: Write the timeline

One short paragraph, dates first. A reviewer should be able to check every line:

I am [legal name], and this has been my account since [year]. On [date] I received a Facebook security email at [old address] saying my email had been changed to an address I do not own. I lost access the same day. The posts and messages behind this decision were made after that date by the person who took over the account. I have since secured my email. ID attached.

Keep it factual. Do not guess who did it and do not list every post. If the notice names the violation, mention it once.

Step 4: Submit, then secure everything around it

Submit the appeal once, with the ID the flow asks for. Facebook’s ID guidance says that when you have lost access, you may be asked for a document whose photo or date of birth matches the details on the account. A hacker who changed the name or profile photo can make that match harder, so mention the original name in your timeline.

At the same time, lock down everything around the account. Change the password and turn on two-factor authentication for the email that was linked to Facebook, delete forwarding rules you did not create, and change any other account that used the same password. If the attacker can still read your email, a restored account can be lost again within days.

Pages, groups and ads during a takeover

Hackers often add themselves to Pages and ad accounts and then remove the real owner. Facebook’s Page recovery form requires you to be logged in, so it usually comes after the profile is back. If another person still has full control of the Page, they can keep it running while you appeal. Our guide to Pages and ad assets after a profile disable covers the rest. If unauthorized ads were charged to your card, contact your card provider too; that dispute runs separately from the appeal.

What weakens a hacked-account appeal

• Several appeals telling different stories. Meta’s Terms prohibit duplicative or groundless appeals, and one complete submission reads better than five partial ones.
• A new account in the meantime. Meta’s Terms say that once it disables your account for a violation, you agree not to create another without its permission. A new profile looks like evasion at the moment you need to look like the victim.
• Paying a “recovery agent”. Fake recovery services target hacked users within hours. They cannot reach a reviewer, and they often take a payment, your login codes, or both.
• Waiting. The appeal window keeps running while you gather evidence. Gather what you have in a day, then submit.

When to get help

If your evidence is clear and the account is personal, you can file this yourself. Help is worth it when the security emails are gone, when the hacker changed the name and photo so the ID check fails, when a business Page or ad account was taken as well, or when a first appeal has already been rejected. That is the casework behind our Facebook account recovery service: we rebuild the timeline, prepare the evidence and submit through official channels only. We cannot promise an outcome, and if the violations look like your own activity, we will tell you. Start with a free case review.