Facebook hacked and the password changed: the official recovery steps, in order

If your Facebook account was hacked and the password was changed, go to facebook.com/hacked on a phone or computer you have used to log in before, and follow the steps. If the hacker also changed your email address, check your old inbox first: Facebook sends the previous address a message with a special link that reverses the change. If you can no longer reach the email or the phone on the account, Facebook’s recovery flow lets you add new contact details and confirm your identity instead.

That is the whole official process. The rest of this guide puts it in order, with the details that decide whether it works.

The short answer

• First: search the old email inbox for Facebook’s security email and use its link to reverse the change.
• Then: open facebook.com/hacked on a device you have used for Facebook before.
• Email and phone both gone? Use facebook.com/login/identify on a familiar device and choose “No longer have access to these?”.
• Asked for ID? One government ID with your name and date of birth or photo, or two non-government documents.
• Back in? Log out unknown devices, undo the hacker’s changes, turn on two-factor authentication.
• Never: pay a “recovery expert” or share a login code with anyone.

Step 1: Find Facebook’s security email

Facebook’s Help Center article on recovering a hacked account says that when the email address on an account is changed, Facebook sends a message to the previous email address with a special link. Clicking it reverses the change and secures the account. The same article lists the emails that signal a takeover: a notice that an email address or phone number was added or removed, or that your password was changed, when you did not do it.

Search the inbox that was on the account before the hack, including spam and promotions folders. Facebook does not publish how long the link stays valid, so use it as soon as you find it.

Check the sender before you click. Facebook’s guide to checking whether an email is really from Facebook says its messages only come from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, metamail.com or global.metamail.com, or their subdomains, and warns about misspelled versions of those names. Facebook also says it will never ask for your password in an email.

Step 2: Start at facebook.com/hacked, on a familiar device

The page at facebook.com/hacked opens with “What to do if your account has been hacked” and walks you through a series of security steps. Facebook asks you to start on the device you usually use for Facebook, and its help pages repeat the point several times. An old phone or a family laptop you once logged in from counts.

Facebook also says you may be able to recover your account through facebook.com/hacked even if you are not sure it was compromised. In our experience, when the hacker changed only the password and left your email or phone in place, this flow is usually the quickest way back.

Step 3: When the email and phone were both changed

This is the case most people are searching for, and Facebook has a dedicated article on it: recover your account if you can’t access your email address or mobile phone number. Its steps, in order:

1. Try every contact you might have used. Older email addresses and phone numbers may still be on the account. With a phone number, include the country code (+1 for the United States).
2. Recover the email account first if the hacker got into it. Facebook suggests contacting your email provider.
3. Find the account on a familiar device. Go to facebook.com/login/identify and enter an email, phone number, account name or username. If you do not know your username, a friend can copy it from your profile’s web address.
4. Select “No longer have access to these?” You may see “Forgotten account?” or “Recover” instead.
5. Add new contact details. Facebook says the email or phone number must not have been used on your Facebook account before.
6. Confirm the account is yours, then set a new password.

Step 5 trips people up. Your old address does not qualify, and neither does anything the hacker added. Use a fresh address that only you can reach.

Step 4: If Facebook asks for ID

The identity check is where most recoveries are decided. Facebook’s list of accepted IDs says you can send one government ID, such as a passport, driving licence or national identity card, showing your name and date of birth, or your name and a photo. Without a government ID, you can send two non-government documents, such as a student card or proof of employment. Both must show your name, and at least one must show your date of birth or a photo. If you have lost access to the account, Facebook may ask for a document whose photo or date of birth matches the details on the account.

In our experience, ID photos are rejected when they are blurry, badly lit, missing information, a picture of a screenshot or photocopy, or not fully in frame. It does not accept images that were digitally edited to hide information, but you can physically cover details it does not need, such as an ID number, before you take the photo. Send only what is asked; Facebook says extra documents can delay the review.

Step 5: Lock the hacker out for good

Recovery without cleanup invites a second takeover. Once you are back in:

• Secure the email first. Change its password, turn on its two-factor authentication and delete any forwarding rule you did not create. In our experience, an inbox the attacker can still read is the most common reason a recovered account is lost again.
• Log out strangers. Facebook’s help points to the “Where you’re logged in” section of your settings, where you can select an unfamiliar device or location and log it out.
• Undo the changes. Check the email, phone number, name and profile photo, and remove anything you did not add.
• Use stronger logins. Facebook recommends a unique password, two-factor authentication and passkeys. Its Advanced Protection setting is required for some accounts, including accounts in business portfolios that advertise with Meta.

If the hacker also took a Facebook Page you manage, Facebook has a separate Page recovery form. You can submit it only while logged in and only if you recently lost access to the Page. Facebook says it aims to reply within a day, though some reviews take longer.

If you see a disabled notice instead

Sometimes the login screen shows a suspension or a disable rather than a security check. Meta’s Terms of Service say it may disable an account if it detects that someone may have used it without permission and it cannot confirm your ownership. That is a different problem with a different route, and our guide to suspended, disabled and locked accounts shows how to tell which one you have.

Meta’s Account Recovery Hub brings together the official recovery steps for Facebook, Instagram and Threads, and our guide to the hub explains what it covers and what it does not.

What not to do

• Do not pay for recovery. Comments and messages offering to “get your account back” appear within minutes of a public post about a hack. They want codes, passwords or money. Our breakdown of recovery scam messages shows the scripts, and they are the same on Facebook.
• Do not share login codes. Anyone who asks for one is trying to take the account.
• Do not open a second profile while you wait. Meta’s Terms say each person should create only one account, their own. In our experience, a duplicate profile also makes the original case harder to explain.
• Do not start from a new phone in a new place if an old device exists. Facebook’s help asks for a familiar device for a reason.

When to get help

In our experience, many hacked Facebook accounts come back through the steps above, at no cost. Help is worth it when the identity check keeps failing, when the account held a business Page or ad account, or when the hack ended in a disable. That is the work behind our Facebook account recovery service: we work out which official route your case belongs to, prepare the evidence and follow it through. There is no guaranteed outcome and no back door, and if the case has no basis we tell you. Start with a free case review, and never share your password or login codes with us or anyone else.