A hacker added their account to your Meta Accounts Center: removing it and locking them out

An account you do not recognize in your Meta Accounts Center is a way back in for whoever added it. Meta’s help center says accounts in the same Accounts Center can use their login information to log in to each other, and that from early 2026 this works for all accounts in an Accounts Center by default. Remove the account under Accounts, then log out every session you do not recognize, change your password and turn on two-factor authentication.

This guide covers why attackers add an account, how to check it is not something harmless, how to remove it, and what else to check while you are in there.

The short answer

• What it means: someone with access to your account linked an account they control. It lets them log in without your password.
• Check first: an old account of your own, or one added by a partner, agency or family member, can look unfamiliar.
• Remove it: Accounts Center, then Accounts, then Remove next to the account.
• Then lock down: log out unknown sessions, change the password, turn on two-factor authentication, confirm your email and phone.
• Locked out already? Start at instagram.com/hacked or facebook.com/hacked instead.

Why an attacker adds their account

Accounts Center is where Meta links your Facebook, Instagram and other Meta accounts. Meta’s page on connected experiences lists what linking enables, and the first item is the one attackers care about: “When you enable logging in with accounts, you’ll be able to use login information from one account to log in to other accounts you have across Meta apps, as long as these accounts are added to the same Accounts Centre.”

Meta is also removing the switch for it. Its page on managing connected experiences says: “Starting early 2026, the connected experience, Logging in with accounts, will no longer be available, and all accounts will be able to log into each other by default.”

Put those two sentences together and the attack is simple. If an attacker’s Facebook or Instagram account sits in the same Accounts Center as your Instagram, they can log in to your Instagram with their own account. Changing your password alone may not close that route, because they are not using your password. In our experience, this is why some owners recover an account, change everything, and lose it again within a day.

The same page lists other connected experiences, including syncing your name, profile picture and username across profiles, and sharing posts, stories and reels between Instagram and Facebook. A linked account in the wrong hands can use those too.

Check for an innocent explanation first

Not every unfamiliar entry is an attacker. Before you remove anything, rule out the common harmless cases:

• An old account of your own, such as a Facebook profile you made years ago and forgot.
• A team member’s setup. An agency, social media manager or assistant may have linked an account while managing yours.
• A shared device. A partner or family member who used your phone may have linked their account by mistake.

If someone you know added it, ask them to remove it or remove it yourself, and move them to a proper access method that does not involve your login. If nobody can explain it, treat it as hostile and remove it now.

How to remove it

Meta’s page on managing which accounts are in your Accounts Center gives the steps:

1. Open Accounts Center from the settings of Instagram or Facebook.
2. Tap or click Accounts (or Manage accounts).
3. Tap or click Remove next to the account you want to remove, and follow the prompts.

Three details from Meta’s help pages matter here:

• Profiles go with it. Meta says that when you remove an account from an Accounts Center, any profiles associated with that account are also removed.
• One Facebook account per Accounts Center. Meta says you can only add one Facebook account to an Accounts Center. If the attacker’s Facebook account is the one in there, yours cannot be added until theirs is removed.
• Your own Instagram may need a password. Meta’s connected experiences page says that if you remove an Instagram account created via Facebook from an Accounts Center, you will be required to create a password for it. Make sure you can receive email at the address on the account before you start.

If the removal does not go through, for example because Meta asks you to confirm with an email or phone number you no longer control, stop and treat the whole account as compromised. That is a recovery case, covered further down.

Lock them out of everything else

Removing the linked account closes one door. Attackers who had enough access to link an account usually opened others. Work through Accounts Center in this order. Meta’s list of Accounts Center settings shows where each one lives.

1. Password and security, then Where you’re logged in. Facebook’s help page on logging out of other devices says each session shows a date, time, location and device type, and that you can select individual devices to log out, or select all. Do this for each of your accounts.
2. Change your password. Use one you have never used anywhere else.
3. Two-factor authentication. Turn it on, or check that the method is yours: your phone number, your authentication app. In our experience, attackers sometimes add their own.
4. Login alerts. Make sure alerts about new logins go to an email address and phone you control.
5. Personal details. Confirm the contact email and phone number are yours, and that your birthday has not been changed.
6. Recent emails. Under Password and security, both apps keep a list of the emails Meta actually sent you. Our guide to telling real Meta emails from fake ones explains how to use it, and it also helps you spot changes you did not make.

Then secure the email inbox behind the account. If an attacker can still read it, they can request a reset and link a new account all over again.

Other signs worth checking while you are there

An unfamiliar linked account rarely comes alone. Look for posts or messages you did not send, a username or profile photo that changed, and third-party apps you did not connect. Our guide to the signs that your Instagram has been hacked lists eight of them, with how much weight each one deserves.

If you are already locked out

If the attacker changed your password, email or phone before you noticed, you cannot reach Accounts Center, and the steps above have to wait.

• Instagram: Instagram’s hacked account page says that if someone gains access to your account or you are unable to log in, you should visit instagram.com/hacked to secure it. Our guide to recovering an Instagram account after the email was changed walks through the full sequence.
• Facebook: Facebook’s help center says to visit facebook.com/hacked on a device you have used to log in to Facebook before.

Once you are back in, come straight back to Accounts Center and remove the attacker’s account before anything else. Until it is gone, recovery is not finished.

What not to do

• Do not only change your password. With a linked account in place, the attacker may not need it.
• Do not leave a team member’s account linked “for convenience”. Use proper access tools instead, so that one compromised account does not open all the others.
• Do not click links in emails about Accounts Center without checking them against Recent emails first. In our experience, fake Meta security notices are one of the most common ways in.
• Do not hand your login to anyone offering to “unlink” accounts for you. Removal takes a minute and needs nobody else.

When to get help

If you could remove the account and lock everything down, you have done what needed doing, at no cost. Help is worth it when removal fails, when you are locked out and the identity check is not working, or when the accounts involved carry a business, ad accounts or creator income. That is the work behind our hacked account recovery service. We work only through Meta’s official recovery channels, we never ask for your password or login codes, and we cannot guarantee an outcome, because the decision is Meta’s. Start with a free case review.