Discovering that your Facebook account has been hacked is an unsettling experience. Within minutes, someone else can be messaging your contacts, posting under your name, locking you out completely, or — in the worst cases — using your account to commit fraud or access connected apps and services. The damage can escalate quickly.
The good news is that Facebook has improved its account recovery tools considerably, and acting fast gives you the best chance of regaining control with minimal lasting harm. This guide walks through exactly what to do, in the right order, whether you’re currently locked out or still have access.
How to Tell If Your Facebook Account Has Been Hacked?
Before taking action, confirm what’s actually happening. Not every strange notification signals a hack — sometimes it’s a login attempt that was blocked, or a friend tagging you in something unusual. But these signs suggest genuine compromise:
You’re receiving emails from Facebook about password changes or login attempts you didn’t initiate. Your contacts are receiving messages you didn’t send. Posts are appearing on your profile that you didn’t create. Your account settings — email address, phone number, or password — have been changed without your knowledge. You’re suddenly logged out and can’t log back in with your usual credentials. Facebook’s security alerts are showing logins from unfamiliar locations or devices.
If several of these are happening simultaneously, treat it as a confirmed hack and act immediately.
Steps to Take When Facebook is Hacked
Step 1: Try to Log In and Change Your Password Immediately
If you can still access your account, this is your most urgent priority.
Go straight to your account settings and change your password to something strong and unique — a combination of upper and lowercase letters, numbers, and symbols, at least 16 characters long, and not used anywhere else. If you’ve been using a simple or reused password, this is exactly how accounts get compromised in the first place. A password manager makes it easy to generate and store complex passwords for every account without needing to remember them.
After changing your password, go to Settings > Security and Login > Where You’re Logged In and log out of all other sessions. This immediately ends any active session the hacker may still have.
Step 2: If You’re Locked Out, Use Facebook’s Account Recovery
If the hacker has already changed your password, email address, or phone number, you’ll need to use Facebook’s recovery tools.
Via facebook.com/hacked: Facebook has a dedicated recovery page specifically for compromised accounts. Go there and follow the prompts. You’ll be asked to verify your identity through various means — a trusted contact, your registered mobile number, government ID, or by identifying photos of your friends.
Recover via your email address: If the hacker changed your Facebook password but hasn’t yet changed your associated email, Facebook will send a recovery link to your email address. Act on this quickly — every minute the hacker has access, they may be changing more details.
Via trusted contacts: If you previously set up trusted contacts (friends Facebook can send codes to), you can use these to confirm your identity during recovery.
Identity verification: In some cases, Facebook may ask you to upload a photo of government-issued ID to verify you’re the legitimate account holder. This is slower but effective.
The recovery process can take anywhere from minutes to several days, depending on the method and verification required. Persistence matters — if one method fails, try another.
Step 3: Secure Your Email Account First
This step is critical and often overlooked. If a hacker accessed your Facebook account, they may have also accessed your email — particularly if you use the same password for both, or if your email was the entry point that gave them access to Facebook.
Go to your email provider and change your password immediately. Enable two-factor authentication if it isn’t already on. Check your email account’s recent activity for any sign of unauthorised access — sent emails, password reset requests for other services, forwarding rules the hacker may have set up.
If your email is compromised, your Facebook recovery attempt may be undermined — the hacker could simply intercept recovery emails. Securing email has to happen in parallel with or before your Facebook recovery effort.
This is also a good time to check whether any other accounts linked to that email address — banking, shopping, subscription services — show any suspicious activity. A breach in one place often signals attempts across multiple services.
Step 4: Enable Two-Factor Authentication
Once you’ve regained access, the single most important thing you can do to prevent this from happening again is enabling two-factor authentication (2FA).
With 2FA enabled on Facebook, anyone trying to log in with your password will also need to provide a code from your phone — either via an authenticator app or SMS. Even if your password is compromised in a future breach, the account can’t be accessed without that second factor.
Go to Settings > Security and Login > Two-Factor Authentication and turn it on. Using an authenticator app (like Google Authenticator or similar) is more secure than SMS, since SMS can be intercepted through SIM swapping — a growing threat that our guide on how to protect yourself from SIM swap attacks explains in detail.
Our broader guide on multi-factor authentication covers how 2FA works across different platforms and why it’s now considered essential rather than optional for any account that matters.
Step 5: Review and Revoke Connected Apps
Facebook is often used as a login method for dozens of other apps and services — Spotify, Airbnb, dating apps, games, e-commerce platforms, and more. If a hacker had access to your account, they potentially had access to all of these too.
Go to Settings > Apps and Websites and review every connected application. Revoke access to anything you don’t recognise or no longer use. Pay particular attention to any apps with broad permissions — read contacts, post on your behalf, access your friends list.
For apps where you’ve used Facebook login and that contain sensitive information (particularly shopping apps with saved payment methods), go directly to those services and change your password and review your account activity.
Step 6: Report the Hack to Facebook
Even after recovering your account, formally reporting the hack to Facebook helps in several ways: it flags your account for additional monitoring, can help restore content that was posted without your authorisation, and contributes to Facebook’s understanding of current attack patterns.
You can report a compromised account at facebook.com/hacked. If impersonation is occurring — meaning the hacker created a fake profile using your photos and name — you can also report that separately through Facebook’s impersonation reporting tools.
Step 7: Warn Your Contacts
If the hacker had access to your account for any significant period, they may have sent messages to your friends and family — potentially impersonating you to request money, share malicious links, or gather personal information.
Send a message across all your communication channels — WhatsApp, SMS, email, or another social media platform — letting people know your Facebook was compromised. Ask them to ignore any unusual messages or requests that came from your account, not to click any links that were sent, and not to transfer any money based on those messages.
This is particularly important if the hacker sent urgent requests for money or gift cards. Unfortunately, this is a common scam pattern — using a compromised account to exploit the trust of friends and family.
Step 8: Check for Malware on Your Devices
In many cases, Facebook accounts are compromised not through guessing passwords but through malware installed on your computer or phone — specifically keyloggers and browser stealers that capture your login credentials as you type them.
If you’re not sure how the hack occurred, it’s worth checking whether malware was involved. Signs include your computer running unusually slowly, browser redirects to unexpected pages, unfamiliar programs being installed, or other accounts being compromised around the same time.
Our virus, spyware and malware removal service handles full device scans and removal of any malicious software found. Our guide on 8 common warning signs of malware on your computer can help you assess whether this is likely to be relevant to your situation.
If you suspect your device is infected, running a thorough check before changing any passwords is important — otherwise, you may simply be giving the attacker your new credentials too. Our laptop virus removal service covers Windows laptops specifically, and our antivirus installation and setup service can ensure you have reliable ongoing protection.
How Facebook Accounts Get Hacked: The Common Methods
Understanding how hacks happen helps you prevent them. The most common routes in 2026 are:
Phishing: A convincing fake Facebook login page captures your credentials when you enter them. These pages can appear through email links, SMS messages, WhatsApp messages from compromised contacts, or even search results. Our guide on phishing emails covers how to recognise and avoid them — the principles apply equally to phishing via social media and SMS.
Credential stuffing: If your email and password combination were exposed in a data breach at another service, and you use the same password on Facebook, attackers test those stolen credentials automatically across thousands of sites. This is why password reuse is so dangerous.
Malware and keyloggers: As mentioned above, malware on your device captures credentials as you type. This is particularly common in attacks that arrive via email attachments, fake software downloads, or malicious browser extensions.
SIM swapping: Attackers convince your phone carrier to transfer your number to a SIM they control, then use SMS-based password resets to take over accounts. This is why authenticator apps are more secure than SMS for 2FA.
Weak or guessable passwords: Passwords based on names, birthdays, or common words are vulnerable to dictionary attacks and educated guessing, particularly by someone who knows you.
Session hijacking: On unsecured public WiFi, it’s possible for attackers on the same network to intercept your session. Using a VPN on public networks significantly reduces this risk.
Understanding these vectors also explains why the recovery and prevention steps above target each one specifically.
Preventing Future Hacks: The Security Checklist
Once you’ve recovered your account, set yourself up so this doesn’t happen again.
Use a unique, strong password for Facebook — not used anywhere else. A password manager makes this manageable across all your accounts.
Enable two-factor authentication using an authenticator app rather than SMS where possible.
Review active sessions regularly in Settings > Security and Login to see where your account is logged in. Log out of any unfamiliar devices or locations immediately.
Be suspicious of unexpected messages claiming to be from Facebook, even if they look convincing. Facebook will never ask for your password via email or message.
Keep your email account secure — it’s the master key to almost every other account. A strong password and 2FA on your email is as important as on Facebook itself.
Be cautious on public WiFi. Avoid logging into sensitive accounts on unsecured networks, or use a VPN if you need to. Our guide on tips to avoid being hacked covers the practical habits that meaningfully reduce your risk across all platforms.
Keep your devices clean. Regularly updated operating systems and reliable antivirus software reduce the risk of malware capturing your credentials. Our guide on how to protect your laptop from hackers and viruses covers the practical steps for Windows users specifically.
Audit connected apps periodically. Remove any Facebook-connected apps you no longer use. Every connected app is a potential additional attack surface.
What If You Also Have Business or Facebook Ad Accounts?
If you use Facebook for business — running a Facebook Page, managing ad campaigns through a Business Manager account, or administering groups — a compromised personal account can have far broader consequences.
Hackers with access to Business Manager accounts have been known to run fraudulent ad campaigns charged to linked payment methods, sometimes racking up thousands of dollars in charges before the account holder realises what’s happening.
If your personal account is linked to any business assets on Facebook, report the compromise to Meta Business Support directly in addition to the personal account recovery process, and immediately remove the compromised account’s admin access to your business pages and ad accounts if possible.
For businesses that rely on Facebook as a marketing and customer engagement channel, having robust cybersecurity practices in place — including regular access audits and clear policies about who has admin access — is essential. Our cybersecurity solutions and small business IT support services help Melbourne businesses maintain the kind of security posture that prevents these situations from occurring in the first place.
When to Get Professional Help?
Most Facebook account recoveries can be handled by the account holder directly using the steps above. But there are situations where professional assistance is warranted.
If you suspect your device has been compromised by malware — particularly if multiple accounts across different platforms have been affected simultaneously — professional malware removal and a full device security assessment is the right next step. Trying to recover accounts from a compromised device is counterproductive.
If you’re a business owner who has experienced a breach that may have affected customer data, you may have legal obligations around notification and response under Australian privacy law. Getting professional IT security advice promptly is important in this scenario.
If you’ve suffered financial loss as a result of the hack — either through fraudulent ads, or through contacts being deceived into sending money — report it to Scamwatch and your bank or payment provider as soon as possible.
For device security support, malware removal, or broader cybersecurity advice, get in touch with the Computer Cures team — we provide IT support across Melbourne for both home users and businesses.
Conclusion
A hacked Facebook account is stressful, but it’s recoverable — especially if you act quickly. The priority order is: secure your email first, then recover your Facebook account through the official recovery tools, lock out any active sessions, enable two-factor authentication, check for malware on your devices, warn your contacts, and audit connected apps.
Prevention comes down to three habits that, once established, protect you across all your accounts: unique, strong passwords managed by a password manager, two-factor authentication on every account that supports it, and healthy scepticism toward unexpected login requests and messages. These aren’t difficult changes — they just need to be made consistently.
