Facebook Account Hacked and Email Changed? How to Recover It

A hacked Facebook account is more than an inconvenience. Attackers use it to message your friends for money, run scam ads on your card, take over Pages you manage and even get the account disabled with policy-breaking posts. The recovery process works, but it rewards doing things in the right order. Here’s what to do if your Facebook account is hacked — including when the email and phone number have been changed.

Signs Your Facebook Account Has Been Hacked

• You can’t log in and your password no longer works
• Your email, phone number, name or birthday has changed
• Friends get messages from you asking for money, codes or to click links
• Posts, stories or ads appear that you didn’t create
• Unfamiliar logins show in Accounts Center → Password and security → Where you’re logged in
• Charges from Meta ads on your card that you didn’t approve
• You’ve been removed as an admin from a Page or business account

How Facebook Accounts Get Taken Over

• Phishing — fake “copyright violation” or “your page will be deleted” messages linking to lookalike login pages
• Reused passwords from other data breaches
• Malicious browser extensions or downloads that steal session cookies, letting attackers skip your password
• Code-sharing tricks — a “friend” asking you to forward a login code
• Compromised email accounts used to reset your Facebook password

Step-by-Step: Recover Your Facebook Account

1. Use a familiar device. Go to facebook.com/hacked on a phone or computer you’ve logged in from before, on a network you normally use. Facebook trusts familiar devices more.
2. Tell Facebook what happened. Choose the option that best describes the problem and enter your email, phone number or username — even if the attacker changed them, old details can still identify the account.
3. If you still control your email or phone, request a reset code, set a new password and choose to log out of other devices.
4. If your email and phone were changed, select the option that you no longer have access to them. Facebook may send a link to your original email letting you undo the change — check that inbox (and spam) for messages from [email protected].
5. Complete identity verification. Facebook increasingly uses a short video selfie, compared with photos on your account. You may also be asked for an ID. Follow the prompts exactly.
6. Wait for a decision. Simple cases can be fast; cases where the email and phone were changed can take days or longer. Don’t submit repeated requests, which can slow things down.

If Your Account Was Disabled

Attackers sometimes post content that breaks Facebook’s rules, which can get the account disabled. In that case you’ll see a disabled notice when you log in and an option to request a review. Explain that the account was compromised and the content wasn’t posted by you. Meta also runs a centralised account recovery hub for its apps; if you have a linked Instagram account, recovering one can help with the other through Accounts Center.

After You’re Back In: Clean Up

1. Log out of everything: Accounts Center → Password and security → Where you’re logged in → select all and log out.
2. Fix your contact details: remove any email or phone the attacker added and make sure yours are confirmed.
3. Turn on two-factor authentication with an authenticator app or security key, not just SMS.
4. Remove unknown apps: Settings → Apps and websites. See our guide to finding apps connected to your accounts.
5. Check posts, messages and Marketplace listings for anything the attacker created, and delete it.
6. Warn your friends with a post or message that any requests for money or codes from you were fake.

Pages, Business Accounts and Ads

If you manage a Page or run ads, attackers often target those first:

• Check Page roles and remove any admin you don’t recognise
• Open Meta Business Suite and review people, partners and ad accounts
• Check Billing & payments for ad charges you didn’t approve, and remove unfamiliar payment methods
• Pause any ads you didn’t create, and contact your card issuer about fraudulent ad spend
• Use Meta’s business support channels if you’ve lost admin access to a Page

Protect Your Account Going Forward

• Use a unique password stored in a password manager
• Keep two-factor authentication on, with backup codes saved offline
• Turn on login alerts for unrecognised devices
• Be wary of copyright, verification and “page violation” messages — they’re common phishing lures
• Review privacy settings — our guide on securing your Facebook account and data covers the key ones
• Keep your email account secure, since it controls your Facebook password resets

Tips That Improve Your Chances of Recovery

Facebook’s automated systems decide many recovery cases, so small details matter:

• Use the same device and location you usually log in from. A familiar phone on your home Wi-Fi looks much more trustworthy than a new laptop on public Wi-Fi.
• Record the video selfie in good light. Face the camera directly, remove sunglasses and hats, and follow the head-turn prompts slowly.
• Make sure your profile has clear photos of you. Video selfies are compared with photos on your account; accounts with no face photos are harder to verify.
• Use your real name as it appears on the account if you’re asked for ID.
• Submit once and wait. Multiple requests in a short time can look suspicious and slow things down.
• Keep an eye on your old email and phone for messages from Facebook while you wait.

How to Help a Friend Whose Facebook Was Hacked

If you receive a strange request from a friend’s account, don’t send money or codes. Call or text them on another channel to confirm. Then help them report the account: go to their profile, tap the three dots, choose Find support or report, and select that the account may be compromised. Reports from friends can help Facebook spot a takeover sooner.

• Start at facebook.com/hacked from a device you’ve used before
• Check your old email for Facebook’s “undo this change” message
• Complete video-selfie identity verification if your email and phone were changed
• Log out all sessions, turn on 2FA and remove unknown apps and admins
• Check Pages and ad accounts for fraudulent charges

Frequently Asked Questions

How long does Facebook account recovery take?

If you still control your email or phone, often minutes. If the attacker changed them and you need identity verification, it can take from a day to several weeks.

Can I recover Facebook without my email or phone?

Yes, through the identity verification route at facebook.com/hacked, which may ask for a video selfie or ID.

Should I create a new Facebook account instead?

Only as a last resort. A new account loses your friends, photos, groups and Page roles, and Facebook’s rules generally allow one personal account per person. Keep trying the recovery route first, and tell friends through other channels so they don’t trust the hacked account.

Why does Facebook keep rejecting my video selfie?

Common reasons are poor lighting, a face partly hidden, or too few clear photos of you on the account. Try again on a familiar device in good light, following the prompts slowly.

Will I lose my photos and friends?

No. Once you recover the account, your profile, photos and friends list are still there, apart from anything the attacker deleted.

Can a hacked Facebook account affect my Instagram?

Yes, if they’re linked in Accounts Center. Check both, change passwords on both, and see our Instagram recovery guide.

The Bottom Line

Facebook recovery works best when you start at facebook.com/hacked on a familiar device, look for the “undo” email first, and complete identity verification patiently. Once you’re back in, log out every session, turn on 2FA, and check Pages and ads for damage. For other platforms, see our guides to WhatsApp and Google account recovery.

Last updated: October 25, 2026. Sources: Facebook — hacked account recovery, PIA.