How Scammers Hack Facebook Accounts (and How to Stop Them)

Scammers take over Facebook accounts through phishing links, reused passwords and fake login pages. The methods they use to hack these accounts rely on tricking you, not breaking encryption. Turning on two-factor authentication blocks almost every automated takeover attempt. Your risk changes based on three things: whether you reuse passwords, if your phone number is public, and how often you click links in messages. The rest of this page covers each one.

Who needs this Facebook account security guide

Three different people search for this topic. The first has already lost access to their profile and needs recovery steps right now. They don’t need prevention tips yet; they need the compromised account form on Facebook’s help center. The second person noticed a strange login alert or a message they didn’t send. They want to know if someone is inside their account and what to lock down first. This page serves them best, assuming they can still log in with their normal password. The third reader hasn’t seen any warnings at all. They just read a news story about stolen profiles and want to tighten their settings before anything happens. If that’s you, skip the recovery table and start with the setup steps below. This page assumes you still control your email address and phone number. If a scammer changed both, you’ll need Facebook’s identity verification process instead.

What actually lets them in

Five specific weaknesses decide whether a scammer gets into your profile or bounces off it. Order matters here, because fixing the biggest gap first does the most work. Password reuse causes more takeovers than clever hacking tricks. If you use the same password on Facebook and a small forum that got breached last year, scammers run automated tools to test that pair everywhere. Check if your email appears in a known breach by visiting Have I Been Pwned and searching your address. Phishing messages arrive as direct messages from friends whose accounts are already taken over. The link leads to a page that looks exactly like Facebook’s login screen but sends your typed password straight to the scammer. If the web address doesn’t start with “facebook.com” or “meta.com”, close the tab immediately. Session hijacking happens when you install a malicious browser extension or approve a rogue app. That tool steals the active login cookie, so the scammer doesn’t even need your password. Review your connected apps in Facebook settings and remove anything you don’t recognize. SIM swapping targets your phone number. A scammer calls your mobile carrier pretending to be you and moves your number to their SIM card. Then they request a Facebook password reset via SMS. If your carrier offers a port-out PIN or account lock, turn it on today. Public personal details give scammers the answers to your security questions. Birthdays, pet names and hometowns listed on your profile let them bypass password resets. Hide these fields from public view. The thing people get wrong most often is trusting a message just because it comes from a friend’s name. That name means nothing once their account is compromised.

Steps to stop scammers who hack Facebook accounts

Follow these actions in order while you’re logged into your real account on a device you trust. Don’t rush; skipping a step leaves a gap they’ll find.

1. Go to Settings & Privacy > Settings > Security and Login. Look at the “Where you’re logged in” list. Tap the three dots next to any session you don’t recognize and select Log Out.
2. Click “Change password” in the same menu. Type a new password that’s at least 16 characters long and uses words unrelated to your life. Don’t reuse any password from another site. Save it in a password manager like Bitwarden or 1Password.
3. Find “Two-factor authentication” and click Edit. Choose an authenticator app such as Google Authenticator or Authy rather than SMS text messages. Scan the QR code shown on screen and type the six-digit number the app generates to confirm it works.
4. Scroll down to “Setting Up Extra Security” and generate backup codes. Write these ten codes on paper and put them somewhere safe at home. You’ll need one if you lose your phone.
5. Click “Get alerts about unrecognized logins.” Turn on notifications for both email and Facebook alerts. You’ll get a message instantly if someone logs in from a new device.
6. Go to Settings > Apps and Websites. Remove every app you no longer use. Any app left here holds a key to your profile data.
7. Open your profile, click About, and change the privacy setting for your phone number, email and birthday to “Only me.”
8. Send a message to your close friends outside of Facebook—by text or call—to tell them your account was targeted. Ask them not to click links from you until you confirm everything is secure.

The single judgment call that separates a locked account from a vulnerable one is choosing an authenticator app over SMS for two-factor authentication. SMS can be intercepted through SIM swaps, but an app generates codes locally on your device. If a scammer asks you to forward a code sent to your phone, hang up and contact your bank or service provider directly.

How different attacks compare

Each takeover method requires a different defense. Match the situation you’re facing to the right response in the table below.

Situation	Action needed	Effort required	Warning sign
Friend sends weird link	Don’t click, message them elsewhere	One minute	Urgent language asking for help
Unknown device logged in	End session, change password	Five minutes	Login alert email arrives
Lost phone with authenticator	Use printed backup code	Two minutes	App won’t open on new phone
Email password reset you didn’t ask for	Ignore it, check active sessions	Three minutes	Multiple reset emails in one hour
Carrier says SIM was changed	Call carrier fraud department immediately	Thirty minutes	Phone suddenly shows no signal
App requests full permissions	Deny and remove the app	Two minutes	Asks to post on your behalf

Details that keep your Facebook profile safe

Checking active sessions

Open the “Where you’re logged in” menu weekly. Facebook lists the device type, location and time for every active connection. If you see a login from a city you’ve never visited, end that session immediately. Don’t just look at the city name. Scammers route traffic through proxy servers, so the location might match yours while the device model is completely wrong. A login showing your hometown on a device you don’t own is still a breach.

Handling suspicious messages

If a friend asks for money or a verification code through Messenger, verify it by calling their actual phone number. Scammers who take over an account immediately message the victim’s friends list. Never type your password after clicking a link inside a message. Instead, open a new browser tab and type facebook.com yourself. The Federal Trade Commission warns against giving out personal information through unsolicited links at consumer.ftc.gov. Bookmark the real login page so you don’t have to guess the address.

When Facebook login problems happen

Use this table to match what you see on your screen to the correct fix. Don’t try advanced recovery steps if a simple password reset solves it.

What you notice	What it usually means	What to do first	How to stop it happening again
Password rejected suddenly	Someone changed it	Use trusted contacts or ID upload	Enable two-factor authentication
Friends report spam from you	Session token stolen	Log out all devices	Remove unknown browser extensions
Can’t receive SMS code	SIM swapped or delayed	Use authenticator app instead	Add carrier port-out PIN
Login page looks slightly wrong	Phishing site loaded	Close tab, clear cache	Type URL manually every time
Weird apps posting automatically	Rogue app authorized	Revoke app permissions	Review connected apps monthly

Rules around hacked accounts

Facebook’s Terms of Service prohibit sharing your login credentials with anyone else. If you give your password to a “recovery service,” you violate those terms and risk a permanent ban. Only Meta’s official forms handle compromised accounts. In the US, unauthorized access to a computer system violates the Computer Fraud and Abuse Act. If a scammer empties a linked bank account after taking your Facebook profile, local law enforcement handles the financial crime, not Facebook’s support team. File a police report before contacting your bank. In the European Union, the General Data Protection Regulation requires companies to notify you of certain data breaches. If a third-party app leaks your Facebook data, the app developer must report it to their national data protection authority. If you suspect identity theft beyond social media, freezing your credit file stops scammers from opening loans in your name. Contact the major credit bureaus directly to place a freeze. Don’t pay third-party sites to do this for you.

What securing your account costs

Locking down your Facebook profile costs zero dollars if you do it yourself through the settings menu. The platform provides two-factor authentication, login alerts and session management without charging a fee. Time is the real currency here. Running through the eight setup steps above takes about fifteen minutes the first time. Checking your active sessions afterward takes under two minutes a week. Authenticator apps like Google Authenticator or Authy are free to download on iOS and Android. Hardware security keys, such as a YubiKey, are inexpensive relative to the alternative depending on the model you choose. A key adds physical protection, but you only need one if your threat level involves targeted harassment rather than random spam bots. Password managers range from free tiers to paid plans that are inexpensive relative to the alternative. The paid versions sync across devices, which saves time if you log in from both a phone and a laptop. If you’ve already been locked out, the cost shifts to hours spent verifying your identity. Meta doesn’t charge for account recovery, but the delay might cost you business leads or personal connections while your profile stays offline.

Keeping your Facebook security tight

Security isn’t a task you finish once. Leave login alerts turned on permanently so Facebook emails you the moment a new device connects. Read that email every time it arrives. Check your “Apps and Websites” list on the first day of each month. Developers update their apps constantly, and an old game you forgot about might gain new permissions you never approved. Remove anything you haven’t used in thirty days. Keep your backup codes in the same place you store important documents. If you move houses or buy a new phone, transfer those codes before you wipe the old device. Losing your phone and your backup codes at the same time means waiting days for manual identity review. Update your authenticator app whenever your phone’s operating system asks you to. An outdated app can fail to generate the six-digit codes you need to log in. The sign that your setup needs attention again is silence. If you haven’t received a login alert or checked your sessions in six months, you’ve likely stopped paying attention. Set a calendar reminder to review your settings twice a year.

When these Facebook security steps won’t work

If a scammer already changed your password, email address and phone number, the standard settings menu won’t load for you. You need to visit facebook.com/hacked and follow the identity verification flow, which requires uploading a government-issued photo ID. If the account belongs to a deceased family member, you can’t log in to secure it. A verified immediate family member must submit a memorialization or deletion request through Facebook’s Help Center using a death certificate. If your workplace manages your Facebook Business Page through Meta Business Suite, personal security settings don’t cover company assets. Your IT administrator needs to enforce organization-wide two-factor authentication through the Business Manager admin panel. If you’re dealing with extortion—someone threatening to release private messages unless you pay—that crosses into criminal territory. Stop engaging with the scammer, preserve screenshots of the threats, and contact local law enforcement or the FBI’s Internet Crime Complaint Center. Don’t try to negotiate or secure the account while actively being blackmailed.

Frequently asked questions

Can someone hack my Facebook without my password?

Yes, through session hijacking or SIM swapping. If a malicious browser extension steals your active login cookie, the scammer bypasses the password entirely. Removing unknown extensions and using an authenticator app instead of SMS blocks both methods.

Why did Facebook send me a login code I didn’t request?

It means someone typed your email or phone number into the login screen. Don’t share that code with anyone who messages you asking for it. Simply ignore the text; without the code, they can’t get in.

How long does Facebook account recovery take?

Identity verification through facebook.com/hacked typically takes 24 to 48 hours for automated reviews. If Facebook asks for a government ID, manual review can take up to a week. The timeline depends entirely on their current support queue.

Is it safe to use my Facebook login on other websites?

Using it grants the third-party app access to parts of your profile through an authorization token. If you no longer use the service, revoke its permissions in your Facebook settings so it can’t continue accessing your data.

What happens if I click a phishing link but don’t type anything?

Nothing happens to your password, but the site may log your IP address or attempt to download malware. Clear your browser cache immediately and run a scan with your antivirus software. Change your password only if you actually typed it.

Does turning on two-factor authentication slow down login?

It adds about five seconds to the process. You open your authenticator app, read the six-digit code, and type it in. Most apps remember trusted devices for thirty days, so you won’t need the code every single time.

Can scammers get my Facebook password from public Wi-Fi?

Not directly, because Facebook encrypts traffic with HTTPS. However, public Wi-Fi makes it easier for attackers to serve fake login portals through network manipulation. Always use cellular data or a trusted virtual private network when logging in away from home.

Do security questions still protect my Facebook account?

Facebook largely phased out traditional security questions years ago in favor of trusted contacts and two-factor authentication. If you still have old questions set, remove them. Scammers easily find answers like your mother’s maiden name through public records.

Start protecting your Facebook account now

Go to your Security and Login settings right now and turn on two-factor authentication using an authenticator app. You’ll know it worked when Facebook asks for a six-digit code the next time you log in from a new device. If you ever receive a password reset email you didn’t trigger and can’t access your settings, stop and contact Facebook’s official recovery page immediately.