Use Facebook’s official recovery flow, secure the email linked to the profile, change the password, and remove unknown logins. For a hacked Facebook account, the safest recovery method is to start at Facebook’s hacked-account page, not through a message from a stranger.
Your result can change if the attacker changed your email, phone number, or password. It also depends on whether you can still use the original email or phone, and whether your email account is secure.
Who needs Facebook account recovery
A person who can still open Facebook but sees unknown posts needs a quick security check and a password change. Someone locked out after an email or phone number changed needs Facebook’s account recovery route. A person whose email account was also taken needs to secure that email first.
You might also be helping a family member who can’t explain what changed. In that case, use the account owner’s normal device and contact details where possible. Don’t ask them to send you a password, login code, or identity document through chat.
This page serves best if you own the profile and can still use at least one trusted email address, phone number, or familiar device. It assumes you can follow Facebook’s on-screen checks without bypassing security. If you’re trying to recover someone else’s profile, use Facebook’s official reporting options instead.
A person with an active business page, payment account, or advertising account needs a separate review after personal access returns. Personal profile recovery may not fix every business permission or billing problem.
What changes the recovery result
The biggest factor is whether you still control the original email or phone number. If you do, use it for password recovery and read every security message carefully. If you don’t, choose Facebook’s option for lost access rather than repeatedly guessing passwords. Check the account’s old contact details in saved messages or your password manager.
The attacker’s changes matter next. A changed password alone is usually easier to correct than a changed email, phone number, name, or two-factor method. Compare the last genuine Facebook email with the current account details, but don’t trust a message just because it uses Facebook’s name.
Your email account is another major factor. If someone can open that inbox, they may reset Facebook again after you recover it. Change the email password, sign out unknown email sessions, and turn on the email provider’s security checks before relying on that inbox.
The device you use can affect the prompts Facebook shows. A familiar phone, browser, or home network may offer more useful recovery choices than a new device. Use a clean, updated device; if it shows unknown browser extensions or malware warnings, stop and get device help first.
The mistake people get wrong most often is treating a strange message as support. That can cost the account again, because the sender may be collecting the new password or recovery code.
How to recover a hacked Facebook account
Start with the account’s official recovery page. Don’t use a link sent by a supposed helper, and don’t share a code with anyone. Work through these steps in order.
-
Open Facebook’s hacked-account page. Use a clean device and type
facebook.com/hackedinto the address bar. The page should show Facebook branding and an account-recovery prompt before you continue. -
Identify the affected profile. Enter the profile’s name, email address, or phone number when Facebook asks. Select the correct account by checking its profile picture or other details.
-
Choose the security problem. Select the option that matches the event, such as a changed password or unauthorized access. The next screen should show a recovery method you recognize.
-
Secure your email account first. If you suspect the email was also accessed, change its password and remove unknown sessions before using it for Facebook recovery. A new email login should work before you continue.
-
Use a trusted recovery method. Choose the email, phone, or other method that you still control. Enter the code only on Facebook’s page, and move on only when Facebook confirms the code.
-
Create a new Facebook password. Use a new password that you’ve never used on another site. The recovery screen should confirm that the password changed successfully.
-
Review active sessions. Open Facebook’s password and security settings, then remove devices, locations, or sessions you don’t recognize. Keep only sessions you can identify.
-
Check account changes. Review the email address, phone number, profile name, posts, messages, pages, and payment settings. Undo only changes you clearly recognize as unauthorized.
-
Turn on stronger sign-in checks. Add two-factor authentication using an available method, then save the recovery information in a secure place. After enabling two-factor authentication, verify that it’s active in Facebook’s security settings; a trusted device may not request the extra check during a test sign-in.
-
Warn affected contacts. Tell contacts not to open recent suspicious messages or send money from requests linked to your profile. The warning is complete when they know which messages to ignore.
If Facebook asks for identity proof, account ownership, or a step you can’t safely complete, stop there and use Facebook’s own review process. Don’t edit documents, bypass a check, or pay a stranger who promises access.
Recovery cases at a glance
The right route depends on what still works and what the attacker changed.
| Situation | What to do in it | What it takes | What to watch for |
|---|---|---|---|
| Password changed | Start hacked-account recovery | One clean device | Fake support messages |
| Email still works | Use email code | Inbox access | Email account security |
| Phone still works | Use phone code | Working number | Unknown number changes |
| Email and phone changed | Choose lost-access options | More account checks | Don’t guess repeatedly |
| Account still opens | Change password immediately | Current login session | Unknown active sessions |
| Email was also hacked | Secure email first | Email provider access | Recovery loop |
| Business access changed | Review page permissions | Admin-level access | Separate business controls |
Details that protect the result
Prepare before changing anything
Write down the profile’s old email, phone number, and username if you know them. Save screenshots of suspicious posts, changed contact details, and strange messages, but don’t forward private recovery codes. This record helps you spot which changes happened after the attack.
Secure the email account before using it for Facebook. Check its forwarding rules, recovery address, sign-in history, and logged-in devices. Remove anything you don’t recognize, then create a Facebook password that isn’t used for email or any other service.
Check before you restore
Look at the account from the inside, not only at the profile page. Review active sessions, connected apps, page roles, ad accounts, payment settings, messages, and recent posts. An account can look normal while an unknown session still has access.
Leave unfamiliar settings alone if you can’t tell what they do. The useful comparison is simple: your known device and location should match the session you keep, while unknown locations or devices should be removed. If a business asset or payment setting is involved, pause and use the relevant Meta support route.
Facebook recovery problems and fixes
Match the visible problem to the first safe action instead of repeating the same login attempt.
| What you notice | What it usually means | What to do first | How to stop it happening again |
|---|---|---|---|
| Password no longer works | Password was changed | Start official recovery | Use a unique password |
| Recovery email looks unfamiliar | Contact details changed | Choose lost-access help | Secure email separately |
| Strange posts appeared | Someone used the session | Change password now | Remove unknown sessions |
| Friends received scams | Messages sent from account | Warn your contacts | Turn on sign-in checks |
| Code never arrives | Wrong contact or delay | Check contact details | Keep recovery methods current |
| Unknown device remains | Session wasn’t removed | Sign out that device | Review sessions after recovery |
| Page access disappeared | Role or permission changed | Contact another admin | Limit admin permissions |
Facebook rules and account limits
Facebook’s recovery options can differ by account, device, country, and current security checks. Meta controls the available prompts, so the screen you see may not match another person’s screen. Use Facebook’s hacked account recovery page for the official starting route.
Facebook may ask for information to confirm that you own the profile. Don’t send passwords, login codes, or identity documents to a person who contacts you through Messenger, email, or another social network. Facebook support won’t need your password to “unlock” the account.
If the account has advertising, payments, or business assets, personal recovery may not restore every permission. Check the business account’s own security and admin controls after your profile works again. If a payment dispute, impersonation, or legal threat is involved, stop DIY recovery and contact the relevant bank, platform support team, or local authority.
The real cost of recovery
The direct cost may be zero when Facebook’s normal recovery tools work. The larger cost is time, lost access, missed messages, unwanted posts, and possible damage to connected pages or payment tools. The cost rises when you keep using an unsafe email account or leave unknown sessions active.
A password change alone takes less effort than checking every connected service, but it gives weaker protection. A full review takes longer because you must compare devices, messages, apps, and account settings. That trade-off is worth making when the account controls a business page or receives payment requests.
You can check any financial loss through your bank, card provider, ad billing records, or Facebook payment history. Don’t trust a person who asks for an upfront fee and promises guaranteed recovery. Official recovery doesn’t require you to give your password to a stranger.
Keep the recovered account secure
Keep the new Facebook password in a reputable password manager or another private place. Don’t reuse it for email, Instagram, banking, or any other service. The account needs attention again when you see an unfamiliar login, a changed contact detail, or a message you didn’t send.
Review security notifications when they arrive, rather than dismissing them automatically. Check connected apps before keeping them, and remove access for apps you no longer use. If an app asks for a Facebook password outside Facebook’s own sign-in screen, close it.
If the account becomes compromised again, secure the email account before repeating recovery. Then remove unknown sessions and connected apps after you regain access. Repeated takeovers suggest a wider device, email, or reused-password problem, so get help from a trusted security professional if you can’t find the cause.
When Facebook recovery isn’t the right choice
Facebook recovery isn’t the right route if you’re trying to access a profile you don’t own. Ask the owner to recover it, or use Facebook’s reporting option for impersonation or abuse instead.
It’s also the wrong approach if your email account, phone number, and trusted devices are all unsafe. Secure the email provider, mobile account, or device first. A technician can check malware or account takeover signs without needing your Facebook password.
Skip DIY recovery when the incident involves stolen money, threats, identity theft, or an active business payment problem. Contact your bank, local police, an identity-theft service, or the relevant Meta business support channel. Don’t keep experimenting with account settings while evidence or money may be at risk.
Frequently asked questions
Can I recover my hacked Facebook account without email?
Yes, you may be able to recover it with a linked phone number or another option Facebook offers. Start from the hacked-account page and choose the lost-access path if the listed email is no longer yours. Don’t guess repeatedly or use a stranger’s recovery service.
Why did Facebook send the recovery code to someone else?
The account’s email address or phone number may have been changed, or the displayed contact method may be unfamiliar. Stop using that method and choose the lost-access option. Secure your own email account first, because it may be part of the same attack.
How long does Facebook account recovery take?
There’s no single reliable time because Facebook may require different checks for different accounts. A code-based reset can finish during one session, while an ownership review can take longer. Read the exact status message Facebook gives you and avoid duplicate requests.
Is it safe to use Facebook’s hacked-account page?
Yes, use the address you type yourself: facebook.com/hacked. Check that the browser address is on Facebook before entering details. It isn’t safe to use a recovery link from a stranger, a social media comment, or an unexpected email.
What happens if the hacker changed my email?
Facebook may show an option for lost access or another recovery method. Check old Facebook security messages for a change you don’t recognize, but don’t click unknown links. If no trusted method works, follow Facebook’s ownership review instead of trying to bypass it.
Does it matter if I can still log in?
Yes, because an open session may let you secure the account before you’re locked out. Change the password, remove unknown sessions, and check contact details immediately. If you wait, the attacker may change the recovery methods and make ownership checks harder.
Can Facebook restore deleted messages or posts?
Not always. Recovery focuses on account access and security, not guaranteed restoration of every deleted item. Save evidence you can still see, warn affected contacts, and report serious fraud or threats to the appropriate service while the details are available.
What to do first for Facebook recovery
Start by securing the email account linked to Facebook, then open the official recovery page from a clean device. You should see your profile and a recovery option you recognize. Stop and get help if the page asks for unsafe actions or the incident involves money, threats, or identity theft.
Olivia Jones
Contents
Need help with your Facebook setup?
We set up profiles, Business Managers and ad accounts the right way.
See our services →