Short answer
Check the inbox of your previous email address: when the email on an account changes, Facebook sends a message there with a special link to reverse the change and secure the account. Then go to facebook.com/hacked, ideally from a device you have used to log in before, and follow the steps. If you can’t access the email or phone, Facebook offers an identity route. If ads are running on your card, call your bank. Afterwards: new password, app-based two-factor authentication, and a check of sessions, Page roles and Business Manager admins.
Signs your Facebook was hacked
- Your profile picture, name or password changed without you.
- Posts, comments or messages appear that you did not write.
- Facebook emailed you that an email or phone number was added or removed, or the password changed — and it was not you.
- Ads you did not create are charging your payment method.
Reverse the email change
Search the old inbox (and spam) for the message from Facebook about the changed email. Its link is designed to undo the change and secure the account even after the attacker’s edits. Genuine Facebook security emails come from Facebook’s own domains such as facebookmail.com; do not use links in look-alike messages.
Use facebook.com/hacked
- Open facebook.com/hacked on a phone or computer you have used for Facebook before.
- Choose the option that matches what happened and follow the steps.
- If you can’t access the email or phone on the account, use the route for that case; Facebook may ask you to confirm your identity, for example with an ID or a video selfie.
- Change the password and review the email and phone on the account as soon as you are back in.
Pages, Business Manager and ad accounts
Attackers often add themselves as admins and run scam ads with your card. Once you are in, remove people you do not recognise from Page and Business Manager roles, check payment methods and spending, and pause unknown campaigns. Facebook has a separate route for recovering a hacked Page you manage. Contact your bank about any unauthorised charges.
If Facebook disabled the account after the hack
Scam activity from a hacked account often triggers enforcement. Appeal from the notice, say clearly that the account was compromised and when, and attach evidence. The appeal window matters — see our Facebook disabled-account guide.
Lock it down afterwards
- A unique password from a password manager.
- Two-factor authentication with an authenticator app, and backup codes stored offline — see what to do if you lose 2FA.
- Log out of unknown sessions and remove apps you do not recognise.
- Secure the email account behind Facebook — it is often the original point of entry.
Frequently asked questions
Can I recover a hacked Facebook account without access to my email or phone?
Often yes, through Facebook’s route for people who can’t access their email or phone, which may ask you to confirm your identity.
How long does it take to recover a hacked Facebook account?
With the reversal link or facebook.com/hacked it can be quick. Identity reviews and disabled-account appeals take longer.
My hacked account is posting scams. What should I tell friends?
Warn them from another account or channel not to click links or send money, and ask them to report the posts.
Should I just open a new Facebook account?
Recover the original if you can: a duplicate account can break Facebook’s rules, and you lose Pages, groups and history tied to the old one.
Sources: Facebook Help Center — hacked accounts, Facebook Help Center — no access to email or phone, Facebook Help Center — hacked Pages