Facebook or Instagram Hacked? Step-by-Step Recovery Guide

First signs your account was hacked

Facebook and Instagram accounts are usually taken over through a leaked or reused password, a phishing link, or a malicious app that was granted access at some point. The warning signs tend to show up quickly, because attackers who take over an account move fast before you notice and lock them out.

• You suddenly can't log in. Your usual password stops working, even though you're certain you're typing it correctly.
• Posts, stories, or messages appear that you didn't make. This can include spam links sent to your friends or followers, often promoting a scam or a fake giveaway.
• Friends tell you they're getting strange messages from you. This is frequently how people first find out, since the attacker is messaging your contacts directly to spread the compromise further.
• Your profile details have changed. A different name, profile photo, linked email, or phone number that you didn't set.
• You're logged out of every device at once without you having done that yourself.

The moment you notice any of these, treat it as active and move on to recovery immediately rather than waiting to see if it resolves itself.

The official Meta recovery flow

Facebook and Instagram are both owned by Meta, but each has its own recovery entry point, and using the right one matters because it routes you to identity verification built specifically for compromised accounts rather than a standard password reset.

On Facebook

1. Go to facebook.com/hacked directly, ideally from a device or browser you've used before with this account.
2. Follow the prompts to identify your account, usually by searching your name, email, or phone number.
3. Verify your identity through whichever method the flow offers, a code sent to a linked email or phone, or answering account-specific questions if those aren't accessible.
4. Once verified, you'll be prompted to set a new password and review recent login activity.

On Instagram

1. On the login screen, tap "Get help logging in" (Android) or "Forgot password?" then look for the option to say your account was hacked.
2. Enter your username, email, or phone number associated with the account.
3. Instagram will send a login link or code to whatever contact method is still valid on the account.
4. If none of your original contact details work anymore, look for the option to submit a video selfie for identity verification, which Instagram uses for accounts where normal recovery methods have been compromised.

If your email or phone was also changed

This is the harder case, because the attacker has effectively locked the front door and changed the lock. Both platforms account for this specific scenario:

• Look for "my email or phone number was changed" as an option during the identity verification step in the hacked-account flow. Don't skip past it looking for a faster option, since it's the correct path for exactly this problem.
• Be ready to provide the original email or phone number you used when you first created the account, even though it no longer works for login. This is one of the strongest signals the platform uses to confirm you're the real owner.
• Provide any other identifying detail you can, such as roughly when the account was created, a list of close friends or followers, or the device and browser you normally use.
• Expect a delay, often several days. This case requires manual review specifically to prevent someone else from being able to falsely claim your account using the same process, so it moves slower than a same-day password reset by design.

If you have a friend who still shows up as a contact or collaborator on the account (for example, an admin on a linked Facebook Page), mention that during verification, since it can sometimes support your claim to the account.

Securing the account after recovery

Getting back in is only half the job. Attackers often leave themselves a way back in unless you close every door.

1. Change the password immediately to something new and unique, not a variation of the old one.
2. Log out of all sessions from the security settings menu, which forces every device, including the attacker's, to log in again.
3. Review connected apps and third-party logins and remove anything you don't recognize or no longer use. This is one of the most common re-entry points.
4. Check your linked email and phone number are your own and haven't been left with a stale entry from the takeover.
5. Turn on two-factor authentication using an authenticator app rather than SMS if the option is available, since it's harder for an attacker to bypass.

If the same attacker also accessed other accounts using a shared or similar password, our guide on what to do in the first 10 minutes after being hacked covers securing your wider account footprint, not just the one platform.

We help people secure their accounts from wherever they are: