A single security mistake can put your Facebook account at risk. Clicking a suspicious link, entering your password on a fake login page or sharing a verification code with the wrong person could allow an attacker to take control of your profile.

A compromised Facebook account can expose much more than your public posts. Depending on your account and privacy settings, it may put your photos, messages, contacts and other personal information at risk. An attacker may also change your password, email address or mobile number, making it difficult for you to sign back in.

Fortunately, Facebook provides recovery options for users who believe their accounts have been hacked. Acting quickly can improve your chances of securing the profile before further changes are made.

How to Know If Your Facebook Account Has Been Hacked

There are several warning signs that should not be ignored.

If posts, comments or messages appear from your account that you did not create, someone else may have gained access.

You should also be suspicious if your profile picture, name, email address, phone number or password changes without your permission.

An alert showing a login from an unfamiliar device or location can be another warning sign.

In more serious cases, users may find that their password no longer works or that an unknown email address or mobile number has been added to the account.

Problems with two-factor authentication can also occur if someone has changed the account's security settings.

First Step: Use Facebook's Hacked Account Recovery Option

If you suspect that your account has been compromised, start with Facebook's dedicated account-recovery process.

Facebook Hacked Account Recovery

Where possible, use a smartphone, computer or browser that you previously used to access your Facebook account.

A familiar device may help Facebook recognise that the recovery request is coming from the legitimate account owner.

Follow the instructions displayed during the recovery process and provide the account information requested.

Try Your Email Address or Mobile Number

Facebook may ask you to identify the account using an email address or phone number associated with it.

If using a mobile number, enter the appropriate country code when requested.

It may also be worth trying another email address or phone number that was previously associated with the account.

This can be particularly useful if an attacker has changed some of the current contact information.

Can't Find Your Account? Try This Recovery Method

If the hacked-account process does not locate your profile, Facebook also provides an account-identification tool.

Find Your Facebook Account

Open it from a device you have used for Facebook before, if possible.

Enter an email address or mobile number associated with your account. Depending on the recovery options available, Facebook may provide additional ways to locate your profile.

Once the correct account appears, follow the instructions shown on the screen.

What If You Cannot Access Your Old Email or Phone?

Account recovery can become more difficult if you have lost access to the email address or mobile number registered with Facebook.

If Facebook displays an option indicating that you no longer have access to the listed recovery methods, select the appropriate option and follow the instructions.

The exact recovery choices can vary depending on the account and the information Facebook can verify.

In some situations, users may be asked to provide alternative contact information or complete additional security checks.

If verification is successful, Facebook may allow the password to be reset and account access restored.

Secure Your Email Account as Well

Your Facebook recovery process may depend heavily on your registered email account.

If someone has compromised both your Facebook profile and email account, changing only your Facebook password may not fully solve the problem.

Try to recover and secure your email account through your email provider.

Change the email password to a strong and unique one and enable two-factor authentication if the service supports it.

Most importantly, avoid using the same password for Facebook and email.

Change Your Facebook Password Immediately

Once you regain access to Facebook, change your password without delay.

Depending on the current interface, you can generally open Settings and Privacy, go to Accounts Centre, select Password and Security, and use the password-change option.

Create a password that is completely different from the compromised one.

Avoid predictable combinations such as your name followed by your birth year or mobile-number digits.

A long, unique password is generally more secure than a short and easily guessed one.

Check Where Your Facebook Account Is Logged In

Changing the password is important, but you should also review the devices and sessions associated with your account.

Look for phones, computers, browsers or locations that you do not recognise.

If you find a suspicious session, sign it out.

You may also consider signing out of other sessions and then logging back in only on devices you trust.

This reduces the risk of an attacker retaining access through an existing session.

Review Email Addresses and Phone Numbers

An attacker may add their own contact information to a compromised Facebook account.

After recovering your profile, carefully check all registered email addresses and mobile numbers.

Remove information that you do not recognise after ensuring that your own verified recovery details are correctly linked.

This step is particularly important because an unknown email address or number could potentially be used in another attempt to regain control of the account.

Turn On Two-Factor Authentication

Two-factor authentication, or 2FA, provides an additional layer of protection.

With 2FA enabled, a password alone may not be enough to access the account.

Review the authentication methods currently offered for your Facebook account and select an appropriate option.

Also keep your recovery details updated. An old phone number or inaccessible email address can create serious problems when you need to recover an account.

Check Posts, Comments and Messages

Once the account is secure, inspect recent activity.

An attacker may have posted spam, sent suspicious links or contacted your friends while pretending to be you.

Delete unauthorised content where appropriate.

If fraudulent messages were sent to your friends or relatives, warn them that your account was compromised and advise them not to click links, send money or share security codes in response to those messages.

One Common Mistake Can Lead to an Account Takeover

Phishing remains an important threat to social-media accounts.

You might receive a message claiming that your Facebook account has violated a policy, your page will be deleted or your profile needs immediate verification.

The message may include a link that appears genuine.

After clicking it, you could be taken to a fake login page designed to look like Facebook.

If you enter your email address and password there, those details could be captured by an attacker.

Instead of logging in through suspicious links, open Facebook directly using the official app or type the address yourself in your browser.

Never Share Facebook Verification Codes

Verification codes and security OTPs should be treated as confidential.

A scammer may already know your email address and password but still require an authentication code to complete the login.

Never share such a code with an unknown caller or someone contacting you through WhatsApp, Messenger, SMS or email.

Be particularly cautious if someone creates urgency by claiming that your account will be permanently deleted unless you provide an OTP immediately.

Don't Pay Strangers to Recover Your Facebook Account

People who lose access to social-media accounts are sometimes targeted by so-called account recovery experts.

A stranger may promise to "hack back" your account in exchange for money.

This can lead to additional fraud.

Avoid giving unknown people your passwords, authentication codes, identification documents or banking details.

Use Facebook's official recovery tools and legitimate support options instead.

Facebook Account Recovery: Important Steps

How to Make Your Facebook Account Safer

Prevention is easier than recovering a completely compromised account.

Use a unique password that you do not use on other websites. Enable two-factor authentication and keep your registered phone number and email address current.

Avoid clicking unknown links received through Messenger, email, SMS or WhatsApp.

Before entering your Facebook credentials, check whether you are actually on Facebook's legitimate service.

You should also be cautious with third-party apps and websites requesting Facebook access. Remove connections that you no longer use or do not recognise.

Bottom Line

A hacked Facebook account can expose personal information and may also allow scammers to target your friends and family using your identity.

Warning signs include unknown posts or messages, unfamiliar login alerts, unexpected password changes, changes to your profile and the addition or removal of email addresses or phone numbers.

If you believe your account has been compromised, begin the official Facebook recovery process as soon as possible. Using a device that you have previously used for Facebook can also be helpful during recovery.

Once you regain access, change your password, review logged-in devices, remove unfamiliar contact information, check recent activity and enable or review two-factor authentication.

Most importantly, never enter your Facebook password on an untrusted page or share an authentication code with an unknown person. One careless click can create a serious security problem, while a few basic precautions can significantly reduce the risk of losing control of your account.