Facebook says there was a login you don’t recognise: check and lock it down

What to do first

Go to facebook.com directly instead of a link in an email or message. If you can still log in, work through the steps. If you can’t, use facebook.com/hacked and our hacked-account guide.

Step 1: Open the sessions list

Go to Settings and privacy, then Accounts Center, then Password and security, then Where you’re logged in, and select your Facebook account. You’ll see each session with a date, time, location and device.

Step 2: Judge what you see

An unfamiliar device or an unexpected country is a red flag. But locations are approximate and can reflect your mobile carrier’s network or a VPN, so look at the device type and time as well. If you’re unsure, log it out; you can always log back in on your own device.

Step 3: End the sessions

Select an individual session and choose Log out, or select all and log out everywhere. You’ll need to log in again on your own devices. Then change your password to something unique, because ending a session doesn’t stop someone who already has it.

Step 4: Add protections

• Turn on login alerts in Password and security.
• Turn on two-factor authentication with an authentication app.
• Run Facebook’s Security Checkup to review email, apps and recovery options.
• Remove apps and websites you no longer use.

Reading the session list like a professional

For each row, ask three questions. Do I recognise the device type? Was I using Facebook at that time? Does the place make sense, remembering that mobile networks often route traffic through another city? A row labelled with your usual phone model and a nearby city is almost always you. A browser on a device you don’t own is not.

Don’t forget old sessions on devices you’ve sold or lent. Logging out of those is routine hygiene even if nothing is wrong.

Check what the account can reach

If you manage Pages or ads, a compromised profile puts them at risk too. Open Meta Business Suite and look at who has access to each Page, then check payment methods and recent spending in Ads Manager. Remove people you don’t recognise.

What not to do

• Don’t click login-alert links in emails unless you opened them from a message you know is real.
• Don’t reuse a password from another site.
• Don’t forget your Pages. Check Page roles and linked ad accounts for changes.

Signs the account is compromised

Posts you didn’t write, messages sent to friends, new Pages or ads, changed email or phone, or friend requests you didn’t send are all signs. Treat any of them as a takeover and follow the hacked-account steps.