Hacker changed your Facebook email and password: how to get back in

Step 1: Check the email Facebook sent about the change

When the email on an account is changed, Facebook sends a notice to the old address. Search your inbox and spam for it. If the message has a link to undo the change or secure the account, open it straight away on a device you trust, because the link may only work for a limited time. Make sure the message really is from Facebook by checking that it matches a notification in your own security settings if you can still reach them.

Step 2: Go to facebook.com/hacked

Use a phone or computer you have logged in from before, on your usual network, and open facebook.com/hacked. Choose the option that says your account is compromised and follow the prompts. Facebook may ask for a name, an old password, a contact method you can reach, or an ID or video selfie. Answer carefully and use your real details.

Step 3: Try to find the account directly

At facebook.com/login/identify you can search for your account by name, email or phone, then choose the option for no longer having access to those details. Add a new contact method you control when asked. If the hacker already removed your old contact details, the hacked-account flow is usually the better route.

Step 4: Once you are back in, remove the attacker

• Change the password to a new one you have not used anywhere else.
• Go to Settings, then Password and security, and log out of every device you do not recognise.
• Remove any email address or phone number you did not add.
• Review apps and websites with access to your account and remove ones you don’t know.
• Turn on two-factor authentication with an authentication app, and save the recovery codes somewhere safe.

Step 5: Secure your Pages and ads

Hackers often add themselves as Page admins or take over a business portfolio. Check Page roles, the business portfolio, and ad accounts for people you do not know and for payment methods you did not add. If a card was used, tell your bank. A Page where the attacker removed other admins is covered in our guide to a hacked Page.

Step 6: Warn your contacts

Post from another account or message close contacts to say not to click links or send money if they got something from your profile. Hackers often use a hijacked account to ask friends for money or to spread the same phishing link that caught you.

What not to do

• Don’t pay a “hacker recovery” service that contacts you first, or a person who offers to hack the hacker back.
• Don’t send ID or codes to anyone who messages you, including people claiming to be Facebook support.
• Don’t keep resetting the password from a new network every few minutes. It looks like the attacker.
• Don’t make a duplicate profile and tell friends the old one is gone. It makes the recovery and any impersonation reports harder.

If the account was disabled afterwards

If the attacker posted scams and Facebook disabled the account, say in any appeal that someone else had access and give the approximate date. Our guide on disabled accounts covers the 180-day window and what to include.