Facebook Account Hacked? How to Recover Your Profile Step by Step

Your password changed, your email swapped, a stranger posting as you — Facebook's own recovery routes can still get your profile back, if you pick the right one for your situation and act before the thief locks every door.

If your Facebook account was hacked, how to recover it starts with one address: facebook.com/hacked. That is Meta's own recovery flow, and it is free. But it is not the only door, and it does not work the same way for everyone. What decides your route is how much of the account you still control — an email or phone number that still receives codes, a session still logged in on an old phone, an inbox holding Facebook's "your email was changed" message. This guide sorts out which situation you are in, then walks the matching route in order, from minutes-fast to last resort.

Two honest notes before we start. First, this guide is about your personal profile. If what you lost is a Facebook Page you run for a shop or business, the recovery is different. Second, Facebook has no recovery phone number, no live agent you can call, and no paid fast lane. Anyone in a comment, a Telegram group or a search ad who claims otherwise is setting up the second scam.

One preparation, before any route: secure your email account first. Password resets and Facebook's most useful recovery messages land in your inbox. If the thief may know your email password too — especially if you reused it — change it now and turn on its two-factor protection. Otherwise the thief can simply watch your recovery emails arrive and take the profile back the same night.

Signs your Facebook account was hacked — and what the scammer does with it

Sometimes the takeover announces itself: your correct password suddenly "is wrong" and you are logged out on every device. Just as often it begins quietly. Treat any of these as an emergency:

Facebook emails or notifies you about a change you did not make — your password, email address or phone number was changed.
Posts, comments or Messenger messages appear that you never wrote, or your account suddenly joins groups and follows Pages you have never heard of.
Friends ask why you sent them a strange link, or asked for money — in Bangladesh this is most often a Messenger message asking for urgent bKash or Nagad help, written in your name.
Your name, profile photo or birthday changed.
A login alert names a device or a city you do not recognise.
You receive a password-reset code you never requested.

What the thief wants is rarely your photos. A stolen profile is a trusted mask: with it they send money requests to your friends, post fake investment schemes, sell counterfeit goods through Marketplace, run up charges in any ad account attached to you, or message you and demand payment to hand the account back. If the spam is heavy enough, Facebook may disable the profile for policy violations. Every hour matters.

First, pick your situation — the four cases

Guides that fail people usually fail here: they print one flow, but hacked accounts come in four different shapes. Find yours, honestly, before touching anything.

Case A — You are still logged in somewhere. An old phone, a tablet, the browser at home: if any session still opens your profile, you hold the fastest key of all. Do not log out. Go straight to Route 4.

Case B — You are locked out, but your email or phone number still works. The thief changed your password but did not get to your contact details. Codes still reach you. This is the classic facebook.com/hacked case — Route 1, often finished in minutes.

Case C — Your email and phone number were both changed. Codes now go to the thief. Route 1 alone will not save you; you will need the undo-email trick (Route 2) or the identity-verification route (Route 3).

Case D — Facebook disabled the profile after the hack. You log in and see a suspension or disabled message, because the thief's spam broke the rules. Recovery still starts with Routes 1–3 to prove the account is yours; the disabled-account appeal is a separate step that sits on top, and we come back to it in the FAQ.

One thing helps every case: work from a phone or computer you have logged in from before, on your usual network, with any VPN turned off. Facebook's systems weigh a familiar device and location as evidence that you are the owner. Use your original details everywhere, even if the thief has already replaced them on the account.

Route 1: Recover your profile at facebook.com/hacked

This is Meta's guided recovery flow for compromised accounts, and it is the right first door for Cases B and C.

Type facebook.com/hacked into your browser yourself. Do not tap a link from a message, a comment or a "support" page — fake copies of this page exist to steal the very login you are trying to save. Choose the option saying your account is compromised or someone else is using it.
Find your account with the email address, mobile number or name you used before the hack. If the first detail fails, try the others — an old email you added years ago still counts.
If Facebook asks for a password, enter a current or previous one. An old password you genuinely used helps Facebook confirm the account is yours.
Choose where the code goes — carefully. Read the masked email or number Facebook offers. If it is yours, request the code, enter it, and set a new password you have never used anywhere else. If the destinations shown belong to the thief, do not send codes there; look for the link saying you no longer have access to these, which opens Route 3.
If a code does not arrive, check spam, confirm you entered the original number with its country code, and wait a few minutes before asking again.

The moment you are back in, do not celebrate and stop — the thief may still hold a live session. Go directly to the lockdown checklist further down, in the same sitting.

Route 2: Undo the email change — Facebook's own "secure your account" message

When someone changes the email address on your account, Facebook writes to the old address to tell you. That message is the most valuable email in your inbox right now, because it can carry a link to reverse or undo the change — worded as "secure your account" or "revert this change". One tap rolls back the email swap and starts the securing process.

Search your inbox and spam folder now for Facebook's message about an email change. Legitimate Facebook security mail comes from an address ending in facebookmail.com.
Check the sender before tapping anything. Phishing copies of this exact email are common. If anything looks off, do not tap. Type facebook.com/hacked yourself and use Route 1 instead.
Act while it is fresh. The reversal works best soon after the change. If the password was also changed, undo the email change first, then run Route 1 to reset the password with codes that once again reach you.

If you never received this message, or it is too old, skip to Route 3.

Route 3: "No longer have access to these?" — identity verification

This is the last-resort door, for Case C, where the thief replaced everything. It begins from facebook.com/login/identify: find your account, choose the option that says you no longer have access to the email and phone shown, and Facebook will ask for a new email address or phone number that has never been used on this account — that is where its answer will come, so use one only you control, on the secured inbox you prepared at the start.

Facebook may then ask you to confirm your identity, typically by uploading a government photo ID — a passport, national ID card or driving licence. Practical details:

The name and date of birth on the ID should match the profile. If your Facebook name is a nickname, expect questions; answer honestly with the details you signed up with.
Upload a clear, complete photo of the document — all four corners visible, no flash glare, no editing or cropping out parts. Blurry or altered images are the commonest reason for rejection.
Use your familiar device and network, as with every route.
Then submit once, and wait. Duplicate requests do not speed anything up; they can create parallel cases that slow review down. Keep any confirmation or reference Facebook gives you, and watch the new contact address you provided — including its spam folder.

If the ID route is not offered on your first attempt, do not conclude the account is gone. Options vary by account and region; try again from the login screen after a pause, and work through the Help Center's hacked-account guidance (facebook.com/help, search "hacked account"). Some accounts are also offered a video-selfie style check instead of a document — follow whichever official check Facebook actually presents to you, on its own page, and never send ID photos to anyone who contacts you privately claiming to submit them "faster".

Route 4: Still logged in somewhere? Secure the account in place

For Case A, your surviving session is gold — people lose accounts by helpfully logging out of the last device that still worked. Stay logged in and work through this inside the account:

Change the password first (Settings → Accounts Center → Password and security). A long, unique one, used nowhere else. If you reused the old password on other accounts, change those too, starting with your email.
Open "Where you're logged in" in the same Password and security area and log out every device and location you do not recognise.
Check your contact details. In Accounts Center → Personal details, confirm the email addresses and phone numbers are all yours. A thief who added their own email keeps a key even after your password change; remove anything you did not add.
Turn on two-factor authentication with an authenticator app where you can, rather than SMS alone, and save the backup codes somewhere safe.
Turn on login alerts so the next unfamiliar sign-in reaches you immediately.

Then continue to the full lockdown checklist below.

While you wait: damage control that cannot wait for Meta

Recovery reviews take days. The scam being run in your name is happening tonight. In parallel:

Warn people from channels you still control. Post from a family member's profile, a second account, WhatsApp groups and Messenger groups you can reach another way: "My Facebook account was hacked. Ignore any message, link, money or code request from it — it is not me. Do not send bKash, Nagad or any money." Message close friends and family directly; a voice note carries more trust than copied text.
Ask a friend to report the profile as hacked. From your profile, a signed-in friend can use the ··· menu → Find support or report profile and follow the options for a hacked account / someone pretending.
Screenshot the evidence before it vanishes. The scam posts, the messages your friends received, any changed name, photo or bio, and any ransom demand — with times visible.
If money already moved, save the transaction details and contact your bank or mobile-money provider through its official channel the same day.

Warning: the "recovery agent" scam — the second wave

Within hours of a public hack, a second set of criminals arrives dressed as rescuers: Facebook pages and Telegram sellers advertising "Facebook account recovery service — 100% guaranteed", commenters recommending a "brilliant hacker" who fixed theirs, and phone numbers pasted into guides and videos claiming to be a Facebook helpline. In Bangladesh the script is consistent: a few thousand taka up front by bKash or Nagad, then a request for your password or a login code "to finish the process" — which hands them whatever you have left.

Be blunt: Facebook does not charge for recovery, has no helpline to call, nobody outside Meta can restore an account, and no legitimate helper will ever ask for your password, a login code or a copy of your NID. The only real doors are the ones in this guide: facebook.com/hacked, facebook.com/login/identify, the undo link in Facebook's own email, and the Help Center. If you already paid an agent or shared a code, assume the code was used: change your email password, change any account sharing the Facebook password, and restart Route 1 from a familiar device.

After you get it back: the lockdown checklist

Getting in is half the job. Work through it in one sitting:

Password: new, long, unique, used nowhere else.
Sessions: Accounts Center → Password and security → Where you're logged in. Log out everything you do not own, everywhere. A password change alone does not always evict a thief's live session.
Contact details: Personal details — every email and number must be yours. Remove additions, and add a recovery email you actually check.
Two-factor authentication: on, preferably with an authenticator app; save backup codes offline.
Third-party apps and websites: Settings → Apps and websites. Revoke anything you do not recognise.
Pages, groups and ad accounts: check every Page you admin and any ad account for strangers added as admins, new payment methods or campaigns you never made.
Clean up the mess: delete the scammer's posts and messages, restore your name, photo and details, unfollow and leave what the thief added, and post a short note telling friends the account is yours again and which earlier messages were fake.
Sweep your email too: repeat the same check there — forwarding rules you did not create, recovery addresses that are not yours.

How long does Facebook account recovery really take?

Honestly, by route. Case B — codes still reach you — is commonly minutes to an hour at facebook.com/hacked. Route 2, the undo-email tap, is as fast as finding the message, if you catch it early. Route 3, identity verification, is measured in days, and can stretch to weeks: Facebook reviews documents by hand and queue, and blurry ID photos or mismatched details restart the wait. Case D adds an appeal on top of that. Two habits genuinely change the timeline: a familiar device with your original details, and one clean submission instead of a pile of duplicates.

FAQ

Can I recover my Facebook account if the hacker changed my email and phone number?
Often, yes. First look for Facebook's message to your old email with the link to reverse the change (Route 2). If that is gone, start at facebook.com/login/identify, choose "no longer have access to these", give a new email or number never used on the account, and complete Facebook's identity check — usually a government photo ID such as a passport, national ID card or driving licence (Route 3).

Is there a Facebook customer care number I can call for recovery?
No. Facebook offers no phone helpline for account recovery, and Meta never charges for it. Numbers and "agents" in search results, YouTube comments and Telegram groups are scams. Use only facebook.com/hacked and the Help Center.

Facebook disabled my account after it was hacked. Is it the same process?
Partly. A disabled or suspended message after a hack usually means the thief's spam broke Facebook's rules. First recover the account with the routes above, so you can show the takeover was real; the disable itself is then handled through the appeal prompt Facebook shows at login.

My ID was rejected. What should I do differently?
Upload a clear, complete, unedited photo of an accepted document — passport, national ID card or driving licence — with all corners visible and no glare, and details that match the profile's name and date of birth. Submit from your usual device, then submit once and wait.

My friends are receiving money requests from my hacked account. What can they do?
Tell them not to send anything and not to tap links or share codes. Ask a friend to open your profile and use the ··· menu → Find support or report profile to report it as hacked, and warn your wider circle from any channel you still control. Screenshot the scam messages — if money was actually sent, the victim should contact their bank or mobile-money provider's official helpline the same day.

Will I lose my photos, posts and friends when the account is recovered?
Normally, no — content and friend lists survive recovery. The real risks while you are locked out are the thief deleting material or Facebook disabling the profile for the thief's spam, which is why starting in the first hour, warning friends the same day, and keeping screenshots all matter.