Facebook Account Hacked? How to Get It Back and Lock It Down

You wake up to a text from your cousin asking why you’re selling concert tickets on Facebook. Or your password suddenly doesn’t work, and your email address on the account isn’t yours anymore. Hacked Facebook accounts are one of the most common calls I get from folks in Strasburg, Byers, Bennett, Watkins, Deer Trail and all along the I-70 corridor, and it feels awful when it happens. Years of photos, your church or 4-H group, your Marketplace listings, all suddenly in someone else’s hands.

The good news: Facebook’s official recovery tools are free, and a lot of people do get their accounts back. Here’s how to tell if you’ve been hacked, how to recover the account the right way, and how to lock it down so it doesn’t happen again.

Signs your Facebook account was hacked

Meta lists these as the common signs that someone else is in your account:

• Your email address or password was changed.
• Your name or birthday changed.
• Friend requests went out to people you don’t know.
• Messages were sent that you didn’t write.
• Posts or ads showed up that you didn’t create.

I’d add one more: a login alert for a phone or computer you’ve never owned. Don’t brush that off as a glitch.

Still able to log in? Move fast

If you can still get in, you’re in the best spot. Do these right away, in this order:

1. Change your password. Go to Settings & privacy > Settings > Accounts Center > Password and security > Change password. Pick a new password you don’t use anywhere else, and check the box to log out of other devices.
2. Kick out strangers. In the same Password and security area, open Where you’re logged in and log out of any device or location you don’t recognize. Locations are approximate, so focus on devices you know aren’t yours.
3. Check your contact info. Under Personal details in Accounts Center, make sure the email and phone number are yours. Remove anything the hacker added.
4. Turn on two-factor authentication (more on that below).

Locked out? Use Facebook’s official recovery page

If the password or email was changed and you can’t get in, here’s the free, official route:

1. Check your email first. When the email on an account is changed, Meta sends a message to the old address with a link to reverse the change. Look in your inbox (and spam folder) for it. Real Facebook security emails come from a facebookmail.com address.
2. Go to facebook.com/hacked, ideally from a phone or computer you’ve used to log in before. A familiar device helps Facebook trust that it’s really you.
3. Enter the email, phone number, or username tied to the account and follow the prompts.
4. If the hacker changed your contact info, look for an option like “No longer have access to these” and give a new email or phone number Facebook can reach you at.
5. Verify your identity. Facebook may ask for a short video selfie, which it compares to your profile pictures, or a photo of your ID. Meta says a selfie match usually takes about a minute; if it can’t confirm it, a person may review it, which takes longer.

Be patient and keep trying from the same familiar device. Recovery doesn’t always work on the first pass, especially if the hacker turned on their own two-factor code.

Don’t pay a “Facebook recovery expert”

This is the big one. The minute you post “my account got hacked, help!” in a group, strangers show up in the comments or your messages saying they can get it back for a fee. They’re scammers. The Better Business Bureau puts it plainly: account recovery is always free. These “experts” want an upfront payment, often by gift card, crypto, or a payment app, or they ask for your password and login codes so they can grab the account themselves. No outside person has a back door into Facebook.

Same goes for anyone who calls or messages claiming to be “Facebook Support.” Stick to facebook.com/hacked and the help options inside the app. If you already lost money to a scam, report it at ReportFraud.ftc.gov and call your bank.

Once you’re back in: lock it down

• Secure your email account too. Facebook password resets go to your email, so if a hacker can get into your email, they can get back into Facebook. Give it a new, unique password and turn on two-step verification there as well.
• Turn on two-factor authentication. In Accounts Center, go to Password and security > Two-factor authentication. An authenticator app (like Google Authenticator or Microsoft Authenticator) is stronger than text-message codes. Save the backup recovery codes somewhere safe, like a printed copy in a drawer.
• Look at passkeys if Facebook offers them on your phone. They let you sign in with your fingerprint, face, or phone PIN and are much harder to phish.
• Turn on login alerts so you hear about new sign-ins right away.
• Clean up. Delete posts, ads, or messages the hacker made, and check your Pages, groups you run, and any payment methods saved in Meta Pay.
• Warn your friends. Post a quick note so nobody falls for a message that looks like it came from you.

A strong password alone isn’t enough anymore. I explain why in Myth #5: “Strong Passwords Are Enough to Stay Safe”.

How it usually happens

Most hacked accounts I see come from one of a few things: a fake “Facebook” or “Meta” login page sent by text or email, a message from a hacked friend’s account (“Is this you in this video?”), reused passwords leaked from some other website, or a code someone was tricked into reading out over the phone or Messenger. Never share a login code with anyone. Facebook won’t ask you for it.

Need a hand?

If you’re stuck in a recovery loop, or you’d like someone to walk through the lockdown steps with you and check your email and other accounts while we’re at it, give Carl the Computer Guy a call. I’ve been helping people with computers since 2000, and Carl the Computer Guy since 2013. I’m happy to help neighbors in Strasburg and across the I-70 corridor, in person or remotely. I’ll never ask for your password up front, and I’ll never charge you to “hack back in.”