How to Recover a Hacked Facebook Account: First Steps
Password failing, strange posts, or a changed email? Recover the linked inbox first, then use facebook.com/hacked and secure every session before appeals.
Secure the email or phone tied to Facebook, then open facebook.com/hacked and follow Meta account recovery. Log out unknown sessions, set a new password, and fix profile, Page or ad changes the attacker made. Warn friends if the account messaged them. Meta decides whether disabled accounts come back.
Summary
A hacked Facebook profile usually means the linked email or phone is compromised too, so inbox security comes first.
facebook.com/hacked and Meta help pages walk through securing the account when login details changed.
After regaining access, remove unknown devices, change the password, and review recovery contacts.
If the attacker posted scams or changed your name, screenshot evidence before you undo changes.
Meta does not work with paid password sellers and never asks for OTP codes by message.
Nobody outside Meta can restore a disabled account for you.
Your Facebook password suddenly fails, friends get loan requests from your profile, or your display name and photo changed overnight. The first hour matters because attackers often add their own recovery email before you notice.
Meta's published order is email inbox first, then facebook.com/hacked, then session cleanup. This guide is the short path for a personal profile hack; our email changed guide goes deeper when login fails completely.
Secure the inbox or phone number on the account, visit facebook.com/hacked, and follow the hacked account help prompts. After access returns, open Security and login, log out unknown devices, change the password, and remove attacker edits to your name, photo, or linked Pages. If Meta disabled the profile, use the review option shown at login per disabled account help.
Attackers change the recovery address so password resets go to them. Meta's flows assume you can prove control of the contact on file. Fix that inbox before you chase Facebook-only shortcuts.
Use the official URL in a browser you trust, not a link from a stranger. Meta's phishing guidance warns that fake login pages steal credentials. After recovery, review recent logins under Security and login and end sessions you do not recognise.
A compromised personal profile can reach Pages you manage, Marketplace listings, or ad accounts. After you regain the profile, check Page roles, unpublished scam posts, and whether ads still run. Our Business Manager hacked guide covers spend pauses when business tools were touched.
Disablement notices appear at login. Meta's help says you may be able to request review within a limited window. Explain that the violating posts happened during a takeover and attach dates from your screenshots. Meta still decides.
If friends sent money to a scam message from your hijacked account, encourage them to call their bank and the National Scam Response Centre on 997 (MyGOV). Your recovery does not reverse their transfers, but a police report helps when officers investigate.
Nobody legitimate needs your password, OTP, or two factor codes to help you sign in. Paid recovery sellers cannot bypass Meta review. Treat urgent DMs claiming to be Meta Support as phishing.
Screenshot the fraudulent posts and messages immediately. Ask victims to report transfers to their banks, keep receipt numbers, and file a police report if officers accept online crime reports in your state. Post a clear warning from any account or Page you still control so the scam posts are not the last message people see.
Many Malaysian users tie Facebook to Messenger and Instagram through Meta accounts. After you secure Facebook, check whether Instagram or Messenger still show the attacker's sessions. Log out everywhere under Security and login, not only on the device you used for recovery.
Attackers sometimes rename profiles to mimic brands or add a new username to confuse search. After recovery, revisit profile settings and username rules on Facebook Help. If a username is locked, our username changed guide covers order of operations.
Turn on two factor authentication with an authenticator app where possible. Review login alerts by email so the next unfamiliar sign in pings you early. Remove apps and websites connected to Facebook that you do not recognise.
Disablement reviews can take days. Save every confirmation screen from facebook.com/hacked and any appeal reference numbers. Do not create a replacement personal profile to bypass disablement; Meta may treat that as ban evasion.
Meta lets many users download a copy of profile data while logged in. That export helps you prove prior posts and friend lists if an appeal asks what changed. Start the download early because large archives take time to prepare.
Store the export on your computer or cloud storage outside Facebook. If the account is disabled again, you still have timestamps for police or bank enquiries.
Most hacks clear through facebook.com/hacked when email access returns. SocialSafe by AwareXone reviews cases when email and Facebook recovery conflict, Business Manager and profile were both hit, or disablement appeals need a coherent timeline. We use official Meta routes only. See Facebook account recovery and Trust Center.
Can I recover without my phone?
Often yes if you still control the recovery email Meta shows in the flow. Use forgot password from a familiar browser.
Should I delete the account?
Usually recover first so you keep friend connections and Page links. Deleting is harder to undo.
Will Facebook remove scam posts automatically?
You should delete attacker posts after access returns. Meta may still review disablement separately.
Can AwareXone log in for me?
No. We never ask for passwords or codes. We help organise evidence and official appeals.
What if the hacker enabled two factor on their device?
Use account recovery options and remove unknown second factors in Security and login once you are in.
Should I warn Facebook friends by mass message?
Post one clear warning on your timeline after cleanup, or use another network, so you do not trigger spam filters while your account is fragile.
