Instagram or Facebook Hacked in the US: File With IC3 or FTC?

Here's how the US reporting options fit together.

Last checked: 29 October 2026 against the sources listed at the end of this guide.

Keep a dated note of every screen you see, including the exact wording shown, before you press continue on any form. Keep a dated note of every screen you see, including the exact wording shown, before you press continue on any form.

#Where do I report?

The FBI's Internet Crime Complaint Center (IC3) calls itself the central hub for reporting cyber-enabled crime. It says to file a report even if you're unsure whether your complaint qualifies, and to call 911 or local police if anyone is in immediate danger. The IC3 warns that scammers impersonate it: it doesn't work with non-law-enforcement entities such as law firms or crypto services to recover lost funds, and it will never contact you directly for information or money.

ReportFraud.ftc.gov is the US federal government's website for reporting fraud, scams and bad business practices. The FTC says reports are shared with over 2,000 law enforcers and entered into Consumer Sentinel, a secure database used by authorities worldwide. It also says it can't resolve individual reports, but uses them to spot patterns, investigate and bring cases.

#What should I do first?

1. Recover through Meta.
2. Call your bank.
3. File with the FTC.
4. File with IC3 if money was lost.

Related guides: Hacked Instagram or Facebook in Australia: Do I Report to ReportCyber or IDCARE First?, Instagram or Facebook Hacked in Singapore: Where Do I Report It and Who Can Help Me Recover?.

#What Do the Official Help Pages Say?

If you think someone else got in and posted the content, Instagram's If you think your Instagram profile has been hacked page lists the recovery steps. If you got an email from security@mail.instagram.com saying your email was changed, you may be able to undo it with the secure my account option in that message. You can also request a login link from the login screen with Forgot password, and if that fails, request a security code or support from a mobile device.

Instagram's View your recent login activity page says you can see devices that recently logged into your account in Settings, under Password and security, then Where you're logged in. Choose your account, then Select devices to log out, pick the devices and tap Log out. In the older Login Activity view, tap This Wasn't Me on any login you don't recognise and follow the steps to reset your password and secure the account.

#What common mistakes should I avoid?

• Expecting agencies to recover accounts.
• Not calling your bank.
• Paying 'IC3 agents' who contact you.
• Skipping Meta recovery.

The IC3 FAQ says the complaint form asks for your contact details, financial loss and transaction information such as the date, amount and who received the money, details of the person who committed the crime, including any email, website or IP address, and what happened. Analysts review complaints and pass them to law enforcement as appropriate, but you won't hear back from the IC3, which doesn't investigate or give case status. Save or print your complaint when you submit it, because that's the only time you can keep a copy. The IC3 doesn't accept attachments, so keep your original evidence, such as receipts, emails and screenshots of web pages, somewhere safe.

Instagram's Secure your Instagram account page calls two-factor authentication the single most effective step to protect an account from hackers, because it asks for a code when someone logs in from a device Instagram doesn't recognise. It also recommends a strong, unique password you haven't used elsewhere, avoiding personal details like names and birthdays, and never giving your password to anyone you don't know and trust.

Meta's Securing your Meta Account with two-factor authentication page says two-factor authentication asks for a code when there's a login attempt from a device Meta doesn't recognise. Turn it on in Accounts Center, under Password and security, then Two-factor authentication. You can choose an authentication app, which Meta recommends, a text message, or WhatsApp. If you lose your phone, a backup code lets you log in, and Meta says you shouldn't tap Trust this device on a public or shared device.

#How do I keep the account safe while I sort this out?

• Never share a login code, password or backup code with anyone, including people who say they work for Meta, the police or a recovery service.
• Make sure the email address and phone number on the account are ones you still control, and remove any you do not recognise.
• Turn on two-factor authentication where the platform offers it, ideally with an authenticator app, and keep your backup codes somewhere offline.
• Log in only from the official app or by typing the address yourself, not from links in messages, comments or ads.
• Keep screenshots of every notice, email and step you take, with dates, in case you need them for a review or a report.
• Make one careful attempt at each official step rather than many rushed ones, because repeated failed attempts can trigger extra checks.

#When It Is Safer to Get Expert Help

Ask for help before you appeal if the account matters to your income, your business or your memories, if you have already had one appeal rejected, or if you cannot tell whether the problem is a bug, a restriction or a hack. That is where most avoidable losses happen.

AwareXone is independent and not affiliated with Meta, Instagram, Facebook, WhatsApp or Threads. Recovery work is best-effort and the platform makes the final decision.