Facebook account hacked? Do these 6 things first

The first hour matters more than anything else. Work through these six steps in order, and do not skip step one even if you think you still have access.

1. Try the official recovery route before anything else

Go to facebook.com/hacked. This is Facebook’s own compromised-account flow and it unlocks options the normal login screen does not offer. If you can still receive email or SMS on the address or number attached to the account, you will often be back in within minutes.

Do not search the web for “Facebook support phone number”. Facebook does not offer phone support to ordinary users, and nearly every number you find will be someone trying to charge you for a free process.

2. Check whether your email account was the real target

Very often the Facebook account was not broken into directly — the email inbox behind it was. If your email password has been changed or you see sign-ins you do not recognise, secure the email first. Recovering Facebook is pointless while an attacker still controls the inbox that can reset it.

3. Change the password and end all other sessions

Once you are back in, change the password to something long and unique, then go to Settings & Privacy → Password and Security → Where you’re logged in and log out of every device you do not recognise. Changing the password alone does not always kick an intruder out.

4. Turn on two-factor authentication

This is the step that stops it happening again, and it is the one most people skip. Use an authenticator app rather than SMS where you can — SIM-swap attacks make text messages the weakest of the options.

5. Check what was changed while you were locked out

Look carefully at recovery email addresses and phone numbers, because attackers add their own so they can walk straight back in later. Then check for posts or messages sent in your name, and for any ad account spending. On a business page, check the admin list — an added admin is the most damaging change of all.

6. If it is a business page, act on roles immediately

Business pages are attacked far more than personal profiles because they can run ads. If you still have any admin access, remove unknown people from Business Manager and revoke their access before anything else. If you have lost admin entirely, Facebook’s business support channel is a different route from the personal one and is worth pursuing properly.

What not to do

Do not pay anyone who contacts you offering to recover your account, especially on WhatsApp or Instagram. Recovery is free, and the “recovery expert” who approaches you first is almost always connected to the problem. Do not create a duplicate account either — it can complicate the real recovery.