STEP 01

Start with the account, not the unfamiliar email

Open facebook.com/hacked on a phone or computer you previously used to sign in. Facebook recommends using a familiar device for hacked-account recovery. Follow the prompts to identify your account and review the options offered.

Changed contact details do not create a universal shortcut. The available checks depend on the account and what Facebook can verify. If a screen offers another way to confirm your identity, follow that official route.

STEP 02

Protect the inbox you used for Facebook

Your email may also need attention. Use its provider’s recovery process if you cannot access it. Once inside, review its password, two-factor authentication, recovery details, and unexpected forwarding rules. An insecure inbox can expose other accounts to password resets.

Write down which email you originally used and when you first noticed the change. Keep any relevant notifications privately with your case notes; do not publish personal details in a help group.

STEP 03

If the code goes to the wrong person

Do not contact the unfamiliar email address or phone number and ask its owner for a code. Use only the alternatives Facebook provides in the recovery flow. If no usable option appears, record the exact message and which step you reached.

If identity verification is offered, submit documents only through the verified official process. Someone contacting you in a comment or direct message is not a safe substitute.

STEP 04

Record what changed

A short case note helps you explain the problem without starting over each time. Keep these details together:

  • Your profile URL, if you have it.
  • The last date you could access the account.
  • Which email, phone, or two-factor method appears to have changed.
  • The recovery route attempted and the result shown.
  • Any existing case reference.

This is your private record. We do not collect it or request your login information.

STEP 05

If you regain access

Change your password, end other sessions, enable two-factor authentication, and confirm your recovery details. Warn contacts about messages you did not send. Our free protection checklist helps you work through the next steps.