Accounts & passwords
How to get a hacked Instagram or Facebook account back
Losing a social media account is stressful, especially if it’s years of photos or the page your business relies on. Hackers often lock you out by changing the email and phone number, then use the account to scam your friends or followers. Here’s how to use the official recovery routes and avoid the fake “recovery experts” who prey on people in this situation.
The short version
Start here
- Check your email for a security alert and use its “secure my account” link.
- Go to instagram.com/hacked or facebook.com/hacked.
- Warn friends not to click anything from your account.
- Never pay anyone who offers to recover it for you.
First, check your email
When someone changes the email address, phone number or password on an Instagram or Facebook account, Meta normally sends an alert to the old email address. That message often contains a link to reverse the change and secure the account.
Search your inbox, and spam folder, for recent emails from Instagram or Facebook. Before clicking, check the sender. Real ones come from addresses ending in @mail.instagram.com or @facebookmail.com. Even better, go to the official recovery page below rather than using links.
Go to instagram.com/hacked
Type instagram.com/hacked into your browser. Choose the option that describes your situation, such as “My account was hacked”.
Request a login link or security code
Enter your username, email or phone number. If you still have access to the email or phone, you’ll get a code or link.
Verify your identity if asked
If the hacker changed your details, Instagram may ask you to record a short video selfie to prove the account is yours. Follow the instructions in the app.
Secure the account once you’re in
Change your password, review the email and phone number, remove unknown devices from Accounts Centre, and turn on two-factor authentication.
Go to facebook.com/hacked
Type facebook.com/hacked into your browser and follow the steps.
Use another device you’ve logged in with
Recovery tends to work best from a phone or computer you’ve used to log in before, on a network you normally use.
Follow the identity checks
Facebook may ask for a code, to identify friends, or for ID. Only provide this through Facebook’s own pages.
Secure everything once you’re back
Change your password, check Accounts Centre for unknown devices and apps, review your email and phone, and turn on two-factor authentication.
Avoid “account recovery” services
People who’ve lost accounts get flooded with messages from “hackers” and “Meta agents” offering to get the account back for a fee. They are scammers. Meta doesn’t charge to recover accounts, and doesn’t contact users through comments or direct messages to offer help.
While you’re locked out
- Warn your friends and followers from another account, by message or in person, that anything sent from your account isn’t you. Hacked accounts are often used for crypto, giveaway or “can you help me out” scams.
- Secure your email first if you think it was also compromised, because recovery codes go there. See what to do if your email is hacked.
- Ask friends to report the account as hacked through the platform if it’s posting scams.
For business pages
- Have at least two admins, each with their own personal account and two-factor authentication. Never share one login between staff.
- Manage pages through Meta Business Suite or Business Manager, so access belongs to the business rather than one person.
- Remove admins when staff leave or agencies finish their work.
- Be wary of messages claiming your page has broken the rules and will be removed unless you “appeal” through a link. This is a very common way business pages are stolen.
Keeping accounts safe
- Use a unique password, saved in a password manager.
- Turn on two-factor authentication using an authenticator app rather than text messages where you can.
- Save backup codes somewhere safe.
- Don’t log in through links in messages. Open the app instead.
Common questions
How long does recovery take?
It can be minutes if you still control the email, or days if identity checks are needed. Keep trying through the official pages.
The hacker turned on two-factor authentication. Can I still get back in?
Often yes, through the identity verification routes on the official recovery pages.
Should I just make a new account?
If recovery fails, you may need to. Report the old account as hacked so it can be disabled, and tell friends which account is the real one.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.