Why it matters
Many of us keep plenty of personal information on Facebook: photos, contacts, messages and links to other services. That makes it attractive to attackers. Even if you use a strong password, accounts can be compromised by phishing, malware, lost devices or reused passwords. The good news: there are straightforward checks you can run, and short actions that usually stop further damage.
Quick signs your account may be compromised
- You can’t log in with your usual password, or Facebook tells you that your email or phone number has changed. - You notice posts, messages or friend requests you didn’t create. - Friends tell you they’ve received odd messages or links from you. - You’re getting password‑reset emails you didn’t request, or alerts about logins from unfamiliar places. - Your profile information, profile picture, or cover photo changed without your involvement. - You see unfamiliar apps, games or pages listed under account settings, or you’ve suddenly been made an admin of a page you don’t recognise.
If any of these are true, act quickly.
What to check and how to secure the account
1. Try to log in and change your password - If you still have access, change your password immediately to a new, strong one you haven’t used elsewhere. Use a password manager if you can. - If you’ve lost access, use Facebook’s account recovery flow to reclaim the account. That process can involve confirming your identity, trusted contacts or other recovery options.
2. Review recent logins and active sessions - From Facebook’s security or login settings, check the list of devices and locations currently signed in. End any session you don’t recognise. This logs the attacker out on that device.
3. Turn on stronger account protections - Enable two‑factor authentication (2FA). Prefer an authentication app or security key over SMS when possible. 2FA makes it much harder for attackers to reuse stolen passwords.
4. Check and remove suspicious apps and integrations - Review apps, websites and services connected to your Facebook account and remove anything you don’t recognise. Revoke permissions for apps that don’t need access to your account.
5. Inspect posts, messages and profile changes - Delete any posts or messages the attacker sent. Check sent messages and message requests — attackers sometimes use accounts to spread phishing links. - Restore profile information and privacy settings to what you prefer.
6. Secure your email and other linked accounts - If an attacker has control of the email address used for your Facebook account they can reset your password again. Ensure that email account is secure with its own strong password and 2FA.
7. Scan your devices for malware - Run a reputable antivirus or anti‑malware scan on any computer or phone you’ve used to access Facebook. Remove anything suspicious and update your software.
8. Tell your contacts and report the problem - Let friends know not to click strange links coming from your account. Report the hacked account to Facebook through its security help options.
Final tips
Be cautious with emails and messages that ask you to log in. Instead of clicking links, go to Facebook directly in your browser or app. Avoid reusing passwords across services. Regularly review login activity and app permissions — a few minutes every month can prevent a lot of stress later.
