Recovering a hacked Facebook, Instagram, or Meta account

A hacked Meta account is unusual because Facebook, Instagram, Threads, and the accounts linked in your Meta Accounts Center behave as one identity system. One compromised email or reused password can put several accounts at risk at once, and there is no support phone number or general human queue you can simply call. Recovery runs through Meta’s own guided flows, and the best chance of success is to use them exactly as designed.

This guide is based on our review of Meta’s official help documentation and current recovery pages, not a hands-on recovery of any specific account. Meta changes these flows often, and the options shown depend on the account type and region — treat the steps below as a map, and follow what Meta actually displays on screen.

Before you start

• Use a device you have signed in from before. Meta’s recovery flows use recognized devices and locations to confirm who you are, and Meta says explicitly to use one when possible. A brand-new device or browser makes verification harder.
• Check the email that was previously attached to the account. When an attacker changes the email address on a Facebook or Instagram account, Meta sends a message to the old address with a special link that can reverse the change. If that message is sitting in your inbox, use it before anything else.
• Do not delete anything. Security emails, notifications, and account messages are evidence for Meta’s review and for any support case you open later.
• Do not pay anyone who offers to “hack it back” for you. No legitimate service can bypass Meta’s identity checks. Anyone asking for your password, a login code, or an upfront fee to recover the account is running a second scam on top of the first.

Facebook

The official starting point is facebook.com/hacked, on a device you have used before. Meta’s flow walks through securing the account, changing the password, and reviewing where you are logged in.

Meta lists these as signs an account was hacked:

• Your profile picture was changed.
• There are posts, comments, or messages you didn’t write.
• You can’t log in, or your two-factor method has stopped working.
• You get a login notification you didn’t trigger.
• You receive an email saying your email address, phone number, or password was changed.

If you can still sign in: change your password, review Where you’re logged in and log out unfamiliar devices, turn on two-factor authentication, and confirm your email and phone details.

If you can’t sign in, or the attacker changed the email or phone on the account: use the recovery flow at facebook.com/hacked. If the account’s email and phone are no longer reachable, Meta has a separate path for that situation, and may ask you to confirm your identity — sometimes with a government ID. If the account was locked or disabled because of activity the attacker caused, follow the on-screen unlock or appeal prompts rather than a plain password reset.

Instagram and Threads

Threads uses the same Instagram account, so recovering Instagram covers both. Start at instagram.com/hacked.

If you can still sign in:

1. Check your email for a message from Meta’s official Instagram security address; if your email address was changed, that message contains a secure my account link that can reverse it.
2. Change your password and turn on two-factor authentication.
3. Confirm your phone number and email address are still yours.
4. In Accounts Center, remove any linked accounts you don’t recognize.
5. Revoke access for suspicious third-party apps.

If you’re locked out: request a login link to your email or phone. If that doesn’t arrive, request support on a mobile device, entering a secure email address only you can access; Meta emails next steps from there. Where the account has photos of you, Meta may ask for a short video selfie to confirm you’re a real person — Meta states the video is never shown on Instagram and is deleted within 30 days. Accounts without photos of you get a different route and a written response.

If you have a professional account and someone is still acting on it while you can still log in, Meta documents a path through Meta Business Suite’s business settings to remove unauthorized business managers.

Not every option appears in every case — Meta notes that some recovery steps may not be available depending on the type of account you’re trying to recover.

Pages, business portfolios, and ad accounts

If the attacker reached a Facebook Page or a Meta business portfolio, work through the official Page recovery form at facebook.com/help/recoverpage. Meta says this form is the fastest route even if you have Meta Verified or other support — and the form can only act when Meta can confirm the Page was compromised.

While you still have any access, remove unfamiliar people from Page roles and the business portfolio’s People settings, disconnect unknown partners, and check payment methods and billing for ad spend you didn’t authorize. After access returns, undo any changes you don’t recognize and consider turning on Advanced Protection.

If the free flows stall

• The Account Recovery Hub at meta.com/account-recovery-support centralizes Meta’s official flows for Facebook, Messenger, Instagram, Threads, and Meta accounts, and is the best place to find the current path for your exact situation.
• Meta Verified is Meta’s paid subscription that includes chat and email support, with higher plans adding prioritized, phone, and monitored support. It can reach a human agent and move a stalled case, but Meta applies the same identity checks and it does not guarantee recovery.
• Meta decides the outcome. Deleted accounts may be unrecoverable, and accounts disabled for policy reasons follow an appeal path rather than a hacked-account path. No amount of pressure, and no third party, changes that.

One safety note while a case is open: Meta says its correspondence comes only from official Facebook, Instagram, or Meta email domains, and that support chats can only be started by you. A message, call, or DM that arrives first — however official it looks — is not Meta. Never share a login code or password with an agent or a “recovery expert.”

After you’re back in

• Set a new, unique password you haven’t used anywhere else, and keep it in a password manager.
• Turn on two-factor authentication. An authenticator app or passkey is stronger than SMS.
• Review active sessions and devices, and log out anything unfamiliar.
• Confirm the recovery email and phone on the account are yours, and update them.
• In Accounts Center, remove linked accounts and third-party app access you don’t recognize.
• Run Meta’s Security Checkup and turn on login alerts.
• Secure the email account itself. If the attacker had access to your email, that account needs its own password change and two-factor reset — Meta’s recovery depends on it.
• Warn your contacts. Attacker-sent messages often target friends and family with scams or malicious links.
• Report any imposter or duplicate account that was created in your name.

How Jeyki can help

Our Hacked Account Recovery service exists for exactly this situation: a focused assessment of what happened and which recovery path fits, an evidence checklist for the case, guidance through Meta’s official flows, and a security checklist once access returns. We use only Meta’s official recovery and support channels, never ask for your password, and cannot bypass Meta’s identity checks or platform decisions — no honest provider can. The assessment is $99, and the additional recovery fee is due only if you are back in control of your account.