Meta account recovery: hacked Facebook and Instagram accounts

Start with the account you need to recover

• Facebook or Messenger: open Facebook’s hacked-account recovery, preferably on a device you’ve used to sign in before.
• Instagram or Threads: open Instagram’s hacked-account recovery and follow the options for the affected profile.
• Meta account, or unsure which route applies: use Meta’s Account Recovery Hub. It separates hacked accounts, lost email or phone access, and two-factor authentication problems by platform.

These are Meta’s recovery services. Jeyki Security can’t bypass its identity checks or guarantee that an account will be recovered. If your recovery email was also taken over, secure it using the hacked-email checklist.

A compromised email, reused password or connected login can put more than one social account at risk. Check which apps and profiles are actually linked in Accounts Center or the newer Meta Account settings. Meta is gradually changing this interface, and accounts can be kept separate. Start recovery through the official flow for the account affected.

This guide is based on my review of Meta’s official help documentation and current recovery pages, not a hands-on recovery of any specific account. Meta changes these flows often, and the options shown depend on the account type and region, treat the steps below as a map, and follow what Meta actually displays on screen.

If your recovery email or phone was changed

If you can still sign in, review your contact details and security settings from inside the official app. If you cannot sign in, use the platform’s recovery flow below rather than repeatedly sending reset codes to a contact you no longer control. Check the previous email inbox for a genuine change notification, using the provider’s official guidance to verify it.

If the email inbox itself was taken over, start with the hacked-email checklist. Secure that recovery route before relying on it to reset your social accounts. Keep the dates and notices showing what changed, and warn contacts through another channel if the account is sending messages.

Before you start

• Use a device you have signed in from before. Meta’s recovery flows use recognized devices and locations to confirm who you are, and Meta says explicitly to use one when possible. A brand-new device or browser makes verification harder.
• Check the email that was previously attached to the account. When an attacker changes the email address on a Facebook or Instagram account, Meta sends a message to the old address with a special link that can reverse the change. If that message is sitting in your inbox, use it before anything else.
• Do not delete anything. Security emails, notifications, and account messages are evidence for Meta’s review and for any support case you open later.
• Do not pay anyone who offers to “hack it back” for you. No legitimate service can bypass Meta’s identity checks. Anyone asking for your password, a login code, or an upfront fee to recover the account is running a second scam on top of the first.

Facebook

The official starting point is facebook.com/hacked, on a device you have used before. Meta’s flow walks through securing the account, changing the password, and reviewing where you are logged in.

Meta lists these as signs an account was hacked:

• Your profile picture was changed.
• There are posts, comments, or messages you didn’t write.
• You can’t log in, or your two-factor method has stopped working.
• You get a login notification you didn’t trigger.
• You receive an email saying your email address, phone number, or password was changed.

If you can still sign in: change your password, review Where you’re logged in and log out unfamiliar devices, turn on two-factor authentication, and confirm your email and phone details.

If you can’t sign in, or the attacker changed the email or phone on the account: use the recovery flow at facebook.com/hacked. If the account’s email and phone are no longer reachable, Meta has a separate path for that situation, and may ask you to confirm your identity, sometimes with a government ID. If the account was locked or disabled because of activity the attacker caused, follow the on-screen unlock or appeal prompts rather than a plain password reset.

Instagram and Threads

For a Threads profile connected to Instagram, start with the Instagram recovery flow at instagram.com/hacked.

If you can still sign in:

1. Check your email for a message from Meta’s official Instagram security address; if your email address was changed, that message contains a secure my account link that can reverse it.
2. Change your password and turn on two-factor authentication.
3. Confirm your phone number and email address are still yours.
4. In Accounts Center, remove any linked accounts you don’t recognize.
5. Revoke access for suspicious third-party apps.

If you’re locked out: request a login link to your email or phone. If that doesn’t arrive, request support on a mobile device, entering a secure email address only you can access; Meta emails next steps from there. Where the account has photos of you, Meta may ask for a short video selfie to confirm you’re a real person, Meta states the video is never shown on Instagram and is deleted within 30 days. Accounts without photos of you get a different route and a written response.

Not every option appears in every case, Meta notes that some recovery steps may not be available depending on the type of account you’re trying to recover.

Meta account recovery

If the sign-in screen names a Meta account, start with the Meta account recovery section of the official hub. Choose the issue that matches what happened: a hacked account, lost access to your email or phone, or a two-factor authentication problem. Meta’s hacked-account guidance also points to the relevant Facebook and Instagram help flows.

Accounts Center and the newer Meta Account settings can group apps differently. Follow the recovery route for the account you cannot access; recovering one profile does not establish that every linked account is secure. Review the other profiles and their recovery details separately.

If the free flows stall

• The Account Recovery Hub centralizes Meta’s official flows for Facebook, Messenger, Instagram, Threads, and Meta accounts, and is the best place to find the current path for your exact situation.
• Meta Verified may offer support for eligible subscribed profiles, but benefits and availability vary. Meta says enhanced support may not be available to every subscriber. Check the exact offer inside the official app before paying, and do not buy a subscription expecting guaranteed recovery of a locked account. The subscription comparison explains what to check.
• Meta decides the outcome. Deleted accounts may be unrecoverable, and accounts disabled for policy reasons follow an appeal path rather than a hacked-account path. No amount of pressure, and no third party, changes that.

One safety note while a case is open: Meta’s recovery hub says its in-app AI support chats are started by you. Security notifications can arrive when account details change; verify them using the official app or Help Center. Treat unsolicited support calls or DMs asking for your password, a login code or payment as suspicious. Never share a login code or password with an agent or a “recovery expert.”

After you’re back in

• Set a new, unique password you haven’t used anywhere else, and keep it in a password manager.
• Turn on two-factor authentication. An authenticator app or passkey is stronger than SMS.
• Review active sessions and devices, and log out anything unfamiliar.
• Confirm the recovery email and phone on the account are yours, and update them.
• Review linked profiles in Accounts Center or Meta Account, and check connected-app permissions in the relevant app. Follow the official recovery guidance if anything unfamiliar appears.
• Run Meta’s Security Checkup and turn on login alerts. The Meta account security checklist walks through linked accounts, recovery details and WhatsApp device checks.
• Secure the email account itself. If the attacker had access to your email, that account needs its own password change and two-factor reset, Meta’s recovery depends on it.
• Warn your contacts. Attacker-sent messages often target friends and family with scams or malicious links.
• Report any imposter or duplicate account that was created in your name.

If a scam led to this

Recovery of the account itself runs through Meta, and I can’t do it for you or speed it up. If the takeover followed a scam, such as a fake login page, a call or a message asking for a code, I can secure your devices and your other accounts afterwards. See post-scam cyber cleanup. If money was sent, call your bank first, then the Canadian Anti-Fraud Centre on 1-888-495-8501.