facebook account hacked and password changed · email and phone changed · facebook account recovery without email
Facebook's own starting point for a hacked account is one address: facebook.com/hacked — opened, if you can, on a device you have used for Facebook before.
Reconstruction for explanation · not a real Facebook screen
From there the route splits: Facebook account hacked and password changed, email changed, or Facebook account recovery without email and phone. Each has its own official step, and each has a point where it stops.
Your route back
Each branch below runs to the end. Labels follow Facebook's help, which writes both “Accounts Center” and “Accounts Centre”; people moved to “Meta Account” settings will find the same items there. Not sure the account is hacked at all? Weigh the signs on the Facebook hub first.
Work through it before the other session changes anything else.
This is the address Facebook's help gives for a hacked account.
The limit We have not gone past the first screen of facebook.com/hacked, and the help does not list its branches, so this page does not describe them.
Open facebook.com/hackedWhen the email on an account is changed, Facebook sends a message to the previous address with a special link. The link reverses the change.
The limit Facebook's help names no period during which the link works, so none is named here. Use it when you find it.
How to tell a real emailFacebook's help gives a route for people who can no longer open the email or the phone on the account.
The limit This is where “recovery agents” appear. Facebook's help names no outside service that can run these checks for you; Bitdefender describes what such offers turn into — an advance, more payments for “server access” and “verification”, a fake login page, a request to forward a code.
Open facebook.com/login/identifyIf the checks include confirming your identity, Facebook's help lists what it takes.
The limit We read this help page in summary, not in full, and it does not say how long the copy is kept — so we say nothing about that. Send a document only through the form Facebook itself opens, never to a person who writes to you.
More on the ID stepUndo the change
Each sign on Facebook's own list points at one change. Undo the change, not only the symptom. The weighed checklist of signs is on the hub.
| What you notice | What was changed | What undoes it |
|---|---|---|
| An email says the email address on the account was changed | The inbox that receives reset links | The special link Facebook sent to the previous address |
| An email says a phone was added or removed | A contact that can receive codes | Once back in, remove every email and phone that is not yours |
| Your password no longer works | The password | facebook.com/hacked, from a device that logged in before if you have one |
| Two-factor authentication stopped working | The second step, or the phone behind it | facebook.com/hacked; once inside, set it up again and take fresh recovery codes |
| A device you do not know under Where you're logged in | Someone holds a session | Select devices to log out → Log out; it is immediate |
| Posts, messages or a profile photo you did not make | Actions taken from inside the account | Get back in first; then remove them and warn the recipients through another channel |
| Neither the email nor the phone works for you any more | Both contacts | facebook.com/login/identify → No longer have access to these? → a contact the account never had |
The signs are Facebook's; pairing each with its undo step is our reading of the same help articles.
Real or fake
Facebook's help names the domains its mail comes from — fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, metamail.com, global.metamail.com and their subdomains — and adds the rule that settles most cases: “Facebook will never ask you for your password in an email or send you a password as an attachment.”
Sender lines can be faked, so the deciding check is inside the account. In Recent emails the SECURITY tab keeps a year of Facebook's security mail and OTHER EMAILS keeps two days. Your “password changed” message is there — it is real; it is not — leave its links alone. The method for any platform is on how to tell a real email.
Locked out and unable to look? Do not test the doubtful email by tapping it: type facebook.com/hacked yourself and start there.
What you will be offered
A locked-out owner is the best customer these offers have. Sites that promise to “find” a Facebook password are a separate story, told on the hub.
“Meta specialist: we recover your hacked Facebook account.”
Bitdefender describes the pattern: a fee up front, then more for “server access”, “verification”, “software”, “final activation”; a fake login page; a request to forward the code you were sent. Forwarding the code hands over the account you were trying to save.
“Install our restore tool and log in with Facebook to get access back.”
No restore tool appears in Facebook's help; the route runs through facebook.com in your own browser. A login box inside an outside app is exactly what Meta's 2022 report described: more than 400 Android and iOS apps — photo editors, games, VPNs, utilities — that collected the login and password typed into a “Login With Facebook” screen.
“Send us a photo of your ID and we will forward it to Meta.”
The document step belongs to Facebook's own flow, which you start yourself. A stranger collecting ID photos in Messenger or WhatsApp is outside it — what Facebook really accepts is listed below.
“Ask your trusted contacts for codes.”
The current Facebook help articles we read do not mention trusted contacts, and we could not confirm that the feature still works. We do not send you there; the routes that the help does describe are the ones above.
After you are back in
Use Select all if you are not sure, then log in again on your own devices.
You should see: only your own devices are left; the logout is immediate.
Length does most of the work: NIST's floor for a password used on its own is 15 characters, CISA advises 16 or more. Rules and examples are on password strength check; test the one you plan to set in the password check.
Facebook offers a security key, an authentication app or SMS, and its help also mentions creating a passkey.
Ten codes, one use each; Get new codes issues a set. Keep them away from the phone they protect — why recovery codes matter.
Remove everything that is not yours. Then secure the mailbox itself: its own password, its own second factor.
The SECURITY tab keeps a year. It shows which security emails went out while you were locked out.
The ID step
Facebook's help page on confirming identity, which we read in summary rather than in full, lists what is accepted: one government-issued document — a driving licence, a national identity card, a passport or a birth certificate — or two non-government documents that show your first and last name. Photos of documents that were processed on a computer are not accepted. Sensitive details that are not needed may be covered.
Two cautions. We read that page in summary and in another language version, so check its current list before you photograph anything. And the page does not say how long Facebook keeps the copy; we will not guess.
The request for a document comes inside Facebook's own recovery flow, after you have started it yourself at facebook.com/hacked or facebook.com/login/identify. A person who asks for a photo of your ID in Messenger, WhatsApp or email is not that flow.
Questions
The previous inbox: Facebook's message there carries the special link that undoes an email change. No message? Then facebook.com/hacked, followed by facebook.com/login/identify → No longer have access to these?, ideally on a device that has run this Facebook before.
The help articles we read give two addresses, facebook.com/hacked and facebook.com/login/identify, and no phone number. Treat a “Facebook support” number from search results or a comment as unverified, and give it no code and no password.
The help describes finding your account at facebook.com/login/identify without listing what it can be found by, so try what you remember. Getting in then depends on the checks Facebook offers after No longer have access to these? — you will need a new email or phone that was never on the account.
The help gives the advice without explaining it: “If you can, use a device that you've used to log in to Facebook before.” It is advice, not a condition — if you have no such device, start anyway.
No. The articles this page relies on cover lost access, not disabled accounts, and we have no confirmed steps for an appeal. We give none rather than guess.
Facebook's help names no outside service that can. The route runs on facebook.com in your own browser; anyone who needs your login code, your password or a photo of your ID is outside it (see recovery offers). If money has already gone to such a “helper”, that is a matter for a complaint — in India through 1930 and cybercrime.gov.in.
Take it with you
Print the page or save it as a PDF to keep the steps next to your phone while you go through the settings.
Where next
