How to Recover a Hacked Facebook or Instagram Account Step by Step

You open Facebook and your password does not work. Or a friend calls to say your Instagram is posting strange adverts for cheap phones and cryptocurrency. Someone else is inside your account, and they are using it to scam your friends.

First: Do Not Panic, and Do Not Pay Anyone

Before anything else, know this: account recovery through Facebook and Instagram is free. Nobody from Meta will message you offering to recover your account for a fee. Anyone who sends you a DM saying "I can recover your account, pay me" is a scammer, probably working with the same people who took your account.

Only use Facebook and Instagram's own pages, apps, and emails. Type the addresses into your browser yourself. Do not click links in messages, emails, or comments that claim to help you recover your account — those links are usually phishing pages designed to steal what is left of your access.

Also, secure your email first. Your email is the key to your social accounts, because password resets go there. If the hacker got into your email too, recovering your social accounts will not help. Change your email password now, turn on two-factor authentication on your email, and check that no forwarding rule or recovery address has been added that you do not recognise.

Recovering a Hacked Facebook Account

Step 1: Go to facebook.com/hacked

Open your browser and type facebook.com/hacked. This is Facebook's own recovery page. It will ask you to identify your account — enter your username, email address, or phone number — and then guide you through securing it. Follow the on-screen steps exactly. Facebook will ask questions to confirm you are the owner, and then let you reset your password.

You can also start from the login page: click Forgot password?, enter your email or phone number, and choose how to receive the reset code.

Step 2: Check your email for a change alert

When someone changes the email address or password on a Facebook account, Facebook sends a message to the old email address. Search your inbox — including your spam folder — for a message from Facebook about the change. That message usually contains a link to reverse the change. If you act quickly, clicking it can undo the hacker's change and give you your account back.

Do this even if you already started the recovery page. The email reversal is often the fastest route, and it works best in the first hours after the change.

Step 3: If you can still log in, secure the account immediately

Sometimes the hacker has not changed your password yet — they are just inside your account posting and messaging. If you can still get in, act now:

1. Change your password to a strong, unique one you have never used before.
2. Go to Settings, then Accounts Centre, then Password and security, then Where you're logged in. Log out every session you do not recognise.
3. Check that your email address and phone number are still yours. If the hacker added their own, remove them.
4. Turn on two-factor authentication.

Step 4: If the hacker changed your email and phone number

This is the harder case, and it takes longer. Facebook will ask you to prove who you are. It may ask you to confirm your identity with a government-issued ID, or to answer questions about your account. Follow the instructions on facebook.com/hacked and give a secure email address that only you can access, so Facebook can contact you there.

Be patient with this process. It can take a day or more, and Facebook does not promise that every account can be recovered. Give accurate information and do not submit multiple requests — that slows things down.

Recovering a Hacked Instagram Account

Step 1: Go to instagram.com/hacked

Open your browser and type instagram.com/hacked. This is Instagram's own recovery page, named by Instagram's Help Center for exactly this situation. It will ask whether your account was hacked, then ask for your username, email address, or phone number, and guide you through the next steps.

You can also start in the app: on the login screen, tap Forgot password?, enter your username, email, or phone number, and choose Send login link.

Step 2: Check your email for the security message

When someone changes the email address on an Instagram account, Instagram sends a message from security@mail.instagram.com to the old address. Open that message and select secure my account. Instagram says this may undo the change. Check your spam folder if you cannot find it.

This is the fastest way back, and it works best if you act within hours of the change. Search for that sender address before you try anything else.

Step 3: Ask for a login link

If your email and phone number are still the ones Instagram has on record, ask for a login link. On the login screen, tap Forgot password?, enter your details, and choose Send login link. Open the link from your email or text message, and set a new password straight away.

Step 4: If your email and phone were both changed

Choose the option that says you cannot access your email or phone number, and follow the identity check. Instagram may ask you to confirm details from when you signed up, or to record a short video selfie — turning your head in different directions so it can compare your face with the photos on the account. This is how Instagram confirms you are the real owner when the hacker has changed all the contact details.

The video selfie is deleted within 30 days, according to Instagram, and it is only used for this check. Follow the instructions carefully and be patient — the review can take a day or two.

Once You Are Back In: The Clean-Up Checklist

Getting back in is only half the job. The hacker may have left things behind. Work through this list before you relax:

• Change your password to a strong, unique one. Never reuse a password from another account.
• Turn on two-factor authentication with an authenticator app, not just text messages. Save your backup codes somewhere safe, offline.
• Log out all other sessions. On Facebook, check where you are logged in and remove every device you do not recognise. On Instagram, check login activity in Settings and log out anything unfamiliar.
• Check your email and phone number on the account. Remove any address or number the hacker added.
• Review connected apps and websites. In your settings, look at the apps and websites linked to your account and remove anything you do not recognise.
• Delete posts, stories, and messages the hacker sent. Delete the scam posts and warn the people the hacker messaged — a short post saying "my account was hacked, ignore any messages asking for money" protects your friends.
• Check your profile. Hackers sometimes change your bio, your profile photo, or your website link to point to a scam. Put everything back the way it was.

How to Stop It Happening Again

A hacked account is a warning. Here is how to make sure it does not happen twice:

Use a unique password for every account. If you used the same password on Facebook and three other sites, one leak exposes all of them. A password manager can remember them for you.

Turn on two-factor authentication everywhere. Email, Facebook, Instagram, WhatsApp, your bank. It is the single most effective protection you can have.

Never click login links in messages. Facebook and Instagram will never send you a login link in a DM. If a message says your account will be deleted unless you click a link, it is a scam. Delete it.

Check your login activity once a month. A quick look at where your account is signed in will show you a stranger's device before it becomes a problem.

If you want to know the warning signs that come before a hack — strange messages, login alerts, and the tricks scammers use — read our guide on 7 signs your phone may be hacked.

Frequently Asked Questions

How long does it take to recover a hacked account?

It depends on what the hacker changed. If only your password was changed, you may be back in within minutes. If your email and phone number were both changed, the identity check can take one to three days. Start as soon as you notice the problem — the faster you act, the better your chances.

Will Facebook or Instagram ask me to pay for recovery?

No. Recovery is completely free. Anyone asking for payment to recover your account is a scammer. Only use the official pages: facebook.com/hacked and instagram.com/hacked.

What if I cannot remember the email or phone number on the account?

Go to facebook.com/hacked or instagram.com/hacked anyway and follow the on-screen steps. Both platforms have a route for people who no longer have access to the contact details, usually through an identity check. Give a new, secure email address that only you can access.

Can I get my account back if the hacker turned on two-factor authentication?

Yes, but it takes longer. You will need to go through the identity check, because the hacker now controls the second factor too. Start at the hacked-account page, choose the option saying you cannot access your email or phone, and follow the video selfie or ID steps.

Act Now, Then Lock It Down

A hacked account feels personal, and it is. Someone has walked into your digital home and started talking to your friends. But it is fixable. Start at facebook.com/hacked or instagram.com/hacked, check your email for the change alert, and follow the official steps. Then change your password, turn on two-factor authentication, and clean up everything the hacker touched.

And if the hack has shown you that your online presence needs stronger foundations — a proper website, secure tools, and a business that does not depend on one social account — explore our services or contact us. We will be glad to help.