How to Know If Your Facebook Account Was Hacked (and What to Do)

That sinking feeling when a friend messages to say 'did you really send me that link?' is one I'd never wish on anyone. If you use Facebook for work, a taken-over account is more than an annoyance: it can mean strangers posting in your name to customers and groups. The good news is that Facebook's help centre lists specific warning signs and a clear recovery route. I've set them out below, along with what to do first and how to make a repeat less likely.

Signs your Facebook account was hacked, according to Facebook

The help article on recovering your account if you were hacked lists the situations where you should suspect someone else has access. Any one of these is worth taking seriously:

• Your profile picture has been changed.
• There are posts, comments or messages that you didn't write.
• You're having problems logging in, or your two-factor authentication method has stopped working.
• You received an email from Facebook saying an email address or mobile number was added or removed, or that your password was changed, and it wasn't you.
• In the Where you're logged in section of Settings, you see a device or location you don't recognise.
• Details such as your name or birthday have changed, or friend requests have gone to people you don't know.

Wording and menus vary by app version, so use the list as a guide and trust your instincts if something looks wrong.

How to check where your Facebook account is logged in

This is the quickest self-check if you can still get into your account. Facebook says to look at the Where you're logged in section of your Settings. If you see a device or location you don't recognise, you can select that device and log it out.

1. Open Facebook and go to Settings.
2. Find the security and login area, then open Where you're logged in.
3. Look through the list for any device or place that isn't yours.
4. Select anything unfamiliar and log it out.

Seeing a second location doesn't always mean trouble. If you've used a work laptop or travelled, you'll see those too. What matters is anything you can't explain.

What to do first if your Facebook account was hacked

Facebook's own advice is to go to its dedicated hacked-account page, which is part of the help centre, and to use a device you've logged in from before if you can. Type the address in yourself rather than following a link in a message or email. Scam messages often imitate Facebook, and Facebook has a separate article on what to do if you've been phished.

If you can still log in

1. Change your password to something new that you don't use anywhere else.
2. Log out any devices or sessions you don't recognise.
3. Review your activity log for actions you didn't take. Facebook has help articles on finding your activity log.
4. Set up two-factor authentication, which Facebook recommends.

If your email address was changed

Facebook says that when an email address is changed, a message is sent to the previous email account with a special link. Clicking it reverses the change and secures the account. So check the old inbox, including spam, before you do anything else.

If you can't get in at all

Facebook has a separate help article for when you can't reach the email address or mobile number on the account. It says you may be able to recover the account through the hacked-account page even if you're not certain it was compromised. Follow the steps shown on screen, because they vary by app version and by what Facebook knows about your account.

Reporting a hacked Facebook account whether or not you can log in

Facebook says you can report an account as compromised whether or not you can still log in. If someone has reached your financial accounts or made purchases you didn't authorise, Facebook's help centre says to contact your bank immediately. That's one for your bank rather than for Facebook.

A hacked Facebook account and the Pages you manage

If you run business Pages from your profile, a taken-over personal account puts those at risk too, because your profile is how you reach them. Facebook has a separate help article about recovering a hacked Page you manage, so it's worth searching the help centre for it once your own account is secure. If you're wondering how many Pages hang off one login, I've explained how many Facebook Pages one account can run, and it's a good reminder of how much one password protects.

How to tell a hacked Facebook account from a stale feed

Not every odd Facebook experience means someone broke in. An out-of-date Home feed, for example, is usually just how the feed works. If that's all you're seeing, my guide to why your Facebook feed shows old posts will save you a lot of worry.

Scam phone numbers claiming to be Facebook support

Be wary of anyone offering a telephone number for Facebook hacked-account support. Facebook's help pages point you to its own recovery page and help centre, and websites promoting a support line aren't Facebook's official routes. Never share a login code with anyone who contacts you, and be suspicious of anyone who says they can get an account back for you.

Frequently asked questions

What are the signs my Facebook account was hacked?

Facebook lists a changed profile picture, posts, comments or messages you didn't write, trouble logging in or a two-factor method that stops working, emails about changes you didn't make, and unfamiliar devices or locations under Where you're logged in.

What should I do first if my Facebook account was hacked?

Facebook recommends using its hacked-account recovery page, ideally from a device you've used to log in before. If you can still log in, change your password, log out unfamiliar devices and turn on two-factor authentication.

Can I recover my account if I can't reach my email or phone?

Facebook has a separate help article for that situation and says you may be able to recover the account through its hacked-account page even if you're not sure it was compromised.

Can I report a hacked Facebook account if I can't log in?

Yes. Facebook says you can report your account as compromised whether or not you can log in.

Does a changed email address mean I've been hacked?

If you didn't make the change, that's one of Facebook's warning signs. Facebook sends a link to your previous email address that lets you reverse the change and secure the account.