The short version: go to facebook.com/hacked from a device you've used to log in before, follow the identity verification steps (this often means a video selfie now, not just a photo ID), and expect it to take anywhere from a few hours to several weeks depending on whether the hacker changed your email and phone number. If they did change your contact details, your odds drop sharply, and no amount of angry emailing to Meta will speed that up because there is no human on the other end reading them.
I've walked three clients through this in the last two years, and helped myself once, back when someone got into an old account I'd half forgotten I still used for a Facebook group. None of it felt as simple as the help articles make out. So here's what happens, step by step, plus the bit most guides skip.
What to do in the first 10 minutes
Speed matters more than most people think, because hackers who get into a Facebook account usually do three things fast: change the password, change the recovery email or phone number, and turn on their own two-factor authentication so you get locked out of your own account. Once all three are done, you're fighting uphill.
- Try logging in normally first. If your password still works, change it immediately, then go to Settings and Privacy > Security and Login and click "Log out of all sessions."
- If your password doesn't work, do not keep guessing. Go straight to facebook.com/hacked. Guessing wrong repeatedly can trigger extra security holds that add days to the process.
- Check your email inbox (including spam) for anything from Facebook confirming a password or email change. This tells you how much time you've lost.
- Warn people close to you, especially anyone in your friends list who runs a business or handles money conversations over Messenger, because hacked accounts are frequently used within the hour to send fake "I'm stuck, can you send me money" messages or phishing links dressed up as videos.
The Facebook recovery process, step by step
Facebook's official recovery flow at facebook.com/hacked is the fastest route, faster than reporting through the app menus, faster than the help centre search bar. Here's what it looks like in practice:
- Enter your email, phone number, username or profile name. Use whatever detail is still linked to the account, even if you can't access it anymore.
- Confirm it's your account. Facebook shows you a masked version of the recovery email or phone on file. If the hacker changed it, you'll see a contact method you don't recognise, that alone tells you what happened.
- Request a login code. If you still control the original email or phone, this is the quickest path back in. If you don't, click "No longer have access to these?"
- Verify your identity. Since 2023, Facebook has leaned heavily on video selfie verification instead of uploading a photo ID. You record a short video, their system checks it against profile photos on file. It's uncomfortable and it's also the step that gets accounts back the fastest, so don't skip it out of squeamishness.
- Wait. Meta says most identity checks are reviewed within 24 to 48 hours. In my experience with clients, straightforward cases (password changed, contact details untouched) do resolve in that window. Cases where the hacker changed the email and phone number took between 9 days and 6 weeks across the three clients I've helped.
When the hacker changed your email and phone number
This is the version that hurts. One client, a wedding photographer with 4,200 followers built up over six years, had her business page's linked personal profile hacked in March last year. The hacker changed the recovery email, turned on their own two-step verification, and started using her Messenger to send crypto-adjacent investment links to her contacts (we're not covering that topic here for good reason, but it's exactly the kind of thing hacked accounts get used for).
Because the recovery email and phone were both gone, the standard "get a code sent to you" option was useless. She had to go through the identity verification route with a video selfie and a written explanation of the account's history (roughly when it was created, what name it was under previously, which pages she managed from it). It took 23 days. During that time the page kept posting spam, and she lost around 300 followers who understandably assumed the whole account had been sold or abandoned. If you're managing chats or automations through Messenger for a business, it's worth reading up on how Messenger security works and how to lock your chats down before this happens to you, not after.
If this is your situation, a few extra things help:
- Fill in every field of the identity verification form, even the optional ones. Vague submissions get bounced back for more information, which restarts the clock.
- If you have any old emails from Facebook (welcome emails, ad receipts, page confirmation emails) forward them into the case, they help prove account history.
- Ask a friend who's still in your friends list to report the account as "hacked" too. Multiple reports on the same profile do sometimes get it flagged for faster manual review, though Meta has never confirmed this officially and I'd hold that as a "seems to help" rather than a guarantee.
Recovering a hacked business Page versus a personal profile
These are handled differently and people mix them up constantly. A Facebook Page is owned by whichever personal profiles have Admin access to it, not by the business itself. If your business's admin profile gets hacked and the hacker removes you as an admin from the Page, you can't fix the Page directly, you have to fix the underlying profile first, then go back into the Page settings once you're back in.
For Pages specifically with no admin access left at all, there's a separate form: search "claim ownership of a Page" in the Meta Business Help Centre, and be ready to prove ownership through a business email domain match, a verified website, or an ad account linked to the Page. If your Page runs ads, this is faster, because Meta's ad fraud team gets involved when money is on the line in a way they simply don't for a personal profile with no ad spend attached.
Why the process feels slower than it should
Here's the part most articles on this topic gloss over: for the vast majority of individual users, there is no support team reading your case personally. Facebook has roughly 3 billion monthly users and, by most estimates, a support and trust and safety workforce in the low tens of thousands globally, split across every product Meta owns. Automated systems handle almost all of the initial triage. A human only looks at your case if the automated flow escalates it, and it escalates far more readily for accounts tied to ad spend, verified business Pages, or public figures.
This isn't Meta being lazy, it's a math problem. There's no version of "email a real person and they'll sort it" at that scale. So when a guide tells you to "contact Facebook support directly," that's not wrong, but it's misleading, because for most personal accounts the recovery form and the identity verification flow ARE the support. There isn't a second, better channel hiding behind it. Knowing that saves you the wasted week of hunting for a magic email address that doesn't exist.
Locking the account down once you're back in
Getting back in is only half the job. I've seen accounts get hacked twice within a month because the person didn't close the gap the hacker used the first time.
- Turn on two-factor authentication using an authenticator app (Google Authenticator, Authy) rather than SMS. SMS codes can be intercepted through SIM-swap scams, which are more common than people assume.
- Go to Settings and Privacy > Security and Login > Where You're Logged In and remove any device or location you don't recognise.
- Set up between three and five Trusted Contacts, friends who can vouch for you if you get locked out again. Most people skip this step entirely and then wish they hadn't.
- Change the password on any other account that shared the same password. Hackers who get into one account almost always try the same login on Gmail, Instagram, and banking apps within hours.
- Review connected apps under Settings > Apps and Websites. Old quiz apps and games from years back are a common entry point and most people never revoke access.
What this costs a business, even after you get the account back
The recovery form is free. The damage isn't. Every client I've supported through this lost something beyond the account itself: follower trust, a week or more of missed customer messages, sometimes ad account suspensions triggered by the hacker running unauthorised campaigns on a linked payment method. One small ecommerce client had £340 of ad spend run through her account by the hacker before Meta's fraud detection caught it, and she only got that refunded after a dispute that took another five weeks on top of the account recovery itself.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
This ties into something worth sitting with: a Facebook account, personal or business, is rented land. You don't own the audience, Meta does, and the platform can (and does) go wrong in ways entirely outside your control, hacking being just one of them. It's the same lesson buried in a lot of the bigger public blowups covered in this rundown of major social media fails, brands and individuals repeatedly learning the hard way that a platform account is never truly theirs to protect. If your business leans entirely on a Facebook presence with no email list, no website, nothing you control, a hack like this is a preview of what happens if Meta simply decides to shut the account down for a policy breach you didn't even know you'd triggered.
I have written more around this on the site: How to hack Messenger and secure your Chats, The biggest social media fails of 2017.
Frequently asked questions
How long does it take to recover a hacked Facebook account?
If your recovery email or phone number is still intact, often 24 to 48 hours through facebook.com/hacked. If the hacker changed your contact details, expect anywhere from 9 days to 6 weeks, based on real cases I've handled, since it requires manual identity verification rather than an automated code sent to a device you control.
Can I recover a hacked Facebook account without ID?
Yes, Facebook now relies mainly on video selfie verification rather than uploading a photo ID for most recovery cases. You record a short video and their system matches it against your profile photos. Providing an ID as backup can still speed things up if the video match is inconclusive.
What do I do if my hacked account is also my business Page's admin?
Recover the personal profile first through facebook.com/hacked, then reinstate your admin access on the Page from Page Settings once you're back in. If the hacker removed all admins from the Page entirely, use Meta's separate "claim ownership of a Page" process, which requires proof like a matching business domain or a linked ad account.
Should I create a new Facebook account instead of recovering the old one?
Only as a last resort. A new account starts with zero followers, zero history, and no proof of who you are to your existing network, so anyone the hacker messaged has no easy way to tell your new account is really you. Exhaust the recovery form and identity verification route first, most accounts are recoverable given enough time.
Related reading: Wix vs WordPress for a Small Business Website: An Honest Answer After Using Both and IT Virtual Assistant: What They Do, What They Cost, and Whether You Need One.
Want the complete version? Read where I break down social media marketing.
