How do I get back into a hacked Facebook or Instagram account?
The official recovery flows in the order they actually work, the changes an attacker makes to lock you out, and how to warn your contacts while you are still locked out.
- Difficulty
- intermediate
- Time
- 1 hr
- Read
- 3 min
- Safety
- caution
Short answer
Start from the platform's own account recovery page, not from any link in an email. Use the "my account was hacked" route rather than "forgot password", because it handles changed email addresses and phone numbers. Try from a device and location you have used before, and be prepared to submit identity verification. Warn your contacts from another account immediately.
Social account takeover follows a standard pattern: password reused or phished, then the email address, phone number and second factor changed within minutes so the normal reset does not reach you. The recovery process exists for exactly this, but it is buried, and the ordinary forgotten-password flow does not lead to it.
Safety
Step by step
- Go to the platform directly, not through a link.Type the address yourself. Every message offering to help you recover is worth suspecting, because takeover victims are targeted by fake support accounts within hours.
- Use the hacked-account route rather than forgot-password.The major platforms have a separate flow for compromised accounts that can work even when the email address and phone number on the account have been changed. Search their help centre for the compromised-account page.
- Try from a device and network you have used before.Recovery systems weigh device history, location and past sessions heavily. Attempting from your usual phone on your home connection materially improves the outcome.
- Check whether you are still signed in somewhere.An old tablet, a second browser, the desktop app, a linked account in a business tool. A live session is the fastest route back in, and from there you can change the password and evict everyone else.
- Be ready to verify identity.Several platforms ask for a photograph of you, or of an identity document, or a video selfie. It is slow and it is the route that works when everything else has been changed.
- Warn your contacts from somewhere else.A hijacked account is used immediately to run scams on your friends — investment offers, cash requests, and "vote for me in this competition" links that harvest their accounts too. Post from another platform or message people directly.
- Once back in, undo the attacker's changes.Password, email address, phone number, second factor, connected apps, linked business accounts and ad accounts, and any page or group where they added themselves as an administrator. Sign out of all sessions.
- Check for money.Advertising accounts attached to a business page are a common motive. Check the ad account, the payment methods on it and any spend, and tell the bank if a card was charged.
- Report it.To the platform, and to Action Fraud or Police Scotland on 101 if money was lost by you or by anyone you know as a result.
If it doesn't work
The reset code goes to an email address you do not recognise
Cause: The attacker changed the account email — Fix: Use the compromised-account recovery route rather than password reset. It is designed for this and can verify you another way.
Recovery keeps failing with no explanation
Cause: The attempt looks unfamiliar to the platform's risk system — Fix: Try again from your usual device, on your home network, with your usual browser, and without a VPN. Do not restart the process repeatedly — that makes it worse.
You get back in and are locked out again hours later
Cause: A session, connected app or added administrator was left in place — Fix: Sign out of all sessions, review connected apps and remove unknown ones, and check page and business roles for accounts you did not add.
The account is now used to message your friends asking for money
Cause: Standard monetisation of a hijacked account — Fix: Warn people through another channel now, before recovery finishes. Ask them to report the messages, which also speeds up the platform's response.
Questions people ask
Can anyone recover it for me?
Only the platform. Every advertised recovery service is either useless or a scam, and several are run by the same people who took the account.
How long does it take?
Anywhere from minutes to weeks, depending on how much was changed and how strong your device history is. Identity verification routes are the slowest and the most reliable.
How do I stop it happening again?
A unique password from a manager, an authenticator app or passkey rather than SMS, recovery codes saved on paper, and scepticism about any link asking you to sign in — the takeover almost always started with one.