How to Recover a Hacked Facebook or Instagram Account in the UK

Finding out someone else has taken over your Facebook or Instagram account is a horrible moment. Your password no longer works, friends are getting strange messages from you, and posts you never wrote are appearing on your profile. Both platforms have recovery flows built for this situation, and acting quickly gives you the best chance of getting your account back.

Step 1: Check whether you are still logged in anywhere

First, check if you are still signed in on another device. Many hacks start on one device while another stays logged in. If you can still get in anywhere, change the password to something strong and unique right away. Then look at the email address and phone number on the account. If the hacker changed them, change them back to yours straight away.

If you are logged out everywhere, do not keep guessing passwords. After a few wrong tries, the account can be locked for a while, which only slows you down. Move on to the official recovery flow instead.

Step 2: Use the official hacked-account flow

Facebook has a dedicated page for this: facebook.com/hacked. It asks what happened and walks you through securing the account. Instagram has the same idea at instagram.com/hacked, or from the app by tapping "Forgot password?" on the login screen and following the help options.

Both flows will usually ask you to confirm your identity, with a code sent to your linked email or phone, or in some cases a photo ID check. The ID check can take a few days, so start it as soon as you can.

If the hacker changed the email on the account, look for the message Meta sends when an email change happens. That message often contains a link to reverse the change if it was not you. These links expire, so check your inbox, including spam, right away.

Step 3: Kick the hacker out of every session

Once you are back in, the hacker may still be logged in on their own device. Both platforms let you see where your account is signed in and end those sessions. On Facebook, go to Settings, then Security and login, then "Where you're logged in", and log out of every session you do not recognise. On Instagram, go to the Accounts Centre, then Password and security, then "Where you're logged in", and do the same.

A password change alone is not always enough, because the hacker's session can stay live. Logging out of all sessions forces everyone, including the hacker, to sign in again with the new password.

Step 4: Turn on two-factor authentication

Switch on two-factor authentication straight away. It adds a second check, usually a code from an authenticator app or a text message, whenever someone tries to log in from a new device. Even if a hacker gets your password again, they will be stopped at this step.

An authenticator app is the stronger choice where it is offered, because text messages can be intercepted in some attacks. On Facebook, you will find this under Settings, then Security and login, then "Use two-factor authentication". On Instagram, it is in the Accounts Centre under Password and security. Also turn on login alerts, so you are told whenever a new device signs in.

Step 5: Check what the hacker did while they were in

Hackers rarely just sit in an account. They often message your friends with scams, post links, or spend money through linked payment methods. Look at your recent posts, messages and friend requests for anything you did not send, and delete the posts. Check your payment settings for unfamiliar transactions, and check your bank statement too. Remove any linked apps you do not recognise under Settings, since one can be a way back in. If you manage a Facebook Page or a business account, check the people with access and remove anyone you do not know. Warn your friends not to click links or send money in reply to messages sent during the hack.

Step 6: Report it, and report the money if there is any

If the hacker took money, used your identity, or tried to scam your contacts, report it to Action Fraud at actionfraud.police.uk or by calling 0300 123 2040. You will get a crime reference number, which your bank may ask for. If any bank details were involved, call your bank straight away and ask them to watch the account.

Report the hack to Meta too, through the same hacked-account pages. If the hacker made a copy of your profile, report it as impersonation from its profile page.

Step 7: Watch out for recovery scams

Once a hack becomes known, scammers often appear offering to recover the account for a fee, usually by message or through fake support accounts. Meta will never ask you to pay for account recovery, and its real support staff will never ask for your password. Only use the official hacked-account pages and the help centre, and never hand your login details or payment details to anyone who claims they can fix it for you.

Keep the account safe from now on

A few habits will make a repeat hack far less likely. Use a strong, unique password for each account, and keep it in a password manager rather than reusing one you use elsewhere. Keep the recovery email and phone number on the account up to date, so the recovery flow can reach you. Check the "Where you're logged in" list every few months, and remove sessions you no longer use.

Frequently Asked Questions

How long does it take to recover a hacked Facebook or Instagram account?

If your recovery email or phone number is still linked, it can take minutes. If the hacker changed your contact details and you need an identity check, it can take a few days, since the check is done by hand.

Can I recover my account if the hacker changed my email address?

Yes, in many cases. Check your inbox for the message Meta sent when the email was changed, since it often includes a link to undo the change. If that link has expired, use the hacked-account flow and the identity check to prove the account is yours.

Will turning on two-factor authentication stop future hacks?

It makes them much harder. Even if someone gets your password, they still need the code from your authenticator app or your phone. It does not help if someone tricks you into handing over the code yourself, so never share it with anyone.