Is there anything you can do if your Facebook account has been hacked?

Having your Facebook account hacked can be a very frustrating and scary experience. Your account contains personal information, photos, conversations with friends and family, and more. A hacked account can lead to identity theft, cyberbullying, and other issues. Fortunately, there are steps you can take to try to regain control of your account and protect yourself.

How to Know if Your Facebook Account is Hacked

Here are some signs that your Facebook account may have been compromised:

You can’t log in to your account. When you attempt to log in, you may receive an error message or be redirected to a strange login page.

Your password suddenly stops working. Even after you reset it, your regular password is rejected.
You notice posts or messages you didn’t write. These may include spam links, offensive content, or messages sent to your friends.
Your profile information like your name, birthday, or profile photo changes.

Your friends report getting strange messages or friend requests from your account.
You notice new friends you don’t recognize or pages you haven’t liked.

If you notice any of these signs, there’s a good chance your account has been hacked. Act quickly to start securing your account.

Step 1: Log Out of All Active Sessions

If you can still access your account, the first step is to log out of all active sessions:

Click on the triangle icon in the top right and select “Settings”.
On the Settings page, click “Security and Login” on the left side.

Under “Where You’re Logged In”, click “See All”.
A page will open showing all active sessions. Click “Log Out” next to each one.
If any look suspicious or unfamiliar, make sure to log out of those sessions first.

Logging out of all sessions will kick the hacker out of your account on any device they’re using to access it. This is an important first step to regain control.

Step 2: Change Your Password

Next, you need to change your password. This prevents the hacker from getting back into your account even if they discovered your old password.

From the Settings page, click “Security and Login”.

Next to the password section, click “Edit”.
Enter a new, strong password that the hacker couldn’t guess. Avoid personal information, common words, or predictable patterns.
Click “Save Changes” to update your password.

A good password is at least 12 characters long, uses upper and lowercase letters, numbers, and symbols. You may want to consider using a password manager to generate and store more secure passwords.

Step 3: Turn on Login Approvals

For extra security, you can turn on login approvals under the Security settings:

Click “Use two-factor authentication” and choose an option.

Text message codes will be sent to your phone when someone tries to login.
You can also use a third party authentication app like Google Authenticator.
Enter the code during login to prove it’s really you.

With login approvals enabled, the hacker won’t be able to access your account again even if they have your new password.

Step 4: Check Login Activity

On the Security and Login page, you can also view recent account activity:

This shows details like login location and browser for each session.

Check for any logins you don’t recognize.
Click the three dots next to a suspicious login and select “Not You?”.
Facebook will log that session out and alert you of any future sign-ins from that device or location.

Regularly checking login activity helps you monitor your account and catch unauthorized access attempts.

Step 5: Recover Your Account

If the hacker changed your password and you can no longer access your account, use Facebook’s account recovery options:

Go to Facebook.com and click “Forgot Password?”

Enter your email or phone number and click “Search”.
Follow the on-screen instructions to reset your password.
If you no longer have access to that email or phone number, click “I don’t have access to these” and follow prompts.

You may need to provide proof of identity like an ID to recover your account. The review process can take up to 24 hours. This allows you to regain access even if the hacker changed critical account information.

Step 6: Remove Suspicious Friends or Pages

Once back in your account, check your friends list and page likes for anything suspicious:

Look for friends you don’t know or remember adding.

Check pages for unusual interests, companies, or groups.
Go through your photos and posts for signs of suspicious activity.

Delete any suspicious friends, pages, photos, or posts the hacker may have added. This helps clean up your account after the hack.

Step 7: Run a Virus Scan

If your account was hacked, your computer or device may have malware on it:

Malware like keyloggers or spyware could have captured your login info.
Run a thorough virus scan using reputable antivirus software.

Quarantine or delete anything suspicious found in the scan.
Update your operating system, browsers, and software after to patch vulnerabilities.

Removing malware prevents continued access to your computer and sensitive accounts.

Step 8: Change Passwords on Other Accounts

To be safe, you should also change your password on any other accounts that use the same or similar password as your Facebook account:

Email, online banking, shopping sites, and social media.
Any account with personal info or financial data.

Use unique, strong passwords for each account.

This prevents the hacker from accessing other accounts if they did uncover a reused password.

Step 9: Enable Login Alerts

You can set up alerts to notify you of certain account activity:

Go to Facebook Settings > Security and Login.
Under “Get alerts about unrecognized logins”, choose options like text, email, Facebook Messenger.
You’ll be notified if your account is accessed from a new device or browser.

Step 10: Report Suspicious Activity to Facebook

If you see signs of continued unusual account activity, report it to Facebook:

Go to Facebook Settings > Security and Login.

Under “Report Suspicious Account Activity”, click “Report”.
Select issues you’ve noticed like login alerts or unusual posts.
Facebook security staff will review your account and investigate.

Facebook may be able to take further action like blocking the hacker’s IP address or device identifier.

Protect Your Account Going Forward

Here are some tips to enhance Facebook account security in the future:

Don’t click suspicious links or download software from unknown sources.

Be wary of public WiFi networks when accessing sensitive accounts.
Don’t access Facebook from unfamiliar devices or use automatic login.
Set strong antimalware and firewall protections on devices.

Limit app permissions and regularly prune Friend requests.
Turn on login approvals and watch for login alerts.

Continuously monitoring your account and practicing good security habits will help prevent future compromise.

Recover Hacked Accounts Faster with Facebook Protect

Facebook Protect is an added layer of security for high-risk accounts like politicians, journalists, and human rights defenders who are frequent targets of malicious hackers. Features of Facebook Protect include:

Required two-factor authentication to prevent unauthorized access
Monitoring for potential hacking threats

Expedited account recovery if hacked
Direct access to Facebook security experts for support

Facebook Protect provides enhanced security tailored to accounts that face more sophisticated and persistent hacking threats. Eligible users can enroll for this added protection.

Conclusion

Having your Facebook account hacked can be stressful, but there are steps you can take to re-secure it. Log out of sessions, change your password, enable two-factor authentication, and watch for suspicious activity. Report hacking attempts to Facebook and continuously monitor your account. Enabling security tools like login alerts and Facebook Protect can also add protection against future threats. Stay vigilant, and take action quickly if you notice any signs of unauthorized access. With proper precautions, you can make it much harder for hackers to compromise your account.