Quick answer
You can regain access to a hacked account fastest through the password recovery option on the platform itself, but if the email linked to the account is under your control, secure it first and check your phone for recovery. If the attacker changed that information, file an abuse report and notify your contacts via another platform. After regaining access, be sure to enable two-factor authentication and change your password.
How to recognize the problem
- Login fails even though you are sure the password is correct
- Friends receive messages or calls in your name that you did not send
- Posts, fake ads, or pages you did not create appear on your profile
- The recovery email or phone number was changed without your knowledge
- You receive a notification about a login from an unknown device or location
Most common causes
Stolen password
The attacker obtained the password through a phishing page, data breach, or a reused password you use on multiple sites.
Login without two-factor authentication
If you do not have two-factor authentication enabled, it is enough for someone to learn your password and sign in from their device.
Malicious app
A third-party app you granted access to your account can post content or change data on your behalf.
Compromised email
If the email linked to your profile is taken over, the attacker uses it to change the password and recovery information on the social network.
Step-by-step fix
- 1
Secure your email, then try platform recovery
If the email linked to your profile is still under your control, first change the email password and enable two-factor authentication. Then on the login page select an option such as
Forgot passwordand enter your email, phone, or username. Follow the instructions sent to your email or phone. If the platform offers verification through friends, use it only if those contacts are verified. - 2
Check if the attacker changed your information
If the recovery message does not arrive, the attacker may have changed the email or phone number. In that case, look for the compromised account report form on the help page and fill it out as precisely as possible.
- 3
Change your email password
If you did not do this in the first step, change your email password and enable two-factor authentication. Also check that the attacker did not set up email forwarding rules or additional recovery methods, so they cannot take over the profile again through email.
- 4
Notify contacts via another platform
Send a short message to friends and colleagues via another channel, such as phone or another network. State that the profile has been taken over and that they should not open links or send money based on messages from that profile.
- 5
Report abuse and fake content
From the profile or the platform's help center, report posts, messages, and ads that are not yours. If the attacker created a fake profile with your information, report it as an impersonation or fake account.
- 6
Change your password and remove connected apps and devices
Once you regain access, immediately change the profile password. Then in the account settings, open the security and logged-in devices section, log out of all sessions you do not recognize, and remove third-party apps you do not trust.
- 7
Enable two-factor authentication
In the profile's security settings, enable 2FA, preferably via an authenticator app rather than SMS only. Save backup codes in a safe place, separate from your phone.
- 8
Review privacy and recovery settings
Review who can see your posts and which recovery methods are listed. Remove old and inactive recovery methods and check that all information is correct.
If nothing works: reporting and legal steps
When the platform rejects your request or does not respond, try again through the official compromised account form and attach proof that the account is yours, such as older posts or messages. Wait a few days for a response and do not pay anyone who promises a quick account recovery. If fraud was committed through the profile or offensive content was posted, save screenshots and report the case to the police. For business profiles, notify the page administrator and, if available, the platform's support team. Always check whether the attacker also accessed the linked email, as that is the most common way control over the profile is regained.
How to prevent it
- Use a unique password for each account and store them in a password manager
- Enable two-factor authentication via an app, not just SMS
- Do not enter your password on pages you reached via a link in a message
- Regularly review active sessions and apps connected to your profile
When to call a professional
Contact IT support if the profile is linked to a business email, if the attacker changed the recovery information, or if the platform does not respond to reports. Professional help is also useful when you need to check whether the computer or email through which the account was taken over has been compromised.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
How long does it take to recover access to a hacked profile?
If the recovery email and phone are still yours, access is usually restored within a few minutes to a few hours. When the attacker has changed that information, the reporting process can take several days.
Should I delete the profile and create a new one?
Deletion is a last resort, as you lose history, contacts, and any business pages. If the platform offers a data archive download, download it before deleting. First try recovery and abuse reporting, and consider deletion only if the platform cannot restore the account.
What if the attacker asked my friends for money?
Notify your contacts that the messages are not from you and advise them not to send money. Save screenshots of the messages and report the case to the platform, and if someone paid, report it to the police as well.