The good news is that Facebook provides official account recovery tools for compromised accounts. Your friend should start with Facebook’s hacked-account recovery page and use a device and browser they have used to access the account before.
You can help them through the process, even if they cannot log in. However, your friend should enter their passwords and security codes privately rather than sharing them with you.
1. Signs Your Friend’s Facebook Account Has Been Hacked
Before starting the recovery process, make sure the account may actually be compromised. Some account problems result from forgotten passwords, temporary security checks, or Facebook restrictions. However, certain warning signs strongly suggest unauthorized access.
Common Signs of a Hacked Facebook Account
Look for these symptoms:
- Your friend can no longer log in with their usual password.
- Their profile name, email address, or phone number has changed unexpectedly.
- Friends receive strange messages, suspicious links, or requests for money.
- The account publishes posts your friend never created.
- Facebook sends a security alert about an unfamiliar login.
- Unknown devices appear in the account’s active sessions.
- Your friend receives a password-reset message they did not request.
The US Federal Trade Commission also identifies unexpected account changes and messages that the account owner did not send as common signs of a compromised account.
Important: Never assume an account is safe just because its profile picture and name look normal. A hacker may control an account without changing its public appearance.
2. What Should You Do Immediately?
When a Facebook account is hacked, acting quickly can reduce the risk of further damage.
Step 1: Contact Your Friend Through Another Channel
Call your friend, send a text message, or contact them through another trusted communication method.
Confirm that they really have lost access to their account. If someone is impersonating them, your friend may still be able to log in to their legitimate profile.
Step 2: Warn Mutual Friends
If the compromised account is sending suspicious messages, warn people who may receive them.
Ask them not to:
- Click unfamiliar links.
- Download suspicious files.
- Send money in response to unexpected requests.
- Share verification codes or passwords.
- Follow instructions to vote, claim prizes, or verify accounts through unknown websites.
Step 3: Start Official Account Recovery
Direct your friend to Facebook’s official hacked-account recovery page:
Recover a hacked Facebook account
Facebook recommends using a device your friend has previously used to log in. A familiar phone, computer, or browser may help the recovery process recognize the legitimate account owner.
Step 4: Secure the Linked Email Account
If the hacker may also have accessed your friend’s email account, secure that account immediately.
Change its password, review active sessions, and enable two-factor authentication where available. Otherwise, the attacker may use the email account to reset Facebook’s password again.
3. How to Recover a Hacked Facebook Account Step by Step
The most direct way to recover a compromised Facebook account is to use Facebook’s official recovery process.
Step 1: Open Facebook’s Hacked Account Page
Visit:
https://www.facebook.com/hacked
Use your friend’s usual device and browser whenever possible.
Avoid recovery links sent by strangers or people claiming they can restore accounts for a fee.
Step 2: Identify the Account
Follow the instructions on the recovery page. Facebook may ask for information that helps identify the account, such as an email address, phone number, or other account details.
If the account does not appear, try Facebook’s account identification page:
https://www.facebook.com/login/identify
Step 3: Follow the Security Checks
Facebook will provide recovery options based on the situation.
These may involve confirming account information, receiving a verification code, resetting the password, or completing an identity-verification step.
Follow the instructions shown on the official Facebook website.
Step 4: Create a New Password
If Facebook allows your friend to reset the password, choose a strong, unique password.
Avoid using:
- Their name or birthday.
- A password they already use elsewhere.
- Simple number sequences.
- Passwords that have appeared in previous data breaches.
A password manager can help create and store a unique password securely.
Step 5: Review Account Access
After regaining access, review the account’s security settings and active sessions. Log out unfamiliar devices and remove suspicious access where possible.
Step 6: Confirm the Account Is Secure
Check the profile, recent posts, messages, email address, phone number, and other account details.
Remove unauthorized changes and notify friends that the account is back under your friend’s control.
Facebook’s official guidance is available through its Recover a Hacked Account Help Center page.
4. What If the Hacker Changed the Facebook Password?
A password change is one of the most common reasons people lose access to compromised accounts.
If your friend can no longer sign in, follow these steps.
- Open Facebook’s hacked-account recovery page.
- Identify the account using the available information.
- Follow the recovery prompts.
- Complete the requested security verification.
- Reset the password if Facebook offers that option.
- Review the account’s security settings after logging in.
If Facebook cannot find the account using one email address or phone number, try another email address or phone number your friend previously used.
Do not keep guessing passwords repeatedly. Use the official recovery process instead.
If your friend still has access to the email address or phone number associated with the account, recovering it may be easier because Facebook may offer verification through that channel.
5. What If the Hacker Changed the Email Address or Phone Number?
Hackers sometimes change an account’s recovery information to prevent the legitimate owner from signing back in.
If this happened, your friend should act quickly.
Check the Original Email Inbox
Search the email account that was previously connected to Facebook.
Look for a genuine security notification explaining that the email address or other account information was changed.
If Facebook provides an option to reverse an unauthorized change, follow the instructions in the legitimate security email.
Be careful with links in unexpected messages. Confirm that the message is authentic before entering any information.
Use Facebook’s Recovery Process
If the old email address or phone number no longer works, visit:
https://www.facebook.com/hacked
Follow the instructions Facebook provides for compromised accounts.
You can also try:
https://www.facebook.com/login/identify
Depending on the circumstances, Facebook may offer other verification methods.
Verify the Account Owner’s Identity
Facebook may request additional information to confirm that your friend owns the account.
Provide information only through the official Facebook interface and follow the instructions presented there. Available verification options can vary by account and situation.
6. How to Recover a Facebook Account Without Email or Phone Access
Losing access to both the registered email address and phone number can make account recovery more difficult, but your friend should still try the official recovery process.
Step 1: Open the Account Recovery Page
Visit Facebook’s hacked-account page from a previously used device.
Step 2: Search for the Account
Try identifying the account using the available information, such as the profile name, username, or a previously associated contact detail.
Step 3: Look for Alternative Verification Options
If the original email address or phone number is unavailable, review the alternatives Facebook displays.
Some recovery flows may offer additional identity verification. Not every method is available to every user.
Step 4: Follow the Instructions Carefully
Complete the available security checks. If Facebook offers identity verification, submit the requested information through the official website.
Never send sensitive identification documents to strangers who claim they can recover the account.
Step 5: Secure Your Friend’s Email and Phone Accounts
If the linked email account or phone number has also been compromised, contact the relevant provider or mobile carrier to restore access.
Securing these recovery channels can help prevent the hacker from taking control again.
7. How Can You Help Your Friend Recover Their Facebook Account?
You can provide practical support without taking control of your friend’s personal information.
Help Them Find the Official Recovery Page
Send your friend the official URL:
https://www.facebook.com/hacked
Explain that they should complete the process themselves and enter any passwords or verification codes privately.
Help Them Identify Their Profile
If they cannot remember their username, you may be able to find their public profile through Facebook search or an old conversation.
The profile URL or username may help them identify the correct account.
Help Them Secure Their Devices
Encourage them to update their phone or computer, remove suspicious apps, and run an appropriate security scan if they suspect malware.
A compromised device can expose new passwords even after the Facebook account is recovered.
Report Suspicious Activity
If the account is sending scam messages or impersonating your friend, report the suspicious content or profile through Facebook’s built-in reporting options.
Never Ask for Their Password
Even if you are close friends, there is no need to know their password or one-time verification codes to guide them through recovery.
The safest approach is to explain the steps while your friend operates their own device.
8. What If the Hacker Enabled Two-Factor Authentication?
Two-factor authentication adds another layer of security by requiring an additional verification method during login.
However, a hacker who takes control of an account may try to add their own verification method, making recovery more difficult.
If your friend encounters this problem:
- Return to Facebook’s official hacked-account recovery page.
- Follow the recovery options provided for the compromised account.
- Look for an alternative verification method if one is offered.
- Complete any required identity checks.
- Secure the account’s email address and phone number.
Do not use unofficial services that promise to bypass two-factor authentication. These may steal additional information or money.
Once the account is recovered, your friend should review their security settings and configure their own two-factor authentication method.
9. How to Secure the Facebook Account After Recovery
Getting back into the account is only the first step. Your friend should also prevent the hacker from returning.
Change the Password Again if Necessary
If the password was exposed or reused elsewhere, replace it with a new, unique password.
Change the same password on other services where it was reused, especially email accounts and financial services.
Log Out Unrecognized Devices
Open Facebook’s security settings and review where the account is logged in.
End sessions your friend does not recognize. Depending on the available controls, they may be able to log out other sessions or all sessions.
Enable Two-Factor Authentication
Set up two-factor authentication using a supported method. An authenticator app or security key can provide additional protection where available.
Store recovery codes securely if Facebook provides them.
Review Contact Information
Check that the account’s email addresses and phone numbers belong to your friend.
Remove unfamiliar contact information after following the appropriate security steps.
Check Recent Activity
Review recent posts, messages, comments, profile changes, and connected apps.
Delete or correct unauthorized content where appropriate, and notify people who received suspicious messages.
Secure Other Accounts
If the hacker learned your friend’s email password or reused Facebook credentials elsewhere, those accounts may also be at risk.
Secure the email account first and change reused passwords on other important services.
10. How to Protect Friends and Family From Facebook Scams
A hacked Facebook account can become a tool for targeting other people.
Attackers often exploit trust. A message from a familiar profile may persuade someone to click a link or send money without checking whether the message is genuine.
Warn People About Suspicious Messages
Ask your friend to contact anyone who may have received scam messages.
A simple warning can help:
“My Facebook account was recently compromised. Please ignore suspicious messages or money requests sent from my account during that period. Don’t click unfamiliar links or share verification codes.”
Report the Compromised Account When Appropriate
If the attacker continues impersonating your friend or sending malicious content, use Facebook’s reporting options.
If a fake account has been created using your friend’s name and photographs, report it as impersonation rather than assuming it is the original account.
Watch for Recovery Scams
Be especially cautious of people who claim to be hackers, account-recovery experts, or Facebook employees.
Warning signs include:
- Demands for payment before recovery.
- Requests for passwords or one-time codes.
- Promises of guaranteed recovery.
- Requests to install remote-access software.
- Links to unofficial recovery websites.
Use Facebook’s official recovery process instead.
11. Common Facebook Recovery Problems and Solutions
| Problem | What to try |
|---|---|
| Password no longer works | Visit facebook.com/hacked and follow the recovery steps. |
| Account cannot be found | Try facebook.com/login/identify and check previous contact details. |
| Email address was changed | Check the original inbox for a genuine security notification and possible reversal instructions. |
| Phone number is unavailable | Use another recovery method offered by Facebook. |
| Two-factor authentication blocks login | Follow the official alternative verification process, if available. |
| Unknown posts appear | Recover access, secure the account, and review recent activity. |
| Recovery code does not arrive | Check the correct inbox or number, wait briefly, and use another available option. |
| Account is being impersonated | Report the fake profile through Facebook’s reporting tools. |
Why Is Facebook Recovery Taking So Long?
Recovery can take longer if Facebook needs to verify the account owner’s identity, if the recovery details have changed, or if additional security checks are required.
Use the official process, follow the instructions carefully, and avoid submitting repeated or conflicting information.
No third-party service can guarantee that Facebook will restore an account.
12. How Long Does Facebook Account Recovery Take?
There is no guaranteed recovery time.
Some users regain access quickly when they can verify their identity using a familiar device and existing recovery information. Others may need additional verification or may have to resolve problems with their email address or phone number first.
To avoid unnecessary delays:
- Use a previously trusted device.
- Enter accurate account information.
- Check the original email inbox for security alerts.
- Follow Facebook’s instructions carefully.
- Keep recovery information private.
- Avoid repeatedly submitting conflicting details.
If Facebook provides a status or next-step message, follow it rather than relying on a promised recovery deadline from an outside service.
13. Frequently Asked Questions
Can I recover my friend’s Facebook account for them?
You can help them find the official recovery page and understand the instructions. Your friend should complete verification and enter passwords or security codes privately.
What is the official website for recovering a hacked Facebook account?
Use https://www.facebook.com/hacked. Facebook recommends starting there on a device previously used to log in.
Can my friend recover Facebook without their old phone number?
Possibly. Facebook may offer alternative verification methods depending on the account and circumstances. Start with the official hacked-account recovery process.
What should I do if a hacker is asking my friend’s contacts for money?
Contact your friend through another channel, warn mutual friends, and tell recipients not to send money or share verification codes. Report suspicious activity through Facebook.
Should my friend pay someone to recover the account?
No. Be cautious of anyone demanding payment or promising guaranteed access. Use Facebook’s official recovery tools and never share passwords or security codes with a stranger.
Conclusion: Recover Your Friend’s Hacked Facebook Account Quickly and Safely
If your friend’s Facebook account has been hacked, the best first step is to visit Facebook’s official hacked-account recovery page from a device they have used before.
Help them identify the account, follow the recovery instructions, secure their email address, and reset their password if Facebook allows it. Once they regain access, they should remove unfamiliar sessions, check their contact information, enable two-factor authentication, and warn friends about suspicious messages.
Remember that recovering an account and securing it are two separate tasks. Take care of both to reduce the risk of another compromise.
Above all, avoid unofficial recovery services and never share passwords or verification codes. With the right precautions and Facebook’s official recovery tools, your friend can work toward regaining control of their account safely.
Summary: Key Takeaways
- Start at facebook.com/hacked.
- Use a device and browser your friend has used before.
- Check the original email inbox for security alerts about changed account details.
- Try Facebook’s account identification page if necessary.
- Secure the linked email account and other accounts with reused passwords.
- Review active sessions, contact details, and recent activity after recovery.
- Enable two-factor authentication.
- Warn mutual friends about suspicious messages and money requests.
- Avoid third-party recovery services that request payment, passwords, or verification codes.