Facebook Trusted Contacts Recovery: What Works Now

You are locked out of Facebook, and an old guide tells you to tap "Reveal my trusted contacts" so three friends can send you codes. You cannot find the link anywhere, or the trusted contacts page in your settings has gone.

The short answer: that feature has been retired. Facebook no longer lets friends unlock your account. The routes that replaced it are facebook.com/hacked, the recovery prompts for a lost email or phone, two-factor fallbacks and identity confirmation.

This guide explains which route fits your situation, how friends and family can still help without a code, and the two scams built around the old feature.

Last checked: 5 October 2026.

#Can Facebook Trusted Contacts Still Recover Your Account?

No. Facebook's help article on choosing friends to help you log in said that "Trusted contacts is no longer supported" and that your chosen friends "will no longer be able to help you get back on Facebook if you lose access to your account". When we opened that help page today, it loaded Facebook's general Account Security page instead. If you are locked out now, go to Facebook's account recovery page or facebook.com/hacked on a phone or computer you have used to log in before, and follow the route that matches your problem. Nobody outside Meta, including AwareXone, can turn the old feature back on.

#What Trusted Contacts Was, and Why Old Guides Still Mention It

Trusted contacts was an optional setting. You picked a small group of friends in advance. If you were locked out, Facebook could send each of them a code, and you collected the codes from them to get back in.

Many blogs and videos written before the change still describe the "Reveal my trusted contacts" link, and copies of the old help text still turn up in search results. Following them sends you in circles. If the link does not appear on your recovery screen, nothing is wrong with your account or your app; the option simply no longer exists.

#Which Route Fits Your Situation Now?

Pick the row that describes you. Facebook's own account recovery page lists the same situations, and its note on the "I can't access the email or mobile number" option says it will prompt you to find a hacked account and that you should proceed even if you were not hacked.

#Route 1: facebook.com/hacked on a Familiar Device

Facebook's hacked account hub gives one instruction above all others: visit www.facebook.com/hacked on a device you have used to log into Facebook before. The familiar device is the closest thing Facebook now has to a friend vouching for you.

1. Find any phone, tablet or computer you have logged into Facebook on before, even an old phone in a drawer or a family member's laptop.
2. Open your usual browser on it and type facebook.com/hacked yourself. Do not tap a link someone sent you.
3. Follow the prompts to find your account and confirm it is yours.
4. When you are back in, change the password, check the email and phone on the account, and log out of devices you do not recognise.

If the attacker already swapped your email and phone, our guide to a Facebook account hacked with the email and phone changed covers that situation in more depth.

#Route 2: When You Cannot Reach the Email or Phone

This is the situation trusted contacts used to solve, and Facebook's lost email or phone page now handles it. Before anything else, it suggests trying other emails or numbers you may have forgotten, adding the country code to a phone number (+60 for Malaysia), and asking your email provider to restore the inbox.

If none of that works, Facebook's steps run as follows:

1. On a device you have used to log in before, type facebook.com/login/identify into your usual browser.
2. Enter any email or phone number that might be registered. If that fails, try your account name or username. A friend can open your profile and send you the username from the address bar.
3. Select "No longer have access to these?". If you do not see it, you may see "Forgot account?" or "Recover" instead.
4. Give a new email or phone number when asked. Facebook says it must not have been used on your Facebook account before.
5. Follow the prompts to confirm the account belongs to you, then reset the password.

In Malaysia, one trap is a prepaid number that expired and has since been reissued to a stranger. If that happened, do not wait for codes to reach the old number. Go straight to the "No longer have access to these?" path.

#Route 3: Two-Factor Codes You Can No Longer Receive

Trusted contacts never helped with two-factor problems, but people confuse the two. Facebook's page on two-factor security codes lists the ways you can still get in: an SMS code, a security key, an authentication app, approving the login from a device Facebook already recognises, or one of your printed recovery codes.

If none of those are available, our walkthrough of losing your Facebook code generator or two-factor app follows Facebook's fallback order step by step.

#Route 4: Confirming Your Identity With an ID

Facebook may ask you to submit a picture of your ID to confirm the account belongs to you. Its page on unlocking an account says that after a security lock you select "Get started" and follow the on-screen steps, and those steps can include confirming your identity.

Facebook's ID upload instructions ask for a close-up photo of your ID taken in a well-lit room, and warn that sending more documents than necessary may delay the review. Its page on why an ID is rejected lists blurry, badly lit, cropped, screenshotted or photocopied images, and says the ID must show your name with either your date of birth or a photo.

• Use the same name on the ID as on your Facebook profile where you can. A MyKad, passport or driving licence is a government ID.
• Photograph the original card, not a scan or a picture of a screen.
• Upload only inside the Facebook app or on facebook.com, never to someone who offers to submit it for you.

If Facebook has already turned down your ID, our guide to an identity confirmation that was rejected explains the usual reasons.

#How Friends and Family Can Still Help

Friends can no longer unlock your account, but they are still useful. Facebook's page on helping someone else recover their account recommends two things: help the person visit the account recovery page to find the right solution, and help them use the device they usually log in with.

• Ask a friend to copy your profile link or username and send it to you, so you can search for your account.
• Ask a family member to check whether their laptop or tablet still has your Facebook logged in, then run recovery on that device.
• Ask friends to warn others not to reply to messages from your account until you have it back.
• Never ask a friend to forward a code for you. That is how the scam below works.

#The "You Are My Trusted Contact" Code Scam

This scam starts with a message from a friend's real account, which has already been taken over. It reads something like: "I'm locked out and Facebook says you are one of my trusted contacts. I'll send a code to your phone, can you forward it to me?" The same request can arrive in Bahasa Malaysia ("tolong hantar kod") or Chinese.

The code that arrives is not for your friend. It is a reset or login code for your own Facebook, WhatsApp or another account, triggered by the attacker who now has your number. Forward it, and you lose your account too. Trusted contacts was retired, so a genuine request of this kind no longer exists.

If your own account is already sending messages like this, our guide to a hacked account messaging your friends covers how to stop it and what to tell people.

#Fake Recoverers Who Offer to Activate Trusted Contacts

A second scam targets people who searched for the old feature. Someone in the comments, a Telegram group or a paid advert claims they can "activate" or "reopen" trusted contacts, or that they have special access to Meta. They cannot. The feature no longer exists, and nobody outside Meta can switch it back on.

Legitimate help looks very different. It starts with a review of your case, uses only Facebook's own forms and flows, never asks for your password, OTP or backup codes, and is honest that the result is best effort and Facebook decides. Red flags to walk away from:

• A promise to get the account back, or a timeframe in hours.
• Requests for your password, a login code, recovery codes or a selfie video sent to them.
• Payment demanded up front by gift card, crypto or a transfer to a personal account.
• Claims of contacts inside Meta or a secret recovery tool.
• Pressure to act now or lose the account forever.

#If You Shared a Code or Paid Someone in Malaysia

Handle any money first. The NSRC's FAQ on the NFCC website says to contact your bank's 24-hour hotline or call 997 as soon as you notice an unauthorised transaction, then make a police report at the nearest police station within 24 hours.

1. If you forwarded a code, change the password on whichever account it belonged to and log out of other devices.
2. Tell the friend whose account messaged you, by phone, that their account has been taken.
3. Report the phishing message in Facebook and to CyberSecurity Malaysia's Cyber999 incident centre, which takes reports by online form, email, phone and its app.
4. Keep screenshots of the messages, the sender's profile link and any payment receipts for your police report.

#Set Up Recovery That Works Without Trusted Contacts

If you still have access, these settings replace what trusted contacts used to do.

• Check the email and phone number on your account in Accounts Center, and remove any you no longer control.
• Turn on two-factor authentication. Facebook's two-factor page offers a security key, an authentication app or SMS codes, and says you can also create a passkey.
• Get your recovery codes. Facebook's recovery codes page says you can get ten one-time codes under Two-factor authentication, Additional methods, Recovery codes. Print or write them down and keep them away from your phone.
• Keep one old device logged in at home. It may be the familiar device that gets you back in later.
• Secure the email inbox linked to Facebook with its own strong password and two-factor authentication.

#When a Case Review Makes Sense

Most people can work through the routes above alone, and only Facebook can restore a Facebook account. Some accounts do not come back. A second opinion helps when every route has failed, when your ID keeps being rejected, or when the account runs a business or community you depend on. SocialSafe by AwareXone, our recovery service, looks at your case first and tells you plainly whether an official route is still open; sometimes the answer is that you can finish it yourself. You can read how we approach Facebook account recovery, and our Trust Center lists what we will never ask for, starting with your password and codes.

#Frequently Asked Questions