# How to Recover a Hacked Facebook Account: First Steps > Password failing, strange posts, or a changed email? Recover the linked inbox first, then use facebook.com/hacked and secure every session before appeals. - URL: https://www.awarexone.com/research/how-to-recover-a-hacked-facebook-account-first-steps - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-11-09 - Topics: Facebook, Account recovery, Malaysia - Related service: Facebook account recovery: https://www.awarexone.com/social-media-recovery/facebook-account-recovery ## Short answer Secure the email or phone tied to Facebook, then open facebook.com/hacked and follow Meta account recovery. Log out unknown sessions, set a new password, and fix profile, Page or ad changes the attacker made. Warn friends if the account messaged them. Meta decides whether disabled accounts come back. ## Summary - A hacked Facebook profile usually means the linked email or phone is compromised too, so inbox security comes first. - facebook.com/hacked and Meta help pages walk through securing the account when login details changed. - After regaining access, remove unknown devices, change the password, and review recovery contacts. - If the attacker posted scams or changed your name, screenshot evidence before you undo changes. - Meta does not work with paid password sellers and never asks for OTP codes by message. - Nobody outside Meta can restore a disabled account for you. Your Facebook password suddenly fails, friends get loan requests from your profile, or your display name and photo changed overnight. The first hour matters because attackers often add their own recovery email before you notice. Meta's published order is email inbox first, then facebook.com/hacked, then session cleanup. This guide is the short path for a personal profile hack; our [email changed guide](https://www.awarexone.com/research/hacked-facebook-account-email-changed-what-to-do) goes deeper when login fails completely. Last checked: 9 November 2026 worldwide. ## Quick Answer Secure the inbox or phone number on the account, visit [facebook.com/hacked](https://www.facebook.com/hacked), and follow the [hacked account help](https://www.facebook.com/help/1216349518398524) prompts. After access returns, open [Security and login](https://www.facebook.com/help/203539833304205), log out unknown devices, change the password, and remove attacker edits to your name, photo, or linked Pages. If Meta disabled the profile, use the review option shown at login per [disabled account help](https://www.facebook.com/help/103873106370583). ## What Should You Do in the First Ten Minutes? 1. Try logging in. If the password fails, check whether the linked email still works. 2. If email works, search for Facebook or Meta password reset or security alerts and secure that inbox with a new password. 3. Screenshot scam posts, renamed profiles, and any messages your account sent to friends. 4. Warn close contacts on another channel not to send money to requests from your profile. 5. Do not pay anyone in DMs promising instant Facebook access. ## Signs the Account, Not Just a Post, Is Compromised *Early signals on a hacked Facebook profile* | What you see | First step | | --- | --- | | Password suddenly wrong | Secure email, then facebook.com/hacked | | Recovery email you did not add | Recover access, then Security and login | | Loan or crypto posts you did not write | Recover, delete posts, warn friends | | New admin on your Page or Business tools | Recover profile, review Page roles | | Account disabled after attacker activity | Appeal from login notice after securing email | ## Why Email Comes Before Facebook Attackers change the recovery address so password resets go to them. Meta's flows assume you can prove control of the contact on file. Fix that inbox before you chase Facebook-only shortcuts. ## Using facebook.com/hacked Safely Use the official URL in a browser you trust, not a link from a stranger. Meta's [phishing guidance](https://www.facebook.com/help/166863010078512) warns that fake login pages steal credentials. After recovery, review recent logins under Security and login and end sessions you do not recognise. ## Pages, Marketplace and Ads After a Hack A compromised personal profile can reach Pages you manage, Marketplace listings, or ad accounts. After you regain the profile, check Page roles, unpublished scam posts, and whether ads still run. Our [Business Manager hacked guide](https://www.awarexone.com/research/facebook-business-manager-hacked-malaysia) covers spend pauses when business tools were touched. ## If Meta Disabled the Account Disablement notices appear at login. Meta's help says you may be able to request review within a limited window. Explain that the violating posts happened during a takeover and attach dates from your screenshots. Meta still decides. ## Malaysia: Money Lost Through Your Profile If friends sent money to a scam message from your hijacked account, encourage them to call their bank and the National Scam Response Centre on 997 ([MyGOV](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline)). Your recovery does not reverse their transfers, but a police report helps when officers investigate. ## Recovery Scams to Reject Nobody legitimate needs your password, OTP, or two factor codes to help you sign in. Paid recovery sellers cannot bypass Meta review. Treat urgent DMs claiming to be Meta Support as phishing. ## Evidence Checklist - Dated screenshots of attacker posts and profile name changes. - Security alert emails with times. - A list of devices shown in Security and login before you log them out. - Messages the attacker sent to friends, copied with timestamps. - Page or Marketplace URLs the attacker edited. ## What If Friends Already Sent Money? Screenshot the fraudulent posts and messages immediately. Ask victims to report transfers to their banks, keep receipt numbers, and file a police report if officers accept online crime reports in your state. Post a clear warning from any account or Page you still control so the scam posts are not the last message people see. ## Messenger and Instagram Links Many Malaysian users tie Facebook to Messenger and Instagram through Meta accounts. After you secure Facebook, check whether Instagram or Messenger still show the attacker's sessions. Log out everywhere under Security and login, not only on the device you used for recovery. ## Username and Profile Photo Changes Attackers sometimes rename profiles to mimic brands or add a new username to confuse search. After recovery, revisit profile settings and username rules on Facebook Help. If a username is locked, our [username changed guide](https://www.awarexone.com/research/hacker-changed-facebook-username-recovery-order) covers order of operations. ## Two Factor and Login Alerts Turn on two factor authentication with an authenticator app where possible. Review login alerts by email so the next unfamiliar sign in pings you early. Remove apps and websites connected to Facebook that you do not recognise. ## When Appeals Take Time Disablement reviews can take days. Save every confirmation screen from facebook.com/hacked and any appeal reference numbers. Do not create a replacement personal profile to bypass disablement; Meta may treat that as ban evasion. ## Downloading Your Information Before Appeals Meta lets many users download a copy of profile data while logged in. That export helps you prove prior posts and friend lists if an appeal asks what changed. Start the download early because large archives take time to prepare. Store the export on your computer or cloud storage outside Facebook. If the account is disabled again, you still have timestamps for police or bank enquiries. ## When a Case Review Makes Sense Most hacks clear through facebook.com/hacked when email access returns. SocialSafe by AwareXone reviews cases when email and Facebook recovery conflict, Business Manager and profile were both hit, or disablement appeals need a coherent timeline. We use official Meta routes only. See [Facebook account recovery](https://www.awarexone.com/social-media-recovery/facebook-account-recovery) and [Trust Center](https://www.awarexone.com/trust). ### Can I recover without my phone? Often yes if you still control the recovery email Meta shows in the flow. Use forgot password from a familiar browser. ### Should I delete the account? Usually recover first so you keep friend connections and Page links. Deleting is harder to undo. ### Will Facebook remove scam posts automatically? You should delete attacker posts after access returns. Meta may still review disablement separately. ### Can AwareXone log in for me? No. We never ask for passwords or codes. We help organise evidence and official appeals. ### What if the hacker enabled two factor on their device? Use account recovery options and remove unknown second factors in Security and login once you are in. ### Should I warn Facebook friends by mass message? Post one clear warning on your timeline after cleanup, or use another network, so you do not trigger spam filters while your account is fragile. ## Official sources - [Meta: Hacked accounts (read 9 November 2026)](https://www.facebook.com/hacked) - [Facebook Help: Recover a hacked account (read 9 November 2026)](https://www.facebook.com/help/1216349518398524) - [Facebook Help: Security and login (read 9 November 2026)](https://www.facebook.com/help/203539833304205) - [Facebook Help: Phishing (read 9 November 2026)](https://www.facebook.com/help/166863010078512) - [Facebook Help: Suspended or disabled (read 9 November 2026)](https://www.facebook.com/help/103873106370583) --- AwareXone is an independent provider serving clients worldwide, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.