Facebook Account
Recovery
Most Facebook recoveries succeed — if you take the right steps in the right order before the attacker locks down the recovery channels. If self-service has already failed, specialist escalation can still get you back in.
Three scenarios — different paths
Recovery looks different depending on what happened. (1) You forgot your password but the account is otherwise intact — the standard reset flow works in minutes. (2) You were hacked but Facebook has not yet locked the account — you have a narrow window to reset before the attacker changes the recovery email and phone. (3) You were hacked AND the recovery channels have already been changed — automated recovery will fail, and you need the identity-verification escalation path.
The wrong step at the wrong time burns recovery options. The most common mistake is repeatedly hitting "Forgot password" after the email has already been changed — every failed attempt confirms to the attacker that you noticed.
How to tell which scenario you are in
- You can log in but cannot do certain actions → likely a temporary restriction, not a compromise
- You cannot log in but the reset email arrives → recovery email is still yours, standard flow will work
- You cannot log in AND the reset email never arrives → recovery email was changed; escalation required
- You receive a "your email was changed" or "new login from [location]" notification → compromise in progress, act in the next 30 minutes
- Friends report posts or messages from your account that you did not write → confirmed takeover
- Your account simply "does not exist" when you search for it → either disabled by Facebook or hidden by the attacker; both have specific recovery paths
Recovery, in order
Try the standard flow first — but only once
Go to facebook.com/login/identify and follow the prompts. If a reset link arrives at the email on file, you are in scenario 1 or 2. If not, stop — do not keep retrying. Move to step 4.
If you got in, harden immediately
Change the password, log out every other session (Settings → Security and login → Where you're logged in → Log out of all sessions), turn on authenticator-app 2FA (not SMS), check that the recovery email and phone are still yours, review installed apps and remove anything you do not recognize.
Check connected accounts
Many Facebook takeovers are used to pivot into Instagram (linked via Accounts Center), ad accounts, and any third-party site you log into "via Facebook." Reset everything connected the same day.
When standard recovery fails — escalate via identity verification
Use facebook.com/hacked. The flow asks for a government ID and biometric video selfie. Submit clearly, with the name and DOB matching the account. This bypasses the recovery email — but takes 24-72 hours and is sometimes rejected silently.
When self-service stalls
The identity-verification path works for many users — but for accounts tied to a business, an ad account, or a creator profile, it often returns "we couldn't verify your identity" without explaining why. That is when escalated recovery is needed.
911Cyber's social-media response team has a documented path for stalled cases: re-filing through the correct trust channels, providing the additional evidence Meta's reviewers actually use, and (where appropriate) coordinating through partner programs. We do not promise success on every case, but we know what works and what does not.
We also clean up after the fact — locking the recovered account so the same vector cannot be reused, separating it from a compromised email, and rebuilding 2FA on a trusted device.
Frequently asked questions
How long does Facebook recovery actually take?
Standard password reset: minutes. Identity-verification escalation: 24-72 hours, sometimes longer. Escalated cases with specialist help: typically 1-3 days once the right path is opened, though Meta sets the pace.
Should I create a new account while I try to recover?
No. A second account complicates the identity-verification process and risks both being flagged. Disable any duplicate you may have made.
What if the attacker is posting from my account?
Notify your contacts directly (via SMS, other platforms) that the account is compromised, especially if scam DMs are being sent to friends. Report the account from another device while continuing recovery. Posts during the takeover are not your liability — but the longer they stand, the more damage they do.
Does paying a "recovery service" on Instagram or TikTok work?
No — those are themselves scams. Anyone with the actual ability to escalate a Meta recovery does not advertise via comment spam. If you cannot reach Meta's legitimate channels, talk to a real firm.
My account had Meta Verified — does that help?
Yes. Meta Verified subscribers have a direct support channel that bypasses the self-service queue. Use it first. If it stalls, the escalation paths above still apply.
Related response services
Social Media Account Hacked
We recover compromised Instagram, Facebook, X, and other social accounts and lock out the attacker for good.
Facebook Business Suite Recovery
We restore admin access to hacked business pages and ad accounts.
Email Account Hacked
We recover hacked Gmail, Outlook, and business email accounts and close every backdoor the attacker left behind.
Instagram Account Hijack
We eject intruders and fully recover compromised profiles.
Stalled in identity verification?
Most cases that reach us have already cycled through facebook.com/hacked. The next step is escalation through the right channel — start with a free triage call.