Imagine someone has been annoying and persistent enough to hack your Facebook account. In some cases, the attacker simply "takes a look" at your profile without causing too much damage, while in others they modify every conceivable aspect. This article will help you visualize what you should do if your Facebook account is hacked, and the measures to take to improve its security.
Can you still log in? Change your password, NOW
First and foremost: If you don't have a private and strong password, then you're not controlling your Facebook account, period. Maybe the attacker entered your profile to do something "simple" like leave a message or change your profile picture, and if so, say you've been very lucky.
You need to change your password (again, we recommend incorporating a password manager into your digital life), enable two-step authentication(you can use a compatible app or receive codes via SMS), enable login alerts, and close all open sessions. Pay attention to their entries and unknown devices: It's possible that your attacker's login appears there.
The "Protect your account" option in the section for closing open sessions is especially useful, as it will help you detect the most recent modifications and posts. We also suggest updating/verifying secondary data that could help with account recovery (name, date, place of study, etc.), and setting up three trusted contacts.
No login? Try to recover your password
Does the login tell you the password is incorrect? If so, you'll have to start the recovery ritual. There are several routes for this process to succeed, and the most common is to click on the famous "Forgot your password?" on the main page.
Facebook will ask you to enter the mobile number or email address associated with the account, and depending on its characteristics, it will offer you the possibility to log in with its original credentials (for example, log in to Google if the email is Gmail), or receive a code by email.
Personally, I recommend the second alternative unless the email address has also been compromised (unfortunately, many people use the same password across multiple services). At the same time, all this should be done on a trusted network, not on a public connection. If you can't access the email account, click on "No longer have access?" and from there, Facebook will tell you how to proceed.
Most commonly, Facebook will recommend that you try to log in again even with an old password, but another click on "I can't access my email address" opens a new range of options. If you've set up trusted contacts, Facebook will activate the process to recover the account that way, based on three codes (each contact must visit facebook.com/recover, and will give you a different one, but you need three). Otherwise, it will likely ask for new credentials (either email or phone), and additional information about your profile.
Report the account as hacked
We slowly begin to escalate the problem (so to speak), and the next step is to report more directly that someone hacked our Facebook account. The exact link is facebook.com/hacked, and with a click on the button "My account is at risk", you'll start the process.
If Facebook manages to detect data about your account, it will ask you to confirm if the profile is correct, and at least enter a previous password to continue. The alternative is (again) to enter an email or phone number. This section isn't much different from the previous ones.
And if none of that works?
If your Facebook account is hacked, you can't complete the standard recovery process, you can't access the associated email to receive codes, you don't have trusted contacts configured, you can't offer alternative credentials, and you don't remember old passwords, you only have one option: Verify your identity with Facebook, and cross your fingers.
The social network has a complete help section that explains the requirements. The text describes the official and unofficial documents that Facebook considers "valid", ranging from conventional ID cards to birth certificates, marriage certificates, visas and/or passports. The requirements for unofficial documents are even higher: There must be two, and one of them must have your photo or date of birth.
The second step is to write to security@facebookmail.com (yes, that address is real) and explain your situation, mentioning that you already sent the documentation to verify your identity. Don't resend it by email to that address. And the rest is waiting. Facebook can take several weeks to verify data, and a certain pandemic is making things complicated.
Another important detail that many users seem to have confirmed: If you don't use your real name on your Facebook profile, the chances of recovery are almost nonexistent.
In summary: What to do if your Facebook account is hacked?
Honestly... try to prevent that from happening in the first place. It's an annoying answer, I know... but prevention is your best ally. Look at everything that awaits you if your Facebook account gets hacked and you don't manage to secure your profile properly. In most cases, the standard recovery process will suffice, however, you'll have to share a lot of personal information in more advanced steps, or bother close contacts with codes and confirmations. Good luck. You'll need it.
