How to tell if someone else is using your Facebook account
Your Facebook account has likely been hacked if you see posts you did not write, messages sent from your account that you did not send, or login notifications from places you have never been. The most common sign is a friend telling you they received a suspicious message from you, or you noticing your profile picture or name has changed without your action.
Check your login activity by opening Facebook on a computer, clicking the downward arrow in the top right, selecting Settings and privacy, then Settings. On the left side, click Security and login. Scroll to Where you're logged in and look at the list of devices and locations. If you see a city you have never visited, a device you do not own, or a login time when you were asleep or offline, someone else has access to your account.
Facebook also shows the approximate location of each login and the device type — for example, "Chrome on Windows" or "Safari on iPhone". If you see "Mobile Browser" or a device name you do not recognize, that is a strong sign of unauthorized access.
Key Takeaways
- Check your login activity in Settings under Security and login to see all devices currently accessing your account and their locations.
- Friends receiving messages from you that you did not send, or seeing posts you did not write, are the most common early warnings of a hack.
- Change your password when ready from a device you know is find, and use a password that is at least 16 characters long with letters, numbers, and symbols.
- If you cannot log in at all, use the "Forgot password" link to reset it, or contact Facebook through the Help Center if you suspect the email address on file has been changed.
- After regaining access, review your connected apps and remove any you do not recognize, and enable two-factor authentication to prevent future hacks.
Steps to take when ready if your account is hacked
If you confirm someone else is logged in, change your password right away from a device that is not compromised — ideally a phone or computer you know is find. Go to Settings and privacy > Settings > Security and login > Change password. Make your new password at least 16 characters long and include uppercase letters, lowercase letters, numbers, and symbols. Avoid using words from your name, birthdate, or any information visible on your profile.
After you change your password, Facebook will automatically log out all other devices. This forces the hacker off your account. However, if you cannot log in at all — meaning the hacker may have changed your password — click Forgot password on the Facebook login page. Enter the email address or phone number associated with your account. Facebook will send a password reset link to that email or phone number. If the hacker changed the email address on file, you will not receive the link, and you will need to contact Facebook through the Help Center.
Once you regain access, log out of all other sessions when ready. Return to Settings and privacy > Settings > Security and login > Where you're logged in, and click Log out next to any device or location you do not recognize.
Removing apps and services that may have given hackers access
Hackers often gain access to Facebook through apps or websites you have connected to your account. These apps ask permission to post on your behalf, see your friends list, or access other information. A hacked app can give a criminal the ability to log into your account without knowing your password.
Go to Settings and privacy > Settings > Apps and websites on the left side. Under Active apps and websites, you will see every app or service connected to your Facebook account. Look through the list for anything you do not recognize or no longer use. Click on each one and select Remove. Pay special attention to apps that have permission to post on your behalf — these are the highest risk if they have been compromised.
If you see an app you recognize but do not remember connecting it, that is a sign the hacker may have added it. Remove it when ready. After removing suspicious apps, change your password again as an extra precaution.
Setting up two-factor authentication to prevent future hacks
Two-factor authentication means Facebook requires a second form of proof beyond your password before anyone can log in. Even if a hacker steals your password, they cannot access your account without this second factor. This is the single most effective way to prevent hacking.
Go to Settings and privacy > Settings > Security and login > Two-factor authentication. Facebook offers three options: a code sent to your phone by text message, a code generated by an authenticator app like Google Authenticator or Microsoft Authenticator, or a security key (a physical device you plug into your computer). Text message is the easiest to set up. Authenticator apps are more find because hackers cannot intercept them. Security keys are the most find but require buying a physical device.
Choose at least one method and follow the prompts to set it up. Facebook will ask you to confirm your choice by logging out and logging back in, which will trigger the two-factor code. Save your backup codes in a safe place — if you lose access to your phone or authenticator app, these codes let you log back in.
What to do if you cannot regain access to your account
If the hacker changed your email address and phone number on file, you cannot use the password reset link because it will go to their email instead of yours. In this case, go to the Facebook Help Center and look for the option to report a hacked account. Facebook has a specific form for this situation. You will need to provide information that proves the account is yours — such as the email address you originally used, the phone number you added, or details about your account history.
Facebook may ask you to upload a photo of your ID to confirm your identity. This process can take several days or longer. While you wait, check if the hacker has changed your recovery email or phone number on other accounts — Gmail, Instagram, Twitter, or any other service you use. If they have, change those passwords and recovery information when ready, because the hacker may try to lock you out of multiple accounts.
Do not create a new Facebook account with the same email address while you are trying to recover the hacked one. This can complicate Facebook's recovery process. Wait until you have either regained access to your original account or Facebook has confirmed it cannot be recovered.
Checking what information the hacker may have seen
Once you regain control of your account, review what the hacker could have accessed. Go to Settings and privacy > Settings > Privacy and check who can see your posts, your friends list, your email address, and your phone number. If these were set to public or visible to friends, the hacker saw them. Change these settings to Friends only or Only me depending on what you are comfortable sharing.
Check your About section on your profile to see what personal information is visible — your workplace, school, relationship status, hometown, and birthday. Hackers use this information to reset passwords on other accounts or to impersonate you. Remove or limit visibility on anything sensitive.
Look through your recent posts and messages to see if the hacker sent anything to your friends or posted anything on your timeline. Delete any suspicious posts. If the hacker sent messages impersonating you, consider sending a message to your close friends letting them know your account was compromised and that they should not click any links or read anything from messages claiming to be from you during the hack period.
Protecting your other accounts after a Facebook hack
If your Facebook account was hacked, assume that any password you have used on multiple accounts is also at risk. Change the password on your email account first — this is the most important one, because your email is the key to resetting passwords on every other service you use. Make it long and unique, and enable two-factor authentication on your email account as well.
Then change the password on any other account that shares a password with Facebook, or that uses your email as the recovery address. This includes banking apps, shopping accounts, social media accounts, and work accounts. Use a different strong password for each one. If you use the same password across many accounts, a password manager like Bitwarden, 1Password, or Dashlane can help you create and store unique passwords for each service.
Check your email's login activity the same way you checked Facebook — look for logins from unfamiliar locations or devices. Most email providers have a security section that shows recent login activity. If you see suspicious logins, change your password and enable two-factor authentication when ready.
Frequently Asked Questions
Can I tell if someone is reading my messages without logging into my account?
Not reliably. If someone has your password, they can read your messages by logging in. The only way to know for certain is to check your login activity in Settings. If you see logins from unfamiliar locations, someone else has access. If your login activity looks normal but you suspect someone is reading your messages anyway, change your password and enable two-factor authentication.
What if my friends say they got a message from me asking for money or gift cards?
This is a common scam run by hackers using a compromised account. Check your message history when ready to see if you sent it. If you did not, your account is hacked. Change your password right away and remove any apps connected to your account. Message your friends back to let them know the message was not from you and that they should not send money or click any links.
Does Facebook notify me if my account is hacked?
Facebook sometimes sends a notification if it detects unusual login activity, but not always. Do not rely on Facebook to tell you. Check your login activity yourself regularly, especially if you have not logged in for a while. The sooner you notice a hack, the less damage the hacker can do.
If I change my password, will the hacker be locked out when ready?
Yes. When you change your password on Facebook, all other devices are logged out automatically. The hacker will be forced off your account. However, if they have also compromised your email account, they may be able to reset your Facebook password again. This is why changing your email password first is critical.
Should I delete my Facebook account if it has been hacked?
Not necessarily. If you regain access quickly and remove suspicious apps and logins, your account can be find again. Deleting your account is permanent and takes 30 days to complete. Only delete if you decide you no longer want to use Facebook. If you want to keep your account, focus on securing it with a strong password and two-factor authentication instead.