Hacked Social Media Account: How to Get Back In and Lock It Down

A hacked social media account is one that someone else has signed in to without your permission. You might notice posts you didn’t write, messages to friends asking for money, a changed password or email address, or a sudden “we noticed a new login” alert. Sometimes you are locked out completely.

It happens to careful people. Most takeovers start with a reused password, a fake login page, or a scammer who tricks someone into reading back a security code. This guide walks through getting back in, cleaning up, and locking the account down. The steps were checked against FTC consumer advice on October 8, 2026.

Signs your account was taken over

• You can’t sign in, or your password suddenly doesn’t work.
• You got an email or text saying your password, email address or phone number was changed, and you didn’t do it.
• Friends say you sent them odd links or asked them for money or gift cards.
• There are posts, stories, ads, or new friends or follows you don’t recognize.
• Your account shows logins from devices or places you don’t know.

Step 1: Secure your device and email first

Before you start recovery, make sure the device you’re using is clean. Update your computer or phone, run its security scan, and remove anything suspicious. Then check your email account, because email is used to reset every other password. If your email was hacked too, recover it first. See Hacked Email: What to Do.

Step 2: Use the platform’s official recovery page

Every major platform has its own recovery process. Go to it directly, by typing the address or opening the official app. Don’t search for a phone number, and don’t click links in messages that offer help.

• Facebook: facebook.com/hacked
• Instagram: on the login screen, tap “Forgot password?” or “Get help logging in,” or visit instagram.com/hacked
• TikTok, X, Snapchat and others: use the “Forgot password” or “Help” link on the official login screen and follow the steps for a hacked account

Recovery may ask you to confirm an old email or phone number, upload a photo of your ID, or record a short video selfie. That is normal on the official site. It can take a few days.

Beware of “account recovery” offers. People who comment or message promising to get your account back are almost always scammers who will take a fee and do nothing. Real platforms don’t charge to recover your account.

Step 3: Once you’re back in, lock it down

1. Change your password to a long, unique one you don’t use anywhere else. A password manager makes this easy.
2. Sign out of all other devices from the security or login activity settings.
3. Turn on two-step sign-in (also called two-factor authentication). An authenticator app is stronger than text-message codes.
4. Check your recovery email and phone number and remove any the hacker added.
5. Remove unknown apps and connected accounts that have access to your profile.
6. Review admin roles on any pages or groups you manage, and remove anyone you don’t recognize.
7. Look through recent posts and messages and delete anything you didn’t write.
8. Save your backup codes somewhere safe, like a printed page at home.

Step 4: Warn your friends

Hackers often use a taken-over account to message everyone on the friends list. Post or send a short note once you are back in:

“My account was hacked. If you got a message from me asking for money, a code or a link, please ignore it and don’t click anything. I’m back in control now.”

If you can’t get back in, ask a family member to share the warning for you, and ask friends to report your account as hacked from their side. That can speed up recovery.

Step 5: Check what else might be affected

• Reused passwords: change the password on every account that used the same one.
• Payment details: if you saved a card for ads or shopping on the platform, check for charges and call the card issuer about anything you don’t recognize.
• Accounts that use “Log in with Facebook” or similar: check those too, since they may have been opened.
• Personal information: if the hacker could see your ID photo, address or Social Security number, visit IdentityTheft.gov and consider a credit freeze.

How accounts get taken over, and how to prevent it

• Reused passwords. A password leaked in one data breach gets tried everywhere. Use a different password for each account.
• Fake login pages. A message says your account will be disabled for a copyright problem or policy violation and links to a page that steals your password. Platforms show real warnings inside the app, not only through links.
• Code scams. Someone, often posing as a friend, says they sent you a code by mistake and asks you to read it back. That code is the key to your account. Never share a login code with anyone.
• No two-step sign-in. With it turned on, a stolen password alone isn’t enough.

Our Privacy Toolkit covers password managers and other tools that make these habits easier.

Helping a parent who is locked out

• Sit down together and use the official recovery page on their own device, so the platform recognizes it.
• Make sure their recovery email and phone number are ones they can still open. Old work emails and disconnected numbers are a common reason recovery fails.
• Write the new password and backup codes on paper and keep them somewhere safe at home.
• Turn on two-step sign-in and show them what a real code request looks like, so they know never to read one to a caller.
• Remind them that a message from “you” asking for money is something to check by calling you first.

Checklist

• Every social media account has a unique password and two-step sign-in.
• Recovery email addresses and phone numbers are current.
• Backup codes are saved somewhere safe.
• Nobody in the family shares login codes, even with a “friend.”
• The official recovery pages are bookmarked.

FAQ

Should I just make a new account?

Try recovery first. The hacker may keep using your old account to scam your friends, so report it to the platform either way. If recovery fails, make a new account, tell friends which one is real, and ask them to report the old one.

Someone is offering to recover my account for a fee. Is it legit?

No. These “recovery experts” are a common follow-up scam. Use only the platform’s own recovery page.

How long does recovery take?

It can be minutes if you still have access to your email or phone, or several days if the platform needs to verify your identity. Keep checking the email address you gave during recovery.

Do I need to report it anywhere else?

If you lost money or your identity information was exposed, report it at ReportFraud.ftc.gov or IdentityTheft.gov. Otherwise, reporting it to the platform is usually enough.

Sources

• Federal Trade Commission, “How To Recover Your Hacked Email or Social Media Account,” consumer.ftc.gov, accessed October 8, 2026.
• Federal Trade Commission, “What To Do if You Were Scammed,” consumer.ftc.gov, accessed October 8, 2026.

This is general information, not legal or financial advice. Recovery steps and settings names change from time to time; follow the instructions on each platform’s official help pages.