Instagram or Facebook Page Hacked? What to Do in the First Hour

If someone has taken over your Instagram account or Facebook Page, the first hour matters more than any other. Work through the steps below in order, from a phone or laptop you have used to log in before. Don't stop to post an apology or argue with the hacker in your DMs.

What should you do right now?

Do these seven things first, in this order. Each one closes a door the hacker could use next.

1. Secure your email account. Change its password and turn on two-factor authentication. Whoever controls your email can reset everything else.
2. Check your phone number still works. If your SIM has suddenly lost signal, call your network (MTN, Telecel or AirtelTigo) from another phone. A SIM swap is how many takeovers start.
3. Start official recovery. Go to instagram.com/hacked or facebook.com/hacked and follow the prompts. Use only these addresses, typed by hand.
4. Freeze the card on your ad account. Lock or freeze it in your bank app, or call the bank. A hacker with your ad account can spend your money on their adverts.
5. Remove anyone you don't recognise from your business portfolio in Meta Business Suite, if you can still get in.
6. Warn your customers on WhatsApp that the account was hacked and they should not pay anyone who contacts them from it.
7. Write down what happened: times, the emails you received, screenshots of strange posts or messages. You'll need them.

Can you still log in?

Whether you can still get in decides your route. If you can, you're racing the hacker. If you can't, you're proving to Meta that the account is yours.

If you can still log in: change your password straight away, then go to Accounts Center (Meta is gradually renaming it Meta Account), open Password and security, and check where you're logged in. Log out every device you don't recognise. Then check the email address and phone number on the account are yours, and remove any you didn't add.

If you've been locked out: use the official recovery pages below. Meta's help centre says to visit facebook.com/hacked on a device you've used to log into Facebook before.

How do you get a hacked Instagram account back?

Instagram's own steps start at instagram.com/hacked, in a mobile or desktop browser, and branch depending on what the hacker changed.

• Check your email first. If the hacker changed your email address, Instagram sends a message from security@mail.instagram.com to the old address. Instagram's help centre says you can undo the change by selecting "secure my account" in that message.
• Request a login link. On the login screen, tap "Forgot password?", enter your username, email or phone number, and open the link Instagram sends.
• Request support. If the link doesn't work, request help from a mobile device and give a secure email address that only you can access.
• Be ready for a video selfie. For accounts with photos of you, Instagram may ask you to record a short video turning your head in different directions. Instagram says the video is never shown on Instagram and is deleted within 30 days. You won't have access to the account while it's reviewed.

Once you're back in, change your password, turn on two-factor authentication, confirm your phone and email, and remove linked accounts and third-party apps you don't recognise.

How do you recover a hacked Facebook account or Page?

Your Facebook profile and your Facebook Page are recovered separately, so you may need both routes.

Your personal profile: go to facebook.com/hacked from a device you've used before. If the hacker changed your email, Facebook sends a message to the previous email address with a special link to reverse the change. Check spam too. Meta said in December 2025 that it had added an optional selfie video to its recovery methods, so you may be offered that to confirm it's you.

Your business Page: Meta has a separate form to request Page recovery, linked from its help article "Recover a hacked Facebook Page you manage". Meta calls it the fastest way to recover a Page, even for businesses that pay for Meta Verified or have other support access. Meta is also clear that it can only act if it can confirm the Page was compromised, so submit evidence: the security emails, screenshots and dates.

Beware of "recovery agents" and fake "Meta support" phone numbers. Meta says its representatives will never ask for money, passwords or payment details over chat or email.

What happens to your ad account and the card on it?

Your ad account and card are often the real prize for hackers, because they can run their own adverts with your money. Deal with this before the Page's posts.

1. Freeze the card in your bank app, or call your bank.
2. Pause your campaigns if you can still get into Ads Manager, so you can see clearly whether new spending appears.
3. Check Billing and payments. Meta's guide "Troubleshoot unrecognised activity on your ad account" says to review your payment activity, open each charge's transaction ID and download receipts, which show the amount, the campaigns and the results.
4. Remove payment methods you don't recognise in your payment settings.
5. Report unexplained charges to Meta through the contact route in that same troubleshooting guide, and keep the receipts for your bank.

A hacked account is also a common reason Meta restricts ad accounts, because the activity looks suspicious. If that has already happened, our guide to a restricted Facebook ad account covers the appeal.

How do you remove unknown admins in Meta Business Suite?

Only an admin of your business portfolio (what Meta used to call Business Manager) can remove people, so do this the moment you have access.

In Meta Business Suite, open Business settings and check three places: the list of people with access to the business, the people with access to each Page and ad account, and any partners connected to the business. Remove anyone you don't know, plus former staff and old agencies you no longer work with. Meta's help centre also advises undoing any changes you don't recognise, such as a new Page name or website link.

If another admin's personal profile was the one hacked, they need to recover their own profile through facebook.com/hacked. You can't do it for them.

What should you tell your customers?

Tell them quickly and plainly, because the hacker's next move is often to scam them in your name. In Ghana that typically looks like a "flash sale" or "clearance" post asking people to pay a new MoMo number, or DMs to your followers asking for urgent help with money.

Send a short WhatsApp Business broadcast to your customer list, post it on your WhatsApp Status, and ask staff to share it:

Hello, this is [business name]. Our Instagram account was hacked today. Please do not pay any money to anyone messaging you from it, and ignore any new MoMo numbers or "promo" offers. Our only payment number is [your registered MoMo name and number]. We'll let you know when it's back. Thank you.

If you have other channels, such as a second Facebook Page, a TikTok account or a website, put the same notice there. Customers who pay a scammer often blame the business, so the warning protects your reputation as well as their money.

You can also report the incident to Ghana's Cyber Security Authority. Its reporting page lists a call and SMS line on 292, WhatsApp on 0501603111 and email at report@csa.gov.gh.

How did they get in?

Many business accounts are taken through a trick, not a technical break-in.

• Fake "copyright violation" or "policy" messages. A DM or email says your Page will be deleted unless you appeal through a link, which leads to a fake login page that collects your password and two-factor code. Meta warns that scammers threaten bans to rush you, and that genuine Meta emails come only from domains such as facebook.com, facebookmail.com, instagram.com, meta.com and metamail.com.
• Sharing a code. Someone pretending to be a friend, a customer or "Meta" asks you to forward a code that was "sent by mistake". That code was your login or recovery code.
• SIM swap. Your number is moved to a new SIM, and every SMS code goes to the attacker.
• Old passwords. The same password you used on a site that leaked years ago.
• Too many admins. A former staff member, a freelancer or an old agency whose own account was hacked, with access to yours still attached.

How do you stop it happening again?

Prevention takes about an hour.

• Use an authenticator app for two-factor authentication, not SMS alone. Facebook's help centre offers a security key, an authentication app such as Google Authenticator, or text message codes. App codes can't be stolen with a SIM swap.
• Save your recovery codes. Facebook lets you generate 10 recovery codes, each usable once. Keep them offline.
• Turn on Advanced Protection if Meta offers it to you. Meta says it's aimed at Page admins, accounts in business portfolios that advertise, creators with large audiences and Meta Verified subscribers, and requires stronger logins such as passkeys or two-factor authentication. It sits under Password and security in Accounts Center.
• Keep admins few and named. Everyone gets their own login and the lowest access they need, and leavers are removed the same day.
• Protect the email behind the account. Use a business address you control, with its own two-factor authentication.
• Train the team on one rule: nobody clicks a "Meta" link in a DM. Facebook and Instagram let you check which emails Meta genuinely sent you in your security settings.
• Own your customer list. Keep customers' WhatsApp numbers and emails in your own system, so a lost account never means lost customers. See our guide to WhatsApp broadcasts.

If an agency runs your adverts, give it partner access, never your password, and keep admin control yourself. See the real cost of a bad marketing agency.

When should you get help?

Get help when recovery has stalled, your ad account is restricted, customers have lost money, or you're not sure who still has access to what. Nobody outside Meta can override its decisions, so treat anyone promising to restore an account for a fee as a scammer. What a good agency can do is audit every admin, partner, payment method and connected asset, fix the security settings, prepare the appeal properly and keep your sales moving while you wait.

Common questions

How long does it take to recover a hacked Instagram or Facebook account?

It varies from minutes to weeks, depending on what the hacker changed and how quickly Meta can confirm the account is yours.

Should I create a new account straight away?

Not for your ads: creating new accounts to get around a restriction can make things worse. A temporary profile to warn customers is fine.

Can Meta Verified get my account back faster?

Meta Verified includes account support for the subscribed profile, though the level of support varies by plan and region. Even so, Meta's own help centre says the Page recovery form is still the fastest way to recover a hacked Page. Use both if you subscribe.

Will I be refunded for adverts the hacker ran?

Report the charges to Meta through its unrecognised activity guide and to your bank. Neither outcome is guaranteed, which is why freezing the card in the first hour matters.

Is SMS two-factor authentication enough?

It's far better than nothing, but SMS codes can be stolen with a SIM swap. An authenticator app or a passkey is safer, with recovery codes kept offline.

If your account has been hacked, or you want your Meta setup checked before it happens, book a free strategy call. We'll go through who has access to your Page, ad account and payment method, and tell you exactly what to lock down first.