How to Protect Your Facebook Account From Hackers

A hacked Facebook account is more than an inconvenience. Scammers use taken-over accounts to message friends asking for money, post fake marketplace listings, or lock the owner out completely. Teens are frequent targets because they tend to click quickly and reuse passwords across games and apps.

The good news is that a handful of settings stop most account takeovers. Here is what to turn on, what to watch for, and what to do if the worst happens.

How Facebook accounts usually get hacked

Most account takeovers are not sophisticated. They tend to fall into a few patterns:

• Phishing. A message or email that looks like it comes from Facebook or Meta warns that your account will be disabled or that you violated a rule. The link leads to a fake login page.
• Messages from a friend's hacked account. "Is this you in this video?" or "Can you help me vote in this contest?" with a link or a request for a code.
• Reused passwords. If your teen used the same password for a gaming site that was breached, attackers try it on Facebook too.
• Code requests. Someone asks you to forward a code you just received by text. That code is often a login or recovery code for your own account.
• Malicious apps and browser extensions that ask for access to your account.

Step 1: Use a strong, unique password

Every account in your family should have its own password. A password manager makes this realistic: it creates and remembers long passwords so nobody has to. If your teen insists on remembering their own, a phrase of four or five unrelated words is stronger and easier to type than a short jumble of symbols.

Step 2: Turn on two-factor authentication or a passkey

Two-factor authentication means a stolen password alone is not enough to get in. Facebook's security options live in Accounts Center.

1. Tap or click your profile picture, then Settings & privacy > Settings.
2. Open Accounts Center, then Password and security.
3. Select Two-factor authentication and choose the Facebook account.
4. Pick a method. An authentication app is stronger than text messages, because codes sent by text can be intercepted or talked out of you.
5. Save the recovery codes Facebook offers somewhere safe, such as your password manager.

Meta also began rolling out passkeys for Facebook on mobile in 2025. A passkey lets you sign in with your phone's face, fingerprint or PIN unlock instead of typing a password, and it cannot be typed into a fake website. You can set it up in Accounts Center under Password and security. Passwords and two-factor authentication still work alongside it.

If the menus on your device look different, search the Facebook Help Center for "two-factor authentication" for the latest steps.

Step 3: Turn on login alerts

Login alerts notify you when someone signs in from a device or browser Facebook does not recognize. They appear in the security section of Accounts Center. When an alert arrives for a login that was not you, act right away: change your password and log that session out.

We explain the setting in more detail in our guide to Facebook login notifications.

Step 4: Check where you are logged in

Accounts Center shows a list of devices and locations currently signed in to your account. Look through it every few months:

• Log out of any device you do not recognize.
• Log out of old phones, school computers and friends' tablets.
• If anything looks wrong, log out of all sessions and change your password.

Step 5: Clean up connected apps

Over the years, many of us have used "Log in with Facebook" on quizzes, games and shopping sites. Each of those connections is a possible weak spot. In your Settings, find the section for apps and websites, review the list, and remove anything you no longer use. Our article on app privacy controls covers what those apps can see.

Step 6: Learn to spot the scams

Go over these rules with your kids, because they apply to every platform, not just Facebook:

1. Never share a code that arrives by text or email, with anyone, even a friend.
2. Facebook will not message you through a regular chat or a random Page to say your account is about to be deleted.
3. Check the address bar before entering a password. The real site is facebook.com.
4. Be suspicious of urgency. "Act within 24 hours" is a pressure tactic.
5. Confirm odd requests another way. If a friend asks for money or a code, call or text them directly.

For a broader look at threats, see our guide to viruses, malware and hackers.

If an account has been hacked

1. From a trusted device, go to facebook.com/hacked and follow the steps.
2. If you can still log in, change the password immediately and log out of all other sessions.
3. Check that the email address and phone number on the account are still yours, and remove any that are not.
4. Turn on two-factor authentication if it was off.
5. Review recent posts, messages and Marketplace listings for anything the attacker created, and warn friends who may have received messages.
6. Change the password on any other account that used the same one.

The bottom line

• Use a unique password, ideally stored in a password manager.
• Turn on two-factor authentication with an authenticator app, or set up a passkey.
• Enable login alerts and review logged-in devices a few times a year.
• Remove old connected apps.
• Never share a login code with anyone, no matter who asks.