Someone got into your Facebook, Instagram, or WhatsApp — and you can get it back.

These three apps are all run by a company called Meta, and they share one login system.

If a stranger took over your account, this guide shows you exactly what to do and what to tap, one calm step at a time.

The path is a little different for each app, so we have a clear section for each one.

You don't need to be good with tech.

Every tool here is free.

How to use this guide. Start at the top — the first hour matters most (Part 1).

Then jump to the section for your app: Facebook is Part 2, Instagram is Part 3, WhatsApp is Part 4.

After you're back in, Parts 5–9 help you lock the door, undo the damage, save proof, report it, and stop it from happening again.

When Meta makes you wait, we tell you how long.

A word you'll see a lot: an account takeover just means a stranger got control of your account.

A note on the screen names: the buttons below match Meta's own instructions as of 2026.

Meta renames buttons often, and the words can differ between an iPhone, an Android phone, and a computer.

If a word on your screen looks a little different, pick the closest match.

The "report it" steps in Part 8 are written for the United States — in other countries, use your country's version (we say where).

Which path are you on?

Find your app, then go to its part:

Facebook→ go to facebook.com/hacked on a device you've used before → Part 2
Instagram → go to instagram.com/hacked in a browser or the app → Part 3
WhatsApp → open WhatsApp and sign your number back in (re-register) → Part 4
Then everyone: lock the door (Part 5) · undo the damage (Part 6) · save the proof (Part 7) · report it (Part 8) · harden it (Part 9).

Part 1 — The first hour (every app)

Do these now — they matter most.

Step 1 — First: is this a real break-in, or just a scare?

Some messages try to scare you so you'll hand over your account.

Tell the two apart.

Signs of a real break-in (Meta's own list):your profile picture, name, or birthday changed and you didn't do it; there are posts, comments, or messages you didn't write; you can't log in, or your two-factor code isn't working; you got a real notice from Meta that an email or phone number was added or removed, or your password was changed — and it wasn't you; under "Where you're logged in" you see a device or place you don't recognize.
Signs it's just a scare (a trick): someone is pushingyou to act fast — an email, text, direct message, or call telling you to "verify your account," click a link, read back a login code, or share your password. Meanwhile your account still works normally.

How to spot a fake "Meta" message.Meta's own rule, word for word: "Meta will never ask you for your password in an email." A real email from Meta only comes from one of these web addresses (or it's a fake): fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, or metamail.com. Safest move: never click a link in the message — open the app yourself and check your settings.

One more warning:Meta has no customer-service phone number for hacked accounts. Any "Facebook support" or "Instagram support" phone number you find online is almost certainly a scammer. Don't call it.

Step 2 — If you can still get in, change your password right now.

The path is the same on Facebook and Instagram, because they share one settings hub called the Accounts Center (the place that ties your Facebook, Instagram, and WhatsApp together).

Pick a new password you've never used anywhere else.

Open Settings & privacy → Settings → Accounts Center → Password and security → Change password, then pick the account to update.
If you see a different menu: Meta is slowly moving everyone to "Meta Accounts," so you may see either Accounts Center or Meta Account settings. Either is the right place.
Can't change it because someone already changed your password? Go to the part for your app (Facebook = Part 2, Instagram = Part 3, WhatsApp = Part 4).

Step 3 — Kick the intruder off your other devices.

A sessionis any place you're logged in right now — a phone, a computer, or a web browser.

In Password and security, open Where you're logged in. Tap any device or place you don't recognize and log it out. There's also an option to log out of every session at once.
Changing your password in Step 2 also signs most other devices out — so do Step 2 first, then clean up here.

Sources: Facebook Help Center — "Recover your Facebook account if you were hacked"; "Check if an email is really from Facebook"; "Change your password"; "Keep your account secure." Instagram Help Center — "If you think your Instagram account has been hacked."

Part 2 — Get back into Facebook

Start at facebook.com/hacked on a device you've used before.

Step 4 — Go to Facebook's rescue page.

In a web browser, type facebook.com/hacked.

Meta says to do this "on a device you've used to log into Facebook before"— that helps Facebook trust it's you.

You'll see a screen titled What to do if your account has been hacked.

Tap Next and follow the steps.

Step 5 — Find your account and reset the password.

If the rescue page can't sign you in, find your account by hand:

Go to facebook.com/login/identify (the Find your account page). Type your email or mobile number and tap Continue (some screens say Search). If that doesn't find it, try your account name or username.
On the login screen you can also tap Forgot password? to reset it.

Heads up about two-factor authentication. Two-factor authentication("2FA") is a second check: after your password, Facebook also wants a one-time login code. If it's on, Meta says you "won't be able to use the same mobile phone number that you use for two-factor authentication to reset your password"— you'll need to add a different phone number or email during recovery.

Step 6 — The locked-out case: the intruder changed your email or phone.

You changed nothing but can't sign in: on the Find your account page, after Facebook finds you, tap No longer have access to these? Meta notes the button might instead read Forgot account? or Recover. Follow the prompts. You'll be asked for a new email or phone — and it "must not have been used for your Facebook account before."
The intruder changed your email: check your oldemail's inbox. Meta says, "When an email is changed, we send a message to the previous email account with a special link. You can click this link to reverse the email change and secure your account." Act fast — Meta does not say how long that link stays good.

Step 7 — If Facebook asks you to prove it's you.

Photo ID:take a clear photo of an official ID and upload it. Facebook accepts one government ID (Driver's license, National identity card, Passport, or Birth certificate), or two non-government items (like a Student card or Library card) if you have no government ID. Meta's tip: "Only submit the required documents. Submitting more documents than necessary may delay the review process."
Video selfie:a short video to show you're a real person. Note: this option is not offered in every country— from some places Facebook shows "This feature isn't currently available in your country."

⏱ How long does the ID check take? Be honest with yourself: Meta does not promise a number of days for reviewing an ID or selfie on Facebook. It only says it may keep the image "up to one year"to fight fraud — that's a storage limit, not the review time. Follow the on-screen steps and wait. Tip: after you upload an ID, delete the photo from your phone's gallery.

Sources: Facebook Help Center — "Recover your Facebook account if you were hacked" (facebook.com/hacked); "Recover your Facebook account if you can't access your account email address or mobile phone number"; "Change your password"; "Confirm your identity on Facebook"; "Upload an ID to Facebook"; "Types of IDs that Facebook accepts"; "How Facebook uses your selfie to confirm your identity"; "Video selfie verification on Facebook."

Part 3 — Get back into Instagram

Start at instagram.com/hacked, or "Forgot password?" in the app.

Step 8 — Go to Instagram's rescue page, or ask for a login link.

Rescue page: in a browser or the app, go to instagram.com/hacked. You'll see Find your account — type your username, phone number, or email and tap Next.
Login link: on the login screen, tap Forgot password? Enter your username, email, or phone, then tap Send login link. Finish the puzzle that proves you're human, tap Next, then open the link Instagram texts or emails you.

Step 9 — If the intruder changed your email — check your inbox.

When an account email is changed, Instagram emails the old address from security@mail.instagram.com.

Meta says you "may be able to undo this change by selecting secure my account in that message."

Instagram sends two emails — one to the old address to deny the change, one to the new address to allow it.

Open your old inbox and tap secure my account right away.

Step 10 — Ask Instagram for support, and prove it's you.

If the login link doesn't get you in, Meta says you "may be able to request support from us on a mobile device."

Follow the on-screen "request support" prompts.

Use an email address only you can read — Meta says, "Once you've submitted your request, you should receive an email from Instagram with next steps."

Then Instagram checks it's you in one of two ways:

If your account has photos of you: you'll be asked to "take a video selfie of you turning your head in different directions."
If your account has no photos of you:you'll get an automatic email asking for the email or phone you signed up with, and the kind of device you used when you joined (for example, iPhone or Android).

⏱ The waiting, plainly. Instagram does not promise a number of days. It says only that while it reviews your video selfie, "you will not have access to your account until we confirm that it's you," and that the selfie video "will be deleted within 30 days."If you pass, Instagram emails you a link to reset your password. If it can't confirm you the first time, you can try again.

Step 11 — The hard dead-end to know about.

⛔ If you can't get into the email you signed up with. Instagram is blunt, word for word: "If you can't access the email account you registered with and didn't link your Instagram and Facebook accounts, we're unable to give you access to the account." So your real first job may be to get your email back from your email company. Once you can read that inbox again, come back and try the steps above. (This is why linking Instagram and Facebook in the Accounts Center ahead of time helps so much.)

Sources: Instagram Help Center — "If you think your Instagram account has been hacked" (instagram.com/hacked); "What to do if the email for your Instagram account was changed"; "Why you might be asked to upload a video selfie to confirm your identity on Instagram"; "Why you're being asked to upload an ID to Instagram"; "Lost access to email or phone number linked to Instagram account."

Part 4 — Get back into WhatsApp

WhatsApp is different: you win it back by signing your phone number in again.

Step 12 — Sign your number back in (this kicks the intruder out).

WhatsApp belongs to whoever can receive a text at your phone number.

Signing in again is called re-registering.

The moment you do it, the intruder is signed out — because, in Meta's words, "A WhatsApp account can only be registered with one phone number at a time," and "all devices logged into your WhatsApp account are automatically logged out" once you enter the code.

Open WhatsApp and tap Log back in → Continue.
If asked, enter your full phone number (with country code) and tap Next → Ok.
WhatsApp sends a 6-digit codeby text (SMS) or phone call. Type it in. You're back in.

Good news about your messages. Your chats use end-to-end encryption — they're scrambled so only your phone can read them. Meta confirms "someone re-registering your WhatsApp account on a new device can't read your past conversations." (Your own chat history comes back only if you had a backup saved to Google or iCloud.)

Step 13 — The worst case: the intruder set a two-step PIN.

A two-step verification PIN is an extra 6-digit secret WhatsApp can ask for when registering a number.

It's different from the texted code.

If the intruder turned it on, you'll be asked for a PIN you never set.

Meta's words: "If you don't have the PIN, wait 7 days and try again." The 7 days count from the last time the account connected to WhatsApp.
"No one can access your account during the 7-day wait period." After 7 days, tap Forgot PIN? → Reset Account.
WhatsApp says "there isn't an option for us to speed up the 7-day timeframe" — not even by contacting them.
Shortcut: if you had added an email to your PIN earlier, you can skip the wait — tap Forgot PIN? → Send Emailand use the reset link. If the intruder set the PIN, there's no email you control, so the 7-day wait is the only way.

Step 14 — If you lost the phone or the SIM card too.

Your SIM card is the small chip that owns your phone number.

Meta says, "It's not possible to recover an account without a SIM card with the same phone number as your account."

If your phone or SIM is gone:

Call your phone company right away. Ask them to block the old SIM and send a new SIM with the same phone number.
Put the new SIM in your phone, open WhatsApp, and re-register (Step 12). That automatically logs the lost device out.

★ Two things to know. Tell your friends — Meta suggests you "notify family and friends as this person could impersonate you in chats and groups." WhatsApp won't do it for you— older advice said to email WhatsApp to "deactivate" a stolen account, but that's out of date: WhatsApp now says "Remote WhatsApp deactivation from another device is not possible." Recovery is the re-register step above. Also: try to recover before you report the account, or WhatsApp may ban it.

Sources: WhatsApp Help Center — "How to recover a compromised account"; "How to reset your two-step verification PIN"; "About email verification codes and resetting two-step verification"; "How to recover a WhatsApp account from a lost or stolen device"; "About account deactivation."

Part 5 — You're back in: lock the door

Do these in order so the intruder can't return (Facebook & Instagram).

Set a brand-new strong passwordyou've never used anywhere else (same path as Step 2: Accounts Center → Password and security → Change password).
Sign out of unknown sessions:Password and security → Where you're logged in. Log out anything you don't recognize.
Turn on two-factor authenticationso a password alone isn't enough: Password and security → Two-factor authentication. On Facebook you can choose a security key, an authentication app (a free app that makes login codes, like Google Authenticator or Duo), or text-message (SMS) codes — and you can save "10 recovery login codes"for when you don't have your phone. On Instagram the choices are Authentication app (recommended), Text message, or WhatsApp.
Turn on login alerts: look for Login alerts (also shown as Get login alerts) in Password and security and switch it on. Meta warns you if someone signs in from a device it doesn't know.
Check the Accounts Center links:in Accounts Center, look at which accounts are linked together. Remove any you don't recognize.
Run a checkup: on Facebook, run Security Checkup. Instagram has no tool by that name — follow its "Secure your Instagram account" steps instead.
Re-check your email and phone: in Password and security, make sure the emails and phone numbers on the account are yours; remove any you don't know. Then secure your email account itself — anyone who can read your email can often get back into your social accounts.

Sources: Facebook Help Center — "How two-factor authentication works on Facebook"; "Security Tips and Features" (Login alerts); "Log out of Facebook on another device"; "How Security Checkup helps"; "About Accounts Center." Instagram Help Center — "Securing your Instagram account with two-factor authentication"; "Secure your Instagram account."

Part 6 — Undo what they did

Step 15 — Clean up rogue posts and messages.

There's no single "undo everything" button, so do a quick sweep by hand.

Look through your timeline, your Stories, and your direct messages, and delete anything you didn't post or send.

On Facebook, your Activity Logis a history of what your account has done — use it to spot the intruder's actions.

(Before you delete things you might need as proof, read Part 7 first.)

Step 16 — Check for money damage: ads and Meta Pay.

Strange charges from Meta: open Settings → Accounts Center → Meta Pay, tap See All next to your activity, open the charge, and tap Get Help with this Payment → Contact Us. Don't wait: Meta's payment terms say you must report an unauthorized charge within 30 days or you may lose the claim.
Ad-account charges: handled separately. Meta says, "If you see a charge on your Ads Account that you don't recognize, visit the Meta Business Help Center."There, check who has access under your ad-account roles and remove anyone you don't know.
Your bank card: if real money left your account, also call your bank to dispute the charge.

Step 17 — If a business Page or ad account was taken.

If you run a Facebook Page or business account and the intruder removed you, you can ask to get it back through Meta Business Suite using Request access to a Page, or by submitting a request to get full control of your business portfolio.

⏱ Business recovery can be slow. Getting control of a Page back from someone else is a dispute that Meta says can take anywhere from a couple of weeks to several months. Start it early, keep your proof handy, and be patient.

Sources: Facebook Help Center — "Recover your Facebook account if you were hacked"; "Report an unrecognized Meta charge on your bank statement"; "Activity Log." Meta Business Help Center — "Troubleshoot Unrecognized Activity on Your Ad Account"; "Request access to a Page in Meta Business Suite"; "Submit a Request to Get Full Control of a Business Portfolio."

Part 7 — Save the proof (and the honest truth about deleted content)

Step 18 — Stop, then save what's still there.

If you may need proof later — for the police, a lawyer, or a bank — collect it before you delete or change anything.

The more you use the account, the more old content gets pushed aside or overwritten.

Take screenshots of anything strange — rogue posts, messages, the email telling you your details changed — and make sure the date and time show.
Download a copy of your account with Meta's free tool, now called Export your information(it used to be "Download Your Information"). Go to Settings & privacy → Settings → Accounts Center → Your information and permissions → Export your information → Create export, pick your account, choose Export to device, then start it. One category, Security and Login Information, holds the login records that show the break-in.

⏱ How long the download takes. On Instagram, Meta says, "It may take up to 30 days for us to email you an export link."On Facebook, Meta doesn't promise a set time, but once your file is ready you have "4 days" to download it before it expires. Start this early.

Step 19 — The honest truth: deleted content is usually gone for you.

If the intruder deleted posts or messages, you generally cannot get them back yourself.

The download tool only gives you what's still on the account.

In Meta's own words: "You won't find information or content that you deleted because we delete that content from our servers," and "we may not be able to retrieve deleted content."

One small exception: a message you sent may still sit in the other person's inbox, "similar to an email."

Still on the account(rogue posts still up, messages not deleted, login & security records) → you can save it yourselftoday, free: screenshots (with the date showing) + "Export your information."
Deleted by the intruder (posts & messages they erased) → no self-serve "undo" button. The only route is legal process, through police or a lawyer (Step 20).

One clarification, because it's a common mix-up: recovering deleted text messages on a phone (SMS, iMessage, or app chats like WhatsApp) is a different question from deleted Meta account content.

Those messages live on the device itself, and a forensic examiner can sometimes recover them in a way that holds up as evidence — if the phone is preserved before it's overwritten.

If that's what you're really after, start with recovering deleted text messages.

Step 20 — The lawful route for records you can't see.

If important records are gone and you truly need them (say, for a court case), there is a real path — but it runs through the law, not a button you press.

A preservation requestasks Meta to freeze a snapshot of the records so they aren't erased while a case gets going. Meta will "preserve account records for 90 days" after a valid legal request from law enforcement. It freezes the records but does not hand them over yet.
Legal process is what makes Meta hand records over: a subpoena (for basic account info), a court order, or a search warrant for the contents of an account — the stronger the records, the stronger the paperwork.
Who can do this: not you, on your own. Meta says it is "unable to confirm or respond to requests from anyone who is not law enforcement personnel." These requests go through the police or a lawyer, who use Meta's official Law Enforcement Online Request System at facebook.com/records.

⛔ The bottom line. Truly deleted posts and messages are usually notsomething you can recover yourself. Save what still exists today (screenshots + export), then — if you need the rest — work with the police or an attorney to send Meta a preservation request and legal process. That's the honest path, not a magic "undelete."

Sources: Facebook Help Center — "Export a copy of your Facebook information"; "Learn what categories of information are available to export"; "What happens to content (like posts or photos) I delete from Facebook." Instagram Help Center — "Review and export a copy of your Instagram information." Meta — "Law Enforcement Guidelines" (Safety Center); "Preservation requests" (Transparency Center); "Law Enforcement Online Requests" (facebook.com/records). Meta Privacy Policy.

Part 8 — Tell someone (report it)

Reporting won't unlock your account — but it builds a record and helps stop the criminal.

Step 21 — Report to Meta.

A hacked account: you already did this by going to facebook.com/hacked or instagram.com/hacked (Parts 2–3).
A fake account pretending to be you (called impersonation): On Facebook, go to the fake profile, tap Options(the "···" below the cover photo), choose Report profile, follow the prompts — you can report it even without a Facebook account. On Instagram, go to the fake profile, tap Options → Report → Report Account → It's pretending to be someone else. Instagram will ask for a photo of your government ID, and only acts on reports from the person being impersonated (or their parent/representative).

Step 22 — Report to the authorities (United States).

FTC — report fraud. Go to reportfraud.ftc.gov and click Report Now. The FTC says, "We can't resolve your individual report, but we use reports to investigate and bring cases," and your report is "shared with over 2,000 law enforcers."
FTC — identity theft. If someone is using your name or identity (not just the account), go to IdentityTheft.gov or call 1-877-438-4338. It builds an official Identity Theft Report and a step-by-step recovery plan. That report is "sufficient documentation to resolve issues with the credit bureaus and most companies."
FBI — IC3. For internet crime, file at ic3.gov → File a Complaint. Have ready your contact details, any money details (amounts, dates, where it went), anything you know about the criminal, and email headers if you have them. The FBI warns: "You will not hear from the IC3. The IC3 does not conduct investigations" — it routes your report to the right agency.
Local police.Your IdentityTheft.gov report usually counts as your official report, so you often don't need one. File a police report anyway if you know who did it, or if a company asks — bring a copy of your FTC report.

Outside the United States?Use your country's version. For example: the UK's Report Fraud (formerly Action Fraud) at reportfraud.police.uk or 0300 123 2040; the Canadian Anti-Fraud Centre; or Australia's Scamwatch and ReportCyber. Most countries also have a national cyber-crime reporting site.

Sources: Facebook Help Center — "Report a Facebook profile or Page pretending to be you or someone else." Instagram Help Center — "Report an account that's impersonating you on Instagram." FTC — ReportFraud.ftc.gov; IdentityTheft.gov. FBI — Internet Crime Complaint Center (ic3.gov). UK — Report Fraud (reportfraud.police.uk). Canada — Canadian Anti-Fraud Centre. Australia — Scamwatch; ReportCyber.

Part 9 — Stop it from happening again

A short checklist, all from Meta's own advice.

Use a strong password you use nowhere else. Meta's rule: "Don't use your Facebook password anywhere else online, and never share it with other people."
Turn on two-factor authenticationso a password alone can't get someone in. An authentication app or a security key is stronger than text-message codes. Save your backup/recovery codes somewhere safe.
Try passkeys. A passkeylets you sign in with your face or fingerprint instead of a password, and Meta says it's "less vulnerable to phishing."
Turn on login alerts (Login alerts / Get login alerts) so you hear about a strange sign-in right away.
Keep your email locked down too— it's the master key to your social accounts. Give it its own strong password and two-factor.
Never click a "verify your account" link in a message,and never read a login code out loud to anyone. Remember Meta's rule: "Meta will never ask you for your password in an email."When in doubt, type the app's address yourself.

Sources: Facebook Help Center — "Keep your account secure"; "How two-factor authentication works on Facebook"; "Security Tips and Features" (Login alerts). Instagram Help Center — "Securing your Instagram account with two-factor authentication."

Related recovery guides

This guide is part of a series.

If a different account was hit:

If the break-in goes deeper than one account — drained funds, stolen identity, or an attacker who keeps getting back in — these SleuthX services can help:

A note from SleuthX

This guide is free, and the steps above are everything most people need to get their account back on their own.

If your case is unusually tangled — recovery keeps failing, you've lost every way to prove it's you, or the takeover looks like part of a bigger fraud (drained accounts, stolen identity, blackmail, or a business account held hostage) — SleuthX investigates account-takeover cases and can help.

We're a digital-forensics firm; reaching out is optional and there's no charge to ask.

Find us at sleuthx.ai or email quinn@sleuthx.ai.

Either way — you've got this.

Work the steps in order, and don't share your codes with anyone.

Where this comes from

Every step, screen name, and timeline above comes from current official sources.

All pages were opened and checked in June 2026; Meta changes these flows often, so a button may have moved by the time you read this.

Facebook Help Center (facebook.com/help)

Instagram Help Center (help.instagram.com)

WhatsApp Help Center (faq.whatsapp.com)

Meta Business & Legal

Government & International

Report fraud — FTC
IdentityTheft.gov — FTC (phone 1-877-438-4338)
Internet Crime Complaint Center / IC3 — FBI
Report Fraud, formerly Action Fraud — UK (0300 123 2040)
Canadian Anti-Fraud Centre
Scamwatch — Australia
ReportCyber

This guide is informational and is not legal advice. SleuthX is an independent digital-forensics company and is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. "Meta," "Facebook," "Instagram," "WhatsApp," "Messenger," "Meta Pay," and "Accounts Center" are trademarks of Meta Platforms, Inc. Steps and timelines reflect official sources current as of June 2026 and may change. © 2026 SleuthX, Inc.