Someone got into your Facebook, Instagram, or WhatsApp, and Meta has steps for this.

These three apps are all run by a company called Meta, and they share one login system.

If a stranger took over your account, this guide shows you exactly what to do and what to tap, one calm step at a time.

The path is a little different for each app, so we have a clear section for each one.

You don't need to be good with tech.

Every tool here is free.

How to use this guide. Start at the top, because the first hour matters most (Part 1).

Then jump to the section for your app: Facebook is Part 2, Instagram is Part 3, WhatsApp is Part 4.

After you're back in, Parts 5–9 help you close the other ways in, check what they changed, save proof, report it, and stop it from happening again.

When Meta makes you wait, we tell you how long.

A word you'll see a lot: an account takeover just means a stranger got control of your account.

A note on the screen names: the buttons below match Meta's own instructions as of 2026.

Meta renames buttons often, and the words can differ between an iPhone, an Android phone, and a computer.

If a word on your screen looks a little different, pick the closest match.

The "report it" steps in Part 8 are written for the United States, so in other countries use your country's version (we say where).

Which path are you on?

Find your app, then go to its part:

Facebook → go to facebook.com/hacked on a device you've used before → Part 2
Instagram → go to instagram.com/hacked in a browser or the app → Part 3
WhatsApp → open WhatsApp and sign your number back in (re-register) → Part 4
Then everyone: close the other ways in (Part 5) · check what they changed (Part 6) · save the proof (Part 7) · report it (Part 8) · harden it (Part 9).

Part 1. The first hour (every app)

Do these now. They matter most.

Step 1. First: is this a real break-in, or just a scare?

Some messages try to scare you so you'll hand over your account.

Tell the two apart.

Signs of a real break-in (Meta's own list): your profile picture, name, or birthday changed and you didn't do it; there are posts, comments, or messages you didn't write; you can't log in, or your two-factor code isn't working; you got a real notice from Meta that an email or phone number was added or removed, or your password was changed, and it wasn't you; under "Where you're logged in" you see a device or place you don't recognize.
Signs it's just a scare (a trick): someone is pushing you to act fast, whether an email, text, direct message, or call telling you to "verify your account," click a link, read back a login code, or share your password. Meanwhile your account still works normally.

How to spot a fake "Meta" message. Meta's own rule, word for word: "Meta will never ask you for your password in an email." A real email from Meta only comes from one of these web addresses (or it's a fake): fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, or metamail.com. Safest move: never click a link in the message. Open the app yourself and check your settings.

One more warning: Meta has no customer-service phone number for hacked accounts. Any "Facebook support" or "Instagram support" phone number you find online is almost certainly a scammer. Don't call it.

Step 2. If you can still get in, change your password right now.

The path is the same on Facebook and Instagram, because they share one settings page called the Accounts Center (the place that ties your Facebook, Instagram, and WhatsApp together).

Pick a new password you've never used anywhere else.

Open Settings & privacy → Settings → Accounts Center → Password and security → Change password, then pick the account to update.
If you see a different menu: Meta is slowly moving everyone to "Meta Accounts," so you may see either Accounts Center or Meta Account settings. Either is the right place.
Can't change it because someone already changed your password? Go to the part for your app (Facebook = Part 2, Instagram = Part 3, WhatsApp = Part 4).

Step 3. Sign the other person out of your devices.

A session is any place you're logged in right now, whether a phone, a computer, or a web browser.

In Password and security, open Where you're logged in. Tap any device or place you don't recognize and log it out. There's also an option to log out of every session at once.
Changing your password in Step 2 also signs most other devices out, so do Step 2 first, then clean up here.

Sources: the Facebook Help Center articles on a taken-over account, checking an email from Facebook, changing your password, and keeping your account secure; the Instagram Help Center article on a taken-over account. Each is linked at the end of this guide.

Part 2. Signing back in to Facebook

Start at facebook.com/hacked on a device you've used before.

Step 4. Go to Facebook's rescue page.

In a web browser, type facebook.com/hacked.

Meta says to do this "on a device you've used to log into Facebook before". That helps Facebook trust it's you.

You'll see a screen titled What to do if your account has been hacked.

Tap Next and follow the steps.

Step 5. Find your account and reset the password.

If the rescue page can't sign you in, find your account by hand:

Go to facebook.com/login/identify (the Find your account page). Type your email or mobile number and tap Continue (some screens say Search). If that doesn't find it, try your account name or username.
On the login screen you can also tap Forgot password? to reset it.

Heads up about two-factor authentication. Two-factor authentication ("2FA") is a second check: after your password, Facebook also wants a one-time login code. If it's on, Meta says you "won't be able to use the same mobile phone number that you use for two-factor authentication to reset your password" and you'll need to add a different phone number or email while you sign back in.

Step 6. The locked-out case: the intruder changed your email or phone.

You changed nothing but can't sign in: on the Find your account page, after Facebook finds you, tap No longer have access to these? Meta notes the button might instead read Forgot account? or a similar label. Follow Meta's prompts. You'll be asked for a new email or phone, and it "must not have been used for your Facebook account before."
The intruder changed your email: check your old email's inbox. Meta says, "When an email is changed, we send a message to the previous email account with a special link. You can click this link to reverse the email change and secure your account." Act fast, because Meta does not say how long that link stays good.

Step 7. If Facebook asks you to prove it's you.

Photo ID: take a clear photo of an official ID and upload it. Facebook accepts one government ID (Driver's license, National identity card, Passport, or Birth certificate), or two non-government items (like a Student card or Library card) if you have no government ID. Meta's tip: "Only submit the required documents. Submitting more documents than necessary may delay the review process."
Video selfie: a short video to show you're a real person. Note: this option is not offered in every country, and from some places Facebook shows "This feature isn't currently available in your country."

⏱ How long does the ID check take? Be honest with yourself: Meta does not promise a number of days for reviewing an ID or selfie on Facebook. It only says it may keep the image "up to one year" to fight fraud. That is a storage limit rather than the review time. Follow the on-screen steps and wait. Tip: after you upload an ID, delete the photo from your phone's gallery.

Sources: the Facebook Help Center articles on a taken-over account, signing in when you can't reach your email or phone, changing your password, confirming your identity, uploading an ID, the IDs Facebook accepts, and video selfies. Each is linked at the end of this guide.

Part 3. Signing back in to Instagram

Start at instagram.com/hacked, or "Forgot password?" in the app.

Step 8. Go to Instagram's rescue page, or ask for a login link.

Rescue page: in a browser or the app, go to instagram.com/hacked. You'll see Find your account and type your username, phone number, or email, then tap Next.
Login link: on the login screen, tap Forgot password? Enter your username, email, or phone, then tap Send login link. Finish the puzzle that proves you're human, tap Next, then open the link Instagram texts or emails you.

Step 9. If the intruder changed your email, check your inbox.

When an account email is changed, Instagram emails the old address from security@mail.instagram.com.

Meta says you "may be able to undo this change by selecting secure my account in that message."

Instagram sends two emails, one to the old address to deny the change and one to the new address to allow it.

Open your old inbox and tap secure my account right away.

Step 10. Ask Instagram for support, and prove it's you.

If the login link doesn't get you in, Meta says you "may be able to request support from us on a mobile device."

Follow the on-screen "request support" prompts.

Use an email address only you can read. Meta says, "Once you've submitted your request, you should receive an email from Instagram with next steps."

Then Instagram checks it's you in one of two ways:

If your account has photos of you: you'll be asked to "take a video selfie of you turning your head in different directions."
If your account has no photos of you: you'll get an automatic email asking for the email or phone you signed up with, and the kind of device you used when you joined (for example, iPhone or Android).

⏱ The waiting, plainly. Instagram does not promise a number of days. It says only that while it reviews your video selfie, "you will not have access to your account until we confirm that it's you," and that the selfie video "will be deleted within 30 days." If you pass, Instagram emails you a link to reset your password. If it can't confirm you the first time, you can try again.

Step 11. The hard dead-end to know about.

⛔ If you can't get into the email you signed up with. Instagram is blunt, word for word: "If you can't access the email account you registered with and didn't link your Instagram and Facebook accounts, we're unable to give you access to the account." So your real first job may be to get your email back from your email company. Once you can read that inbox again, come back and try the steps above. (This is why linking Instagram and Facebook in the Accounts Center ahead of time helps so much.)

Sources: the Instagram Help Center articles on a taken-over account, a changed account email, video selfies, uploading an ID, and lost access to the email or phone on the account. Each is linked at the end of this guide.

Part 4. Signing back in to WhatsApp

WhatsApp is different: you win it back by signing your phone number in again.

Step 12. Sign your number back in on WhatsApp.

WhatsApp belongs to whoever can receive a text at your phone number.

Signing in again is called re-registering.

The moment you do it, the intruder is signed out, because, in Meta's words, "A WhatsApp account can only be registered with one phone number at a time," and "all devices logged into your WhatsApp account are automatically logged out" once you enter the code.

Open WhatsApp and tap Log back in → Continue.
If asked, enter your full phone number (with country code) and tap Next → Ok.
WhatsApp sends a 6-digit code by text (SMS) or phone call. Type it in. You're back in.

Good news about your messages. Your chats use end-to-end encryption, so they're scrambled and only your phone can read them. Meta confirms "someone re-registering your WhatsApp account on a new device can't read your past conversations." (Your own chat history comes back only if you had a backup saved to Google or iCloud.)

Step 13. The worst case: the intruder set a two-step PIN.

A two-step verification PIN is an extra 6-digit secret WhatsApp can ask for when registering a number.

It's different from the texted code.

If the intruder turned it on, you'll be asked for a PIN you never set.

Meta's words: "If you don't have the PIN, wait 7 days and try again." The 7 days count from the last time the account connected to WhatsApp.
"No one can access your account during the 7-day wait period." After 7 days, tap Forgot PIN? → Reset Account.
WhatsApp says "there isn't an option for us to speed up the 7-day timeframe," not even by contacting them.
Shortcut: if you had added an email to your PIN earlier, you can skip the wait. Tap Forgot PIN? → Send Email and use the reset link. If the intruder set the PIN, there's no email you control, so the 7-day wait is the only way.

Step 14. If you lost the phone or the SIM card too.

Your SIM card is the small chip that owns your phone number.

Meta says you cannot get a WhatsApp account back without a SIM card that has the same phone number as the account.

If your phone or SIM is gone:

Call your phone company right away. Ask them to block the old SIM and send a new SIM with the same phone number.
Put the new SIM in your phone, open WhatsApp, and re-register (Step 12). That automatically logs the lost device out.

★ Two things to know. Tell your friends, and Meta suggests you "notify family and friends as this person could impersonate you in chats and groups." WhatsApp won't do it for you, and older advice said to email WhatsApp to "deactivate" a stolen account, but that's out of date: WhatsApp now says "Remote WhatsApp deactivation from another device is not possible." Getting back in is the re-register step above. Also: try to get back in before you report the account, or WhatsApp may ban it.

Sources: the WhatsApp Help Center articles on a compromised account, resetting the two-step PIN, email verification codes, a lost or stolen device, and account deactivation. Each is linked at the end of this guide.

Part 5. You're back in: close the other ways in

Do these in order so the intruder can't return (Facebook & Instagram).

Set a brand-new strong password you've never used anywhere else (same path as Step 2: Accounts Center → Password and security → Change password).
Sign out of unknown sessions: Password and security → Where you're logged in. Log out anything you don't recognize.
Turn on two-factor authentication so a password alone isn't enough: Password and security → Two-factor authentication. On Facebook you can choose a security key, an authentication app (a free app that makes login codes, like Google Authenticator or Duo), or text-message (SMS) codes, and you can save a set of 10 one-time backup login codes for when you don't have your phone. On Instagram the choices are Authentication app (recommended), Text message, or WhatsApp.
Turn on login alerts: look for Login alerts (also shown as Get login alerts) in Password and security and switch it on. Meta warns you if someone signs in from a device it doesn't know.
Check the Accounts Center links: in Accounts Center, look at which accounts are linked together. Remove any you don't recognize.
Run a checkup: on Facebook, run Security Checkup. Instagram has no tool by that name, so follow its "Secure your Instagram account" steps instead.
Re-check your email and phone: in Password and security, make sure the emails and phone numbers on the account are yours; remove any you don't know. Then secure your email account itself, because anyone who can read your email can often get back into your social accounts.

Sources: Facebook Help Center, "How two-factor authentication works on Facebook"; "Security Tips and Features" (Login alerts); "Log out of Facebook on another device"; "How Security Checkup helps"; "About Accounts Center." Instagram Help Center, "Securing your Instagram account with two-factor authentication"; "Secure your Instagram account."

Part 6. Check what they changed

Step 15. Clean up rogue posts and messages.

There's no single "undo everything" button, so do a quick sweep by hand.

Look through your timeline, your Stories, and your direct messages, and delete anything you didn't post or send.

On Facebook, your Activity Log is a history of what your account has done, so use it to spot the intruder's actions.

(Before you delete things you might need as proof, read Part 7 first.)

Step 16. Check for money damage: ads and Meta Pay.

Strange charges from Meta: open Settings → Accounts Center → Meta Pay, tap See All next to your activity, open the charge, and tap Get Help with this Payment → Contact Us. Don't wait. Meta's payment terms give you 30 days to report an unauthorized charge, or you may lose the claim.
Ad-account charges: handled separately. Meta says, "If you see a charge on your Ads Account that you don't recognize, visit the Meta Business Help Center." There, check who has access under your ad-account roles and remove anyone you don't know.
Your bank card: if real money left your account, also call your bank to dispute the charge.

Step 17. If a business Page or ad account was taken.

If you run a Facebook Page or business account and the intruder removed you, you can ask to get it back through Meta Business Suite using Request access to a Page, or by submitting a request to get full control of your business portfolio.

⏱ Getting a business Page back can be slow. Getting control of a Page back from someone else is a dispute that Meta says can take anywhere from a couple of weeks to several months. Start it early, keep your proof handy, and be patient.

Sources: the Facebook Help Center articles on a taken-over account, an unrecognized Meta charge, and the Activity Log; the Meta Business Help Center articles on unrecognized ad-account activity, requesting access to a Page, and getting full control of a business portfolio. Each is linked at the end of this guide.

Part 7. Save the proof (and the honest truth about deleted content)

Step 18. Stop, then save what's still there.

If you may need proof later for the police, a lawyer, or a bank, collect it before you delete or change anything.

The more you use the account, the more old content gets pushed aside or overwritten.

Take screenshots of anything strange, whether rogue posts, messages, or the email telling you your details changed, and make sure the date and time show.
Download a copy of your account with Meta's free tool, now called Export your information (it used to be "Download Your Information"). Go to Settings & privacy → Settings → Accounts Center → Your information and permissions → Export your information → Create export, pick your account, choose Export to device, then start it. One category, Security and Login Information, holds the login records that show the break-in.

⏱ How long the download takes. On Instagram, Meta says, "It may take up to 30 days for us to email you an export link." On Facebook, Meta doesn't promise a set time, but once your file is ready you have "4 days" to download it before it expires. Start this early.

Step 19. The honest truth: deleted content is usually gone for you.

If the intruder deleted posts or messages, you generally cannot get them back yourself.

The download tool only gives you what's still on the account.

Meta says content you delete is removed from its servers, and that it may not be able to bring deleted content back.

One small exception: a message you sent may still sit in the other person's inbox, "similar to an email."

Still on the account (rogue posts still up, messages not deleted, login & security records) → you can save it yourself today, free: screenshots (with the date showing) + "Export your information."
Deleted by the intruder (posts & messages they erased) → no self-serve "undo" button. The only route is legal process, through police or a lawyer (Step 20).

One clarification, because it's a common mix-up: deleted text messages on a phone (SMS, iMessage, or app chats like WhatsApp) are a different question from deleted Meta account content.

Those messages live on the device itself, and a forensic examiner can document what the phone still holds, if the phone is preserved before it's overwritten.

If that's what you're really after, start with our guide to deleted text messages.

Step 20. The lawful route for records you can't see.

If important records are gone and you truly need them (say, for a court case), there is a real path, but it runs through the law, not a button you press.

A preservation request asks Meta to freeze a snapshot of the records so they aren't erased while a case gets going. Meta will "preserve account records for 90 days" after a valid legal request from law enforcement. It freezes the records but does not hand them over yet.
Legal process is what makes Meta hand records over: a subpoena (for basic account info), a court order, or a search warrant for the contents of an account, and the stronger the records, the stronger the paperwork.
Who can do this: not you, on your own. Meta says it is "unable to confirm or respond to requests from anyone who is not law enforcement personnel." These requests go through the police or a lawyer, who use Meta's official Law Enforcement Online Request System at facebook.com/records.

⛔ The bottom line. Truly deleted posts and messages are usually not something you can get back yourself. Save what still exists today (screenshots + export), then, if you need the rest, work with the police or an attorney to send Meta a preservation request and legal process. That's the honest path, not a magic "undelete."

Sources: Facebook Help Center, "Export a copy of your Facebook information"; "Learn what categories of information are available to export"; "What happens to content (like posts or photos) I delete from Facebook." Instagram Help Center — "Review and export a copy of your Instagram information." Meta, "Law Enforcement Guidelines" (Safety Center); "Preservation requests" (Transparency Center); "Law Enforcement Online Requests" (facebook.com/records). Meta Privacy Policy.

Part 8. Tell someone (report it)

Reporting won't unlock your account, but it builds a record and helps stop the criminal.

Step 21. Report to Meta.

A hacked account: you already did this by going to facebook.com/hacked or instagram.com/hacked (Parts 2–3).
A fake account pretending to be you (called impersonation): On Facebook, go to the fake profile, tap Options (the "···" below the cover photo), choose Report profile, and follow the prompts. You can report it even without a Facebook account. On Instagram, go to the fake profile, tap Options → Report → Report Account → It's pretending to be someone else. Instagram will ask for a photo of your government ID, and only acts on reports from the person being impersonated (or their parent/representative).

Step 22. Report to the authorities (United States).

FTC report fraud. Go to reportfraud.ftc.gov and click Report Now. The FTC says, "We can't resolve your individual report, but we use reports to investigate and bring cases," and your report is "shared with over 2,000 law enforcers."
FTC identity theft. If someone is using your name or identity (not just the account), go to IdentityTheft.gov or call 1-877-438-4338. It builds an official Identity Theft Report and a step-by-step plan. That report is "sufficient documentation to resolve issues with the credit bureaus and most companies."
FBI IC3. For internet crime, file at ic3.gov → File a Complaint. Have ready your contact details, any money details (amounts, dates, where it went), anything you know about the criminal, and email headers if you have them. The FBI warns: "You will not hear from the IC3. The IC3 does not conduct investigations," which routes your report to the right agency.
Local police. Your IdentityTheft.gov report usually counts as your official report, so you often don't need one. File a police report anyway if you know who did it, or if a company asks, bring a copy of your FTC report.

Outside the United States? Use your country's version. For example: the UK's Report Fraud (formerly Action Fraud) at reportfraud.police.uk or 0300 123 2040; the Canadian Anti-Fraud Centre; or Australia's Scamwatch and ReportCyber. Most countries also have a national cyber-crime reporting site.

Sources: Facebook Help Center, "Report a Facebook profile or Page pretending to be you or someone else." Instagram Help Center, "Report an account that's impersonating you on Instagram." FTC, ReportFraud.ftc.gov; IdentityTheft.gov. FBI, Internet Crime Complaint Center (ic3.gov). UK, Report Fraud (reportfraud.police.uk). Canada, Canadian Anti-Fraud Centre. Australia, Scamwatch; ReportCyber.

Part 9. Stop it from happening again

A short checklist, all from Meta's own advice.

Use a strong password you use nowhere else. Meta's rule: "Don't use your Facebook password anywhere else online, and never share it with other people."
Turn on two-factor authentication so a password alone can't get someone in. An authentication app or a security key is stronger than text-message codes. Save your backup codes somewhere safe.
Try passkeys. A passkey lets you sign in with your face or fingerprint instead of a password, and Meta says it's "less vulnerable to phishing."
Turn on login alerts (Login alerts / Get login alerts) so you hear about a strange sign-in right away.
Keep your email locked down too — it's the master key to your social accounts. Give it its own strong password and two-factor.
Never click a "verify your account" link in a message, and never read a login code out loud to anyone. Remember Meta's rule: "Meta will never ask you for your password in an email." When in doubt, type the app's address yourself.

Sources: Facebook Help Center, "Keep your account secure"; "How two-factor authentication works on Facebook"; "Security Tips and Features" (Login alerts). Instagram Help Center, "Securing your Instagram account with two-factor authentication."

Related account takeover guides

This guide is part of a series.

If a different account was hit:

If the break-in goes deeper than one account, such as drained funds, a stolen identity, or someone who keeps getting back in, a forensic examination documents what happened:

A note from SleuthX

This guide is free, and the steps above are everything most people need to sign back in on their own.

Some cases are tangled: signing back in keeps failing, you've lost every way to prove it's you, or the takeover looks like part of a bigger fraud (drained accounts, stolen identity, blackmail, or a business account held hostage). Then a SleuthX examination documents what happened for the police, a bank or a lawyer.

We examine only a device you own. Before we start, you sign a form stating that you own it.

We're a digital-forensics firm; reaching out is optional and there's no charge to ask.

Find us at sleuthx.ai or email quinn@sleuthx.ai.

Either way — you've got this.

Work the steps in order, and don't share your codes with anyone.

Where this comes from

Every step, screen name, and timeline above comes from current official sources.

All pages were opened and checked in June 2026; Meta changes these flows often, so a button may have moved by the time you read this.

Facebook Help Center (facebook.com/help)

Instagram Help Center (help.instagram.com)

WhatsApp Help Center (faq.whatsapp.com)

Meta Business & Legal

Government & International

Report fraud (FTC)
IdentityTheft.gov (FTC) (phone 1-877-438-4338)
Internet Crime Complaint Center / IC3 (FBI)
Report Fraud, formerly Action Fraud (UK) (0300 123 2040)
Canadian Anti-Fraud Centre
Scamwatch (Australia)
ReportCyber

This guide is informational and is not legal advice. SleuthX is an independent digital-forensics company and is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. "Meta," "Facebook," "Instagram," "WhatsApp," "Messenger," "Meta Pay," and "Accounts Center" are trademarks of Meta Platforms, Inc. Steps and timelines reflect official sources current as of June 2026 and may change. © 2026 SleuthX, Inc.