A compromised social media account is stressful, but a calm sequence beats random password resets. Attackers often control your email, your phone number, or a connected app — fixing only the social login may not be enough.
This guide covers a practical recovery order that works across major platforms. Exact menu names differ; use official help centers linked from our platform guides for button-level steps.
1. Stabilize the damage
Ask trusted friends to ignore weird messages from you. If the attacker is running scams in your name, a Story, post, or text to close contacts reduces harm while you recover access.
If money or crypto was requested from your contacts, say so clearly. Shame helps attackers; clarity helps your community.
2. Secure the email inbox first
Most social recovery codes go to email. If attackers own the inbox, they can intercept resets forever.
- Change the email password from a device you trust.
- Enable two-factor authentication on email; remove unknown forwarding rules and app passwords.
- Check recovery phone/email on the inbox and remove unknowns.
- Review recent login activity for the email provider.
3. Check the phone number
SIM-swap and port-out attacks let criminals receive SMS codes. Contact your carrier if SMS codes arrive you did not request, and prefer authenticator apps over SMS for important accounts when available.
4. Recover the social account via official flows
Use “forgot password,” “hacked account,” or in-app support forms on the official domain only. Avoid third parties who promise recovery for payment — they often steal what remains.
- Try password reset to the secured email or phone.
- Complete identity challenges (old passwords, trusted devices, photo ID where legitimately requested in-app).
- Once inside, change password immediately and enable 2FA.
- Log out other sessions and revoke third-party apps.
- Delete attacker posts and warn contacts if needed.
5. Aftercare
- Update passwords on any site that used the same password
- Review connected Facebook/Google/Apple logins
- Set unique passwords in a password manager
- Document dates and screenshots if you need platform appeals later
- Read our scam and phishing guide to reduce repeat risk
Related platform help: Facebook, Instagram, X, TikTok.
How to recognize a takeover quickly
Early signs include password-reset emails you did not request, login alerts from unfamiliar cities, friends asking about strange messages, posts you did not publish, and connected apps you do not recognize. Treat any one of these as enough reason to begin the recovery sequence — waiting for “proof” often gives attackers time to change recovery emails.
Sometimes the compromise is partial: the attacker cannot change the password yet but can post via a stolen session cookie or a connected scheduling tool. That is why logging out other sessions and revoking apps matters even when your password still works.
Priority order when several accounts fall at once
Attackers who steal a password manager export or an email inbox often pivot sideways. Secure accounts in this order when multiple are affected: email → financial institutions and cloud storage → primary social graph accounts (the ones that can message all your contacts) → secondary social accounts → anything that used “login with Facebook/Google.”
Write a short checklist on paper if you feel panicked. Adrenaline makes people click phishing “support” links. A written order keeps you on official domains only.
About identity verification and photo selfies
Some platforms ask for government ID or video selfies during recovery. Only provide these through the official in-app or help-center flow that starts from a bookmarked domain. Scammers imitate these requests. If a request arrives by DM or a shortened link, it is not legitimate.
If you are uncomfortable with ID upload, look for alternate recovery paths (trusted devices, old passwords, friend vouching features where they exist). Document what you tried and when for appeal follow-ups.
Brand and Page takeovers
When a Facebook Page, Instagram professional account, or YouTube Brand Account is hijacked, personal profile recovery may not be enough. You also need to audit Business Manager / Business Suite roles, YouTube managers, and ad account payment methods. Attackers sometimes run ads on your billing profile.
Keep at least two trusted admins with hardware 2FA on separate devices. Contracts with agencies should require named users rather than shared logins, and access should end the day a contract ends.
When to involve carriers, banks, or law enforcement
Contact your mobile carrier immediately if you suspect SIM swap. Contact banks if financial requests went out in your name. Law enforcement reports may help in identity-theft cases, though platforms still need their own recovery forms completed. Preserve timestamps, message headers, and usernames.
If a minor’s account is involved in exploitation, use appropriate child-protection reporting channels in addition to platform reports. See also our parental controls guide.
Prevention habits that actually help
- Password manager with unique passwords
- Authenticator app or security keys on email and social
- No 2FA codes shared with anyone
- Quarterly app-permission audits
- Skepticism toward giveaways that require login on third-party sites
Recovery is a process, not a single button. Move step by step, keep notes, and use only official support. For platform-specific menus, return to the matching guide under Platforms.
Example scenario: personal Instagram takeover
You wake up to friends asking why you pitched a crypto scheme. You cannot log in; password reset emails do not arrive. First you secure Gmail and discover a forwarding rule to an unknown address — you delete it, change Gmail password, enable authenticator 2FA, then retry Instagram’s hacked-account flow from help.instagram.com on a bookmarked connection. After regain, you revoke sessions, remove a shady “insights” app, delete the spam posts, and post a brief authenticity note. Finally you change passwords on TikTok and Facebook because you reused variants of the same password years ago.
That story is composite, not a promise that every recovery succeeds on the first try. Persistence with official forms matters. Keep case numbers.
Example scenario: brand Page lockout
An agency employee still has admin after the contract ended. One day the Page avatar changes and ads start. The brand founder still has personal profile access but not Page control. Recovery requires Meta Business Support paths, identity verification for the business, and removal of unauthorized partners. Legal contracts that specify access return timelines make these cases easier. Technical skill alone rarely replaces paperwork.
Printable recovery checklist
- Secure email + remove forwarding
- Call carrier if SMS anomalies
- Official social recovery only
- New password + 2FA + session revoke
- App revoke + post cleanup + friend warning
- Sideways password changes
- Billing audit for ads
- Notes with dates for appeals
Return to this article when panic rises. Slow is smooth; smooth is fast.
Related articles
- Spotting Scams and Phishing DMs on Social Media
- Social Media Privacy Checklist
- How to Download and Backup Your Social Media Data
Independent educational content. Not affiliated with any platform. Last reviewed October 2026.