Losing access to a social media account can be stressful. You may discover that your password no longer works, your email address has changed, unfamiliar posts have appeared, or the platform has temporarily locked the account.
The safest way to recover the account is to use the platform’s official recovery system. Avoid people who claim they can recover the account for money, especially if they ask for your password, verification codes or other private login information.
First, determine what happened
A hacked account and a locked account are not always the same problem.
Your account may have been compromised if:
- Your password suddenly stopped working
- Your email address was changed without your permission
- You see posts you did not create
- Messages were sent from your account without you sending them
- New devices or sessions appear that you do not recognize
- You receive an unexpected password-reset notification
An account may instead be locked because the platform detected suspicious activity, too many failed login attempts or another security issue.
X, for example, says a compromised account may show unexpected posts, messages, account changes or a password that no longer works.
Try the normal password recovery option
If you still control the email address or phone number connected to the account, start with the platform’s official “Forgot password” or account recovery process.
Enter the email address, username or phone number associated with the account and follow the verification instructions.
Check your spam or junk folder if the recovery email does not appear.
Do not keep requesting dozens of password-reset codes. Some platforms temporarily restrict repeated attempts for security reasons.
X, for example, says repeated failed login attempts can trigger a temporary lock that lasts about an hour.
If the hacker changed your email address
This situation requires extra care.
Search your original email inbox for security notifications from the social media platform. Some platforms send a message when the account’s email address or password is changed and may provide a way to reverse an unauthorized change.
Do not click suspicious links in messages claiming to be from the platform. Instead, open the platform’s official website or application yourself and begin the recovery process there.
Recover a Facebook account
If you believe your Facebook account has been hacked, use Facebook’s official account recovery process rather than contacting an unofficial “account recovery agent.”
Facebook’s Help Center specifically directs people who believe their account has been hacked to its account-recovery process, including recovery from a device previously used to access the account.
If Facebook asks you to complete a security check, follow the instructions shown on the official service. Facebook says some security checks can result in a waiting period before access is restored.
Once you regain access, review your security settings and enable additional protection such as two-factor authentication. Facebook lists login alerts and two-factor authentication among its account-security features.
Recover an X account
If you can still log in to X, change your password immediately.
X recommends using a strong password that has not been used elsewhere. It also recommends checking the email address attached to the account and revoking access for unfamiliar third-party applications.
If you cannot log in because the account has been compromised, use X’s official hacked-account support form. X says users who cannot regain access through normal login recovery can submit a support request.
If your X account is locked or limited, the platform may require you to verify ownership through email, phone or another verification method.
Secure the email account connected to your social media
This step is often overlooked.
If someone has access to your email account, changing the social media password alone may not solve the problem. The person could potentially use the email account to request another password reset.
Secure the email account first if you suspect it has also been compromised.
Change its password to a new, unique password and review its security settings and logged-in devices.
Change reused passwords
If you used the same password on several websites, change those passwords too.
For example, if the same password was used for your social media account, email and another website, a compromise on one service can put the others at risk.
Use different passwords for important accounts.
A password manager can help generate and store unique passwords so you do not have to memorize every one.
Remove unfamiliar third-party applications
Some account compromises happen because users authorize applications or websites that later gain access to their accounts.
After recovering your account, look through connected applications and remove anything you do not recognize.
X specifically recommends revoking access to unfamiliar third-party applications after an account compromise.
Be cautious with services that promise followers, verification, free rewards or other benefits in exchange for your login details.
Turn on two-factor authentication
Two-factor authentication adds another security step after your password.
Depending on the platform, the second step may involve an authentication app, security key, text message or another supported method.
X recommends two-factor authentication as an additional layer of account protection.
Facebook also provides two-factor authentication and other account-security features.
When possible, use a security method that you control directly rather than sharing verification codes with another person.
Never give someone your verification code
A common mistake after an account is hacked is trusting someone who claims to be able to recover it.
They may ask for:
- Your password
- A one-time verification code
- Your email password
- Recovery codes
- Screenshots of private security messages
Do not give these details to strangers.
A person who asks for a login code may be trying to take control of the account rather than recover it.
What to do if the account is locked
If the platform says your account is locked, read the exact message displayed during login.
The solution could involve:
- Confirming your email address
- Confirming your phone number
- Completing a security check
- Resetting your password
- Waiting for a temporary security lock to expire
- Contacting the platform’s support team
- Appealing a restriction if the platform provides an appeal process
Do not repeatedly attempt random passwords. This can trigger additional security restrictions on some services.
What if you lost access to both email and phone?
Recovery becomes more difficult when you no longer control the account’s recovery methods.
Use the platform’s official account-access or hacked-account support process and provide the information requested to verify ownership.
Do not create fake documents or provide false information to pass an identity check.
If the platform cannot verify that you are the rightful account owner, there may be limits on what it can restore.
Check your devices for suspicious software
If an account keeps getting compromised after you change the password, investigate the devices you use to access it.
Update your operating system and browser. Remove unfamiliar applications and extensions. Run the security tools available on your device.
X specifically recommends scanning computers for malware when unauthorized activity continues after a password change.
Changing the password repeatedly will not solve the underlying problem if a device is still exposing your new login information.
Be careful with recovery scams
Search engines and social media can contain people advertising account-recovery services. Some may claim to have special access to social media companies.
Treat these claims with caution.
Use the platform’s official Help Center, recovery page or support system instead of giving your password or verification code to another person.
A genuine support representative should not need you to hand over your account password.
After you recover the account
Once you regain access, take a few minutes to secure everything.
Check:
- Your email address
- Your phone number
- Your password
- Connected applications
- Logged-in devices
- Recent posts
- Direct messages
- Account recovery options
- Two-factor authentication
- Security notifications
Delete or correct unauthorized posts and notify friends or followers if the compromised account sent suspicious messages.
Final thoughts
The safest way to recover a hacked or locked social media account is to work directly through the platform’s official recovery system.
Start by trying the normal password-reset process if you still control the account’s email or phone number. If that fails, use the platform’s official hacked-account or support process.
After recovering the account, secure the connected email account, replace reused passwords, remove unfamiliar third-party applications and enable two-factor authentication.
Most importantly, never give your password or one-time verification code to someone who promises to recover your account for you.