A Facebook account often contains years of messages, photos, contacts and access to business pages. That makes it valuable to scammers. The strongest defence is a layered setup: a unique password, multi-factor authentication, protected email, careful session review and the ability to recognize phishing. Here is how to secure your Facebook account from hackers today.

Do these five things first

  1. Run Facebook’s Security Checkup.
  2. Change any reused password.
  3. Enable two-factor authentication with an authenticator app or security key when possible.
  4. Turn on alerts for unrecognized logins.
  5. Secure the email account and phone number used for recovery.

1. Use a unique password

Your Facebook password should not be used for email, banking, shopping or any other site. Credential-stuffing attacks succeed when a password leaked elsewhere also opens Facebook. A password manager can generate and store a long random password so you do not have to remember it.

Never send your password or one-time code to a friend, support agent or buyer. Legitimate support does not need your password.

2. Turn on two-factor authentication

Two-factor authentication (2FA) requires an additional proof after the password. In Accounts Center, open Password and security → Two-factor authentication and choose the account. Meta currently supports methods including an authentication app, security key and SMS, although availability can vary.

An authenticator app or hardware security key is generally more resistant to SIM-swap attacks than SMS. Save recovery codes somewhere offline and private. Follow Meta’s official 2FA instructions for the latest menus.

3. Protect your recovery email and number

If an attacker controls your email, they may be able to reset Facebook too. Give your email its own unique password and 2FA. Confirm that Facebook lists only email addresses and phone numbers you control. Remove old work addresses and inactive SIM numbers.

Do not rely on a single recovery channel. Keep your contact information current, but limit who can see it on your profile.

4. Review logged-in devices

Open Password and security → Where you’re logged in. Sign out of sessions you do not recognize and old shared devices you no longer use. If a location looks unfamiliar, remember that mobile networks can report an approximate location; check the device and time as well.

If you find a suspicious session, sign it out, change the password, review account changes and check the email account. Take screenshots of important evidence before removing it if fraud has occurred.

5. Enable login alerts and run Security Checkup

Security Checkup reviews password, two-factor authentication and login alerts in one guided flow. Meta’s Security Checkup help page explains how it works. Turn on alerts through channels you actually monitor.

6. Learn the common Facebook phishing tricks

Many “hacks” begin when the owner voluntarily enters credentials into a fake page. Common lures include:

  • “Your page will be deleted for copyright infringement.”
  • “Is this you in the video?” messages from a compromised friend.
  • Fake verification, ad-credit or giveaway offers.
  • Marketplace buyers asking for an OTP or sending a payment link.
  • Someone pretending to be Meta support in Messenger or WhatsApp.

Do not log in through the link. Open Facebook directly in the app or type facebook.com yourself. Check the exact domain, not the logo or page design. Never approve a login prompt you did not initiate.

7. Lock down privacy and connected apps

Use Privacy Checkup to review who can see posts, profile information and how people find you. Remove apps and websites you no longer use. Limit public details that could answer security questions or help an impersonator.

For Page administrators, give each person their own access instead of sharing one login. Assign the minimum permissions needed and remove former staff immediately. Keep at least two trusted, secured administrators so a business is not dependent on one account.

What to do if your Facebook account is hacked

  1. From a device you have used before, visit facebook.com/hacked.
  2. Secure the associated email account first if it is also compromised.
  3. Change the Facebook password and end unknown sessions.
  4. Review email, phone, 2FA, name, Page roles, ad accounts and payment methods for changes.
  5. Warn contacts not to trust recent messages or money requests.
  6. Preserve evidence and report financial fraud to the relevant provider and authorities.

Meta specifically recommends using a familiar device during recovery. Avoid people selling “guaranteed recovery” in comments; they may be running a second scam.

Extra protection for Bangladeshi users

Be especially cautious when a Messenger contact asks for a bKash, Nagad or banking payment, even if the account belongs to someone you know. Call the person on a trusted number before sending money. Never share a mobile-wallet PIN or verification code. See our detailed guide to avoiding mobile banking scams in Bangladesh.

Frequently asked questions

Can someone hack Facebook with only my phone number?

A phone number alone should not grant access, but it can support impersonation, SIM-swap attempts or password-reset abuse. Protect your SIM, hide unnecessary profile details and use app-based 2FA or a security key where possible.

Is SMS two-factor authentication better than none?

Yes, it adds a layer, but an authenticator app or security key generally offers stronger protection against phone-number attacks.

Will Facebook support ask for my OTP?

No legitimate support process should require you to send a login code or password to another person. A code authorizes access; keep it private.

Last fact-checked: 20 August 2026. Facebook menu names can change; use Meta’s linked help pages for the latest path.