Symptoms
- Posts or stories appear that you didn't create
- Friends receive messages or links from your account you didn't send
- Profile information changed without your input
- Login alert from an unfamiliar device or location
Likely causes
- CommonPassword compromised through reuse or phishingA password reused elsewhere or entered on a fake login page can be captured and used here.
- CommonMalicious third-party app connected to the accountAn app granted access during a quiz, game, or promotion can post on your behalf.
- Less commonSession hijacking via saved browser cookies on a shared deviceStaying logged in on a public or shared computer can let someone else use your session.
What to do
- Change the account password immediately, using a strong unique password.
- Log out of all sessions and devices from the account's security settings.
- Check connected third-party apps and remove anything unfamiliar or unused.
- Turn on two-factor authentication if it isn't already enabled.
- Delete or report any posts and messages you didn't send.
- Warn contacts who may have received suspicious links not to click them.
- Review the account's recovery email and phone number for unauthorized changes.
When to call a pro
If you can't regain access at all, use the platform's official hacked-account recovery form, which may take a few days to process.
Safety
Generally low risk
Generally low risk for a careful person. Stop if anything looks different from what this guide describes.