Use a password you have never used anywhere else
Long, unique and stored in a password manager. A password reused across sites is the single most common way a Meta account falls.
Trust and safety
Security
guide.
Why this matters
Nearly every account we recover was lost to something avoidable — a password reused from another site, an SMS code intercepted, a login page that only looked like Meta. Below is the exact advice we give every client after their case is closed, so it does not happen to them twice.
Protective measures
Lock it down
before it happens.
Turn on two-factor authentication
Use an authenticator app rather than SMS. Text codes can be intercepted, and a SIM swap takes the number with it.
Keep your backup codes offline
Print them or store them in an encrypted note away from the phone. Losing the only device holding your 2FA codes is what locks most people out.
Review logged-in devices and sessions
Check your security and login settings monthly and end any session you do not recognise. Old sessions on borrowed or sold devices count.
Lock down the recovery email and phone
Your recovery route is the real front door. Secure that mailbox with its own 2FA, and remove phone numbers you no longer use.
Treat every login link as suspect
Check the address before you type a password. Meta never asks for your password, or your codes, in a direct message.
Clear out connected apps and games
Every connected app holds a token to your account. Revoke anything you no longer use, and anything you do not recognise.
Keep Business Manager access tight
Give the smallest role that does the job, require 2FA for every admin, and remove former staff and ex-partners the day they leave.
Already compromised
Locked out
right now?
Step 1
Secure the recovery email first
Change that mailbox password and turn on its 2FA before anything else. Whoever controls the recovery email controls the account.
Step 2
Change your Meta password from a clean device
Use a computer or phone you trust, not the one you suspect. Pick a password you have never used anywhere else.
Step 3
End every active session
Sign out of all sessions so the intruder loses access immediately, then check which devices are still listed.
Step 4
Rebuild two-factor authentication
Turn 2FA back on with an authenticator app and save a fresh set of backup codes somewhere offline.
Step 5
Strip out anything you do not recognise
Check the email addresses, phone numbers and connected apps on the account, and remove every one that is not yours.
Step 6
Report it and keep the evidence
Report the compromise inside Meta, warn your contacts about messages sent from your name, and keep screenshots, dates and any emails from Meta.
Already lost access?
Everything above you can do yourself, for free. If the account is already gone, or you keep hitting a verification loop that goes nowhere, send us the details and we will tell you plainly what is recoverable.