Few messages are as alarming as a notice that your Facebook email address was changed when you did not change it. It means someone has your password, and they are trying to lock you out for good by moving the account to an email they control. The window to undo it is usually short, so this guide focuses on doing things in the right order: reverse the change, recover the account if the password was also changed, and close every door the attacker used.
Step 1: Find the Security Email Facebook Sent You
When the email address or password on an account changes, Facebook sends a notice to the previous email address. It typically comes from security@facebookmail.com and includes an option to secure the account if you did not make the change.
- Search your inbox, spam, promotions and archive folders for messages from facebookmail.com.
- Check that the sender address ends in facebookmail.com before you click anything.
- Use the secure link as soon as possible; it is designed for quick action and may not work indefinitely.
The link usually lets you reverse the email change, set a new password and log the attacker out. If it works, skip to Step 4.
Step 2: Use facebook.com/hacked
If you cannot find the email or the link no longer works, go to facebook.com/hacked from a device you normally use for Facebook. Select the option that someone else got into your account, and follow the prompts. Facebook may let you log in with your old password, send a code to a phone number still on the account, or move you to an identity check.
Step 3: When You Have No Access to the New Email or Phone
If the attacker replaced both the email and the phone number and enabled their own two-factor authentication, look for options such as no longer having access to these methods, or trying another way, in the login and recovery screens. They lead to identity confirmation, which may include:
- Uploading a photo of a government ID that matches the name on the profile.
- Recording a short video selfie that Facebook compares with photos on the account.
- Entering a new email address you control, where Facebook will contact you.
Use an email address that has never been linked to another Facebook account, and complete the check only once with accurate details. Our guides on recovering Facebook without email or phone and ID verification delays go deeper.
Step 4: Lock the Attacker Out Completely
Once you are back in, do this immediately, in this order:
- Change the password to one you have never used anywhere else.
- Log out of all sessions: in Accounts Center, open Password and security, then the list of places you are logged in, and log out of every device you do not recognize.
- Remove the attacker’s contact info from Personal details: unknown emails and phone numbers.
- Reset two-factor authentication and set it up with your own authenticator app. Save new recovery codes offline.
- Check linked accounts: Instagram and other profiles in the same Accounts Center may also have been changed.
- Review Pages, ad accounts and payment methods: attackers often add themselves as admins or run ads on your card.
- Secure your email account with a new password and two-step verification. If the attacker reached your inbox, they can repeat the takeover.
How the Attacker Got In
Email-and-password changes rarely happen out of nowhere. The most common causes are:
- Phishing: fake copyright-violation or Page-will-be-disabled messages that lead to a fake login page.
- Reused passwords: a password from another site that leaked in a data breach.
- Session theft: malware or browser extensions that steal login cookies, which can bypass two-factor codes. See how session cookie theft works.
- SIM swaps: the attacker takes over your phone number to receive codes.
Fix the cause, not just the symptom: scan your computer, remove unknown browser extensions and stop reusing passwords.
Recovery Timeline
| Situation | Typical outcome |
|---|---|
| Reversal link used quickly | Back in within minutes |
| facebook.com/hacked with your phone still on the account | Usually the same day |
| Identity confirmation required | A few days to several weeks |
| Attacker added their own 2FA and contact info | Longer; needs strong ownership proof |
How AccRevert Helps
When the reversal link has expired and identity checks keep failing, AccRevert prepares a structured ownership case and guides each submission through Meta’s official channels. We never ask for your password, codes or ID; you upload documents only to Meta. You start with a flat $299 case-preparation fee. The success fee is $599 for personal accounts, $999 for business accounts and $1,199 for Business Manager and ad accounts, and it is due only if access is restored. See our Facebook recovery service.
Frequently Asked Questions
Can I undo a Facebook email change I did not make?
Usually yes, if you act quickly. Use the secure link in the notice Facebook sent to your previous email address, then change your password and log out of other sessions.
What if I deleted the Facebook security email?
Check your trash and archive folders first. If it is gone, use facebook.com/hacked from a device you normally use with Facebook.
The hacker turned on two-factor authentication. Can I still recover?
Often yes, through identity confirmation such as an ID upload or a video selfie. It takes longer, and the details you provide must match the profile.
Will my friends see the hacker’s posts?
Possibly. After recovery, review your activity log, delete anything the attacker posted or sent, and tell friends to ignore messages from the takeover period.
Final Checklist
- Use the reversal link in the security email right away.
- Fall back to facebook.com/hacked from your usual device.
- Complete identity confirmation once, with matching details.
- Log out all sessions, reset 2FA and remove unknown contact info.
- Check Pages, ads, payments and linked Instagram accounts.
Reversal link expired? Open your recovery case with AccRevert: a flat $299 fee starts the work, and the success fee applies only if access is restored.
Related Articles
Stop guessing and document the case properly.
Our team can review the account history, available ownership evidence and the recovery steps already attempted.
Facebook Decision Is Final? What You Can Still Do
Hacker Ran Ads on My Facebook Account? How to Stop the Charges
