An Accounts Center hacked by a stranger is one of the quietest ways to lose Instagram or Facebook: the attacker links their own account to yours, and Meta lets accounts in the same Accounts Center log into each other. That is why a new password often fails. The fix is to remove the unknown account, end every session, then lock down your email and two-factor authentication.
Why a Linked Account Keeps the Hacker In
Meta’s help pages say that starting early 2026, accounts in the same Accounts Center can log into each other by default, and that the way to remove an account’s login access is to move it out. Passwords, however, are set per account. So while a hacker’s account sits beside yours, changing your password does not touch their route in, whether they added their account to yours or pulled yours into theirs.
Many of these takeovers start with a stolen login session: an attacker already signed in as you may not need your password or a 2FA code. Our guide to session cookie theft and how attackers get past 2FA explains how.
Signs a Stranger’s Account Is Linked to Yours
- An unknown account under Accounts. Meta allows only one Facebook account per Accounts Center, so a stranger’s Facebook account there means yours is not in it.
- Cross-posting you didn’t set up. Your posts or stories appear on a profile you don’t own, or theirs appear on yours.
- A profile picture that changes by itself, through profile picture sync.
- Unfamiliar devices. Where you’re logged in covers every account in that Accounts Center.
- Reset messages going elsewhere. A password reset shows an email or phone you don’t recognize. Instagram says its emails come only from @mail.instagram.com.
How to Remove an Unknown Account From Accounts Center
Instagram’s checklist for hacked accounts says to check Accounts Center and remove any linked accounts you don’t recognize. Use a device where you are still logged in.
- On Instagram, tap Profile or your profile picture, then Menu in the top right. On Facebook, tap Menu, then Settings & privacy, then Settings.
- Tap Accounts Center.
- Tap Accounts or Manage accounts.
- Tap Remove next to the account you don’t recognize and follow the prompts to confirm.
- Check that only your own accounts remain.
What happens after you remove it
- The account is not deleted; Meta says it moves into its own Accounts Center, along with any profiles tied to it.
- Connected experiences stop, including logging in between the accounts and profile picture sync, because Meta only allows them within one Accounts Center.
- Shared settings such as birthday and some ad preferences stay as they were while linked. Meta says they don’t revert.
- If your Instagram was created with that Facebook account, Meta will prompt you to create an Instagram password.
Lock Them Out: Sessions, Password, Email and 2FA
Do these in one sitting so the attacker can’t link back in.
- Secure your email first. Whoever controls that inbox can reset your Meta passwords.
- Log out unknown sessions. In Accounts Center, open Password and security, then Where you’re logged in. Pick an account, tap Select devices to log out, choose the devices and tap Log out.
- Change your password. In Password and security, tap Change password, pick the account, enter the current and new passwords, then tap Change password. Repeat for each account you own.
- Check Personal details and make sure every email and phone number is yours.
- Turn on two-factor authentication. Password and security, Two-factor authentication, select the account, choose a method. Instagram recommends an authentication app.
- Get new backup codes. Two-factor authentication, the account, Additional methods, Backup codes, Get new codes. This cancels the old set. See our guide to two-factor authentication backup codes.
- Revoke unknown third-party apps, and on Facebook run Security Checkup from Password and security.
If the Hacker Removed You or You’re Locked Out
- If an email from security@mail.instagram.com says your email changed, Instagram says selecting secure my account in it may undo the change.
- On the login screen, tap Forgot password? and request a login link to an email or phone you still control.
- If none of your details work, go to instagram.com/hacked or facebook.com/hacked. For an Instagram account with photos of you, Meta may ask for a video selfie, which it says is deleted within 30 days.
See how to recover a hacked Instagram account, Instagram hacked with the email and password changed, or locked out by Facebook two-factor authentication. Once you’re back in, run the removal steps right away.
| Situation | What to do | Where to start |
|---|---|---|
| Unknown account linked, you can still log in | Remove it, then log out sessions | Accounts Center → Accounts |
| Posts sharing to a profile you don’t own | Remove the account, review sharing | Connected experiences → Sharing across profiles |
| Unknown device signed in | Log it out, change your password | Password and security → Where you’re logged in |
| Locked out, email and phone changed | Follow Meta’s hacked-account flow | instagram.com/hacked or facebook.com/hacked |
| Professional Instagram, hacker still active | Check People for unknown business managers; Meta says switching to personal removes them | Meta Business Suite → Business Settings |
Common Mistakes to Avoid
- Changing only your password while the linked account stays.
- Removing the account but leaving the attacker’s sessions active.
- Tapping links in “security” emails instead of opening the app yourself.
- Tapping Trust this device on a shared or public device; Instagram warns against it.
- Paying “recovery hackers” or sharing your password, login codes or screen with anyone.
When to Get Professional Help
If the attacker replaced your email and phone, or Meta’s identity check keeps failing, a documented case can help. AccRevert reviews the case, organizes your ownership evidence and prepares a documented request submitted through Meta’s official channels. Only Meta decides the outcome, so no result is promised, and we never ask for your password or login codes.
Pricing: a flat $299 case-preparation fee opens a case; a success fee of $599 for personal accounts, $999 for business accounts or $1,199 for Business Manager and ad accounts applies only if access is restored. Payment is by PayPal only. See our Hacked Account Recovery service.
Frequently Asked Questions
Why does the hacker get back in after I change my password?
Meta says accounts in the same Accounts Center can log into each other by default, while each account keeps its own password. If the attacker’s account is still linked, your new password does not block their route in. Remove their account first, then log out unknown sessions.
How do I remove an account from Accounts Center that isn’t mine?
If it appears in your Accounts Center, use Meta’s standard steps: open Accounts Center, tap Accounts or Manage accounts, then tap Remove next to it. Meta says a removed account moves into its own Accounts Center. If you can’t log in to see the list, recover your own account first.
What happens to my Facebook and Instagram profiles when an account is removed?
Meta says profiles associated with the removed account leave the Accounts Center with it. Connected experiences between the accounts, including logging in and profile picture sync, stop. Shared settings changed while they were linked, such as birthday and some ad preferences, stay as they are until you change them.
Does two-factor authentication stop a hacker who is already linked?
Not reliably. Meta says two-factor authentication asks for a code when someone tries to log in from a device it doesn’t recognize. An attacker with an active session is past that point. Remove the linked account and log out unfamiliar devices first, then turn on 2FA.
Is a password reset email from Instagram proof that I was hacked?
No. Instagram says an unrequested reset email can come from someone mistyping their own details, and only people who know your password or click the link in that email can log in. Real Instagram emails come only from @mail.instagram.com. Open the app and check Accounts Center instead of clicking.
Final Checklist
- Only your own accounts are listed in Accounts Center.
- Unknown devices are logged out.
- Your email has a new password and two-step verification.
- Each of your accounts has a new, unique password.
- Two-factor authentication is on, with new backup codes saved offline.
- Every email and phone under Personal details is yours.
Hacker still linked to your account? Open your recovery case with AccRevert: a flat $299 case-preparation fee starts the work, and the success fee ($599 personal, $999 business, $1,199 Business Manager or ad account) applies only if access is restored.
Related Articles
Stop guessing and document the case properly.
Our team can review the account history, available ownership evidence and the recovery steps already attempted.
How to Report an Impersonation Account on Instagram or TikTok
Instagram Disabled After a Hack? How to Get Your Account Back
