If Facebook tells you someone may have accessed your account, take it seriously, but verify it before you click anything. Meta does lock accounts and send login alerts after unusual activity, and scammers copy those alerts to steal passwords. Here is how to check the notice, get back in and shut the intruder out.
What the Alert Actually Means
Whether it reads “someone may have accessed your account,” “we noticed unusual activity” or “your account has been locked,” the warning rests on one of two Meta features:
- Login alerts. Meta emails you when someone tries to log in from a device or browser it doesn’t recognize. You can add text message alerts.
- A security lock. After unusual activity, Meta may lock the account and tell you by email or at your next login.
An alert isn’t always a break-in. Meta notes that phones often connect through IP addresses that don’t match your real location, and that private browsing stops it from remembering your browser.
Real Meta Notice or Phishing Fake?
Fake security emails borrow Meta’s logo, threaten to close your account and push you to “secure” it through a link. Check every notice this way:
- Don’t click anything in the message. Open the Facebook app, or type www.facebook.com yourself.
- Check Meta’s record. Go to facebook.com/recent_emails/security, or Settings & privacy, Settings, Accounts Center, Password and security, then Recent emails under Security checks. Security emails from the last year are listed there. If yours isn’t, treat it as fake.
- Check the sender. Meta says its email comes only from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, metamail.com or their subdomains. Watch for misspelled lookalikes.
- Report fakes to phish@fb.com (phish@instagram.com for Instagram) and to your email provider.
Instagram keeps the same Recent emails list for the last 14 days and says it never contacts you about security through Direct messages. Meta never asks for your password by email and has no general support phone number. More in how to spot fake account recovery services.
Quick reference: which message did you get?
| What you see | Genuine? | What to do |
|---|---|---|
| Email about a login from a new device | Possibly | Confirm it in Recent emails; if it wasn’t you, end that session |
| “Your account has been locked” inside Facebook | Yes | Select Get started |
| Email or text saying click now or lose your account | Usually fake | Don’t click; report to phish@fb.com |
| DM or call from “Meta Support” | Fake | Report it; never share codes |
| Instagram login request or “account at risk” screen in the app | Yes | Deny unknown logins and change your password |
Locked Out? Get Past the Security Checkpoint
If the alert came with a lock, the way back is inside Facebook. Our guide to recovering a Facebook account locked for suspicious activity covers every screen; Meta’s short version:
- Open the Facebook app, or type facebook.com into your browser.
- Log in and select Get started on the locked-account message.
- Follow the on-screen steps. Meta may ask you to confirm your identity, for example with a code sent to your phone or email.
- No code? Check spam and blocked texts. If you’ve requested several, Meta suggests waiting a day before trying again.
- Once in, go straight to the security steps below.
If you can’t get past it
If your password no longer works, Meta recommends facebook.com/hacked on a device you’ve logged in from before (instagram.com/hacked for Instagram). If your email was changed, Meta sends the old address a link that reverses the change. If both email and phone were replaced, read what to do when a hacker changed your Facebook email and password. If the identity check keeps failing, see Facebook ID verification stuck or rejected.
Secure the Account Once You’re Back In
End sessions you don’t recognize
In Accounts Center, open Password and security, then Where you’re logged in, and select your account. Each entry shows date, time, location and device. Use Select devices to log out, or Select all. On Instagram’s Login activity screen, This Wasn’t Me starts a password reset.
Change your password, then secure your email
Go to Accounts Center, Password and security, Change password. Meta limits resets per day, so pick a strong, unique password once. Then secure your inbox: Meta advises that only you should access the email and phone on your account, with an email password different from Facebook’s.
Turn on two-factor authentication
Under Password and security, select Two-factor authentication and choose a security key, an authentication app or text codes. Save the 10 single-use recovery codes offline; see our guide to two-factor authentication backup codes. Security Checkup also recommends login alerts.
Why It Happened, Even With 2FA On
- Phishing. A fake login page captured your password or a code.
- A reused password. Instagram flags accounts as at risk when a password may have leaked in another site’s breach, or when an unauthorized third-party app is connected.
- Malware and stolen sessions. Meta warns that malware, sometimes posing as browser extensions, is built to steal login information. Some grabs the session cookie that keeps you signed in, letting an attacker skip your password and code. Read how session cookie theft gets around 2FA.
Meta recommends scanning every device you use with trusted antivirus software and removing suspicious browser add-ons. Do it before changing your password, or the new one may be stolen too.
What Not to Do
- Don’t use “Secure your account” links in an email before checking Recent emails.
- Don’t share a login code with anyone, even a friend.
- Don’t pay “recovery hackers.” Only Meta can restore access.
- Don’t ignore the alert because you can still log in. Meta lets you report a compromised account while you still have access.
When to Get Professional Help
If the checkpoint sends codes to an address the attacker controls, your ID check fails, or business Pages depend on this login, a structured case helps. The AccRevert team reviews the case, organizes your ownership evidence and prepares a documented recovery request submitted through Meta’s official channels. Only Meta decides the outcome, so no result is promised, and we never ask for your password or login codes.
Pricing: a flat $299 case-preparation fee opens a case; a success fee of $599 for personal accounts, $999 for business accounts or $1,199 for Business Manager and ad accounts applies only if access is restored. Payment is by PayPal only. See our Hacked Account Recovery service.
Frequently Asked Questions
Is “someone may have accessed your account” a real Facebook message?
It can be. Meta sends login alerts and locks accounts after unusual activity, but scammers imitate both. A warning shown inside the app or on facebook.com after you log in is genuine. If it arrives by email, look for it under Recent emails in Accounts Center; if it isn’t there, treat it as phishing.
Why did Facebook lock my account if I did nothing wrong?
A security lock protects you; it isn’t a penalty. Meta may lock an account after unusual activity, such as a login it doesn’t recognize. You unlock it by selecting Get started, which may include confirming your identity. A suspension for breaking the rules is a separate process with its own appeal.
Does changing my password log the hacker out?
Instagram says a password update after an at-risk warning logs out all other devices. On Facebook, don’t rely on the change alone: open Where you’re logged in and end every session you don’t recognize. Then turn on two-factor authentication so a stolen password isn’t enough on its own.
Can I call Facebook about the alert?
No. Meta says it has no general public phone number for customer service and that numbers claiming to be Meta support may be scams. Use the on-screen steps, facebook.com/hacked or the Help Center instead. Meta Verified subscribers get email and chat support from Meta.
Final Checklist
- Confirm the alert under Recent emails, without clicking its links.
- Unlock through Get started inside Facebook.
- End every session you don’t recognize.
- Change your Facebook and email passwords.
- Turn on two-factor authentication and save recovery codes.
- Scan devices and remove unknown browser extensions.
Still locked out after the alert? Open your recovery case with AccRevert: a flat $299 case-preparation fee starts the work, and the success fee ($599 personal, $999 business, $1,199 Business Manager or ad account) applies only if access is restored.
Related Articles
Stop guessing and document the case properly.
Our team can review the account history, available ownership evidence and the recovery steps already attempted.
Copyright Violation Scam on Instagram and Facebook: How to Spot It
Meta Verified Account Recovery: What Support Can and Can’t Do
