Facebook Hacked? How to Recover Your Account — Even From Abroad

Why a Facebook hack is worse when you're travelling

At home, recovering a hacked Facebook account is annoying. On the road it can derail a whole trip. Your Facebook login is often the key to Messenger, your business Page, Marketplace, and "Log in with Facebook" on dozens of other apps. And the very recovery tools you'd reach for — an SMS code, a confirmation call — go to a home phone number that has no signal because you're on a local SIM or eSIM with roaming off. Meanwhile the attacker is messaging your friends and family in your name, often with a crypto or "I'm stuck, can you help me" scam.

This is one of the most stressful situations we help expats and digital nomads with, so the steps below are written for someone recovering an account from a different country, on hotel or café WiFi, in the wrong time zone.

Signs your account was taken over

• You're logged out and your password no longer works.
• An email from Meta says your email address, password, or name was changed.
• Posts, friend requests, or Messenger messages you didn't send appear on your account.
• Friends report scam messages (crypto, "help me", fake Marketplace deals) coming from you.
• Unknown ad spend appears if a card is attached to an ad account.

Recover it step by step

Work through these in order, and resist the urge to hammer the login — repeated failures can harden the lock.

1. Start at facebook.com/hacked

Choose "My Account Is Compromised." Facebook tries to identify your account and offers the recovery options available to you. Do this from a device and browser you've used to log in before — it improves your odds.

2. If your email was changed, use Meta's alert email

When an attacker changes your address, Meta emails your old address: "If you didn't make this change…". Click the secure-your-account / reverse-this-change link right away. This is frequently the single fastest way back in — act before the attacker locks everything down.

3. Reset through facebook.com/login/identify

Find your account by phone, email, or name and reset the password. If the attacker changed your contact details, choose "No longer have access to these?" to move on to identity verification.

4. Verify with government ID if prompted

When other methods fail, Facebook may ask for a photo of an official ID matching the profile name. Review takes a few hours to a few days, so start it early rather than retrying.

5. Once you're back in, lock it down

• Change to a strong, unique password you don't use anywhere else.
• Log out all sessions: Settings & privacy → Security and login → Where you're logged in → Log out of all.
• Restore your own email and phone; remove any the attacker added.
• Revoke unknown third-party apps under Settings → Apps and websites.
• Check your posts, Messenger, and Marketplace, and warn your contacts.

The abroad problem: the code you can never receive

The most common travel lockout has nothing to do with the hack itself — it's that Facebook wants to text a code to a home number with no roaming signal. Fix the second factor so it works anywhere:

1. Switch to an authenticator app (Google Authenticator, Authy, or your password manager's TOTP). Codes generate on your device with no signal needed — the single best change you can make.
2. Save offline backup codes for Facebook and your email, stored where you can reach them without the account.
3. Keep a reachable second factor — a recovery email you can open, or a security key.
4. Keep your home SIM reachable via brief roaming, dual-SIM, or call forwarding for the first day.

Email is the keystone — if you lose it too, reset links for everything else stop working. Our email & Microsoft 365 team restores access to accounts that locked mid-trip and re-arms them with travel-proof 2FA.

Pages & business accounts

If a Page or ad account is hit, recover the personal admin account first, then:

• Open Meta Business Suite / Business Manager and review admin roles — remove anyone you don't recognise.
• Check payment methods and pause any fraudulent ad campaigns immediately.
• If you've lost admin access to a Page, use Meta's Page recovery flow with proof of identity or business ownership.
• Tell your customers through another channel that scam messages may have gone out in your name.

Lock it down before you fly (10 minutes)

• Switch SMS 2FA to an authenticator app on Facebook and your email.
• Download and store offline backup codes.
• Turn on login alerts so a new-device login pings you instantly.
• Confirm your recovery email isn't tied only to a device you might lose.
• Use a password manager so a breach elsewhere never exposes Facebook.

We give this checklist to every remote worker we set up — ten minutes before departure prevents the worst tech emergency of a trip.

Real example: a Facebook takeover mid-trip

Here is a composite of cases we handle for travelers. You land in a new country, connect to café WiFi, and tap a link in a DM from a "brand" offering a collaboration — or an email warning your Page will be deleted. It opens a convincing Facebook login page; you enter your details. Minutes later you're logged out, your email and password are changed, and friends back home start getting "I'm stuck abroad, can you send money?" messages in your name. The cruel part: the recovery code Facebook wants to text you goes to your home SIM, which has no signal on your travel eSIM.

The escape route is the same one above, in order: open your email first (not the Facebook login) to catch Meta's "your email was changed" reversal link; if it's gone, run facebook.com/login/identify on a home-country VPN; and lean on authenticator-app or backup codes instead of SMS. Travelers who set up an authenticator app before leaving recover in minutes; those relying on SMS to a dead home number are the ones who lose days.

Recovering Messenger and "Login with Facebook" apps

Your Facebook login is often the master key to other services, which matters even more when you're working remotely:

• Messenger returns with the account — check for scam threads the attacker sent and warn those contacts.
• "Login with Facebook" apps (Spotify, shopping, games, sometimes Instagram): go to Settings → Apps and websites and remove anything you don't recognise. An attacker can hop from Facebook into these.
• Linked Instagram via Meta Accounts Center — confirm it wasn't hijacked at the same time, a common combo for creators on the road.

Fraudulent ad spend while you're away

If a card is attached to an ad account, attackers can burn thousands on ads within hours — and a different time zone means you notice late. The moment you're back in: pause every active campaign in Ads Manager, remove the payment method, contact your bank to dispute the charges and freeze the card, and report the fraud to Meta through Business Manager (Meta sometimes refunds documented fraudulent spend). This is one of the most expensive ways a travel hack goes wrong, so check ad accounts early.

Protect business Pages before you travel

If you run a Page from the road, harden governance before departure: keep two or more admins so a single locked account can't orphan the Page, require authenticator 2FA on every admin's personal account, and review roles to remove old staff. A Page is almost always hijacked by first compromising an admin's personal login — so the personal accounts are what you protect.