How to Recover Your Facebook Account: Password, Email, Bans and Hacks

If you've simply forgotten your password, open the login page and click the recovery link: give your email, phone number or profile name, get a code and set a new password. A deactivated account comes back even more easily — just log in with your credentials. The harder cases — a lost email, a ban or a hack — go through Meta's support forms.

Below is each scenario, and what to realistically expect from those requests.

Identify the problem first

• The password fails but codes arrive. A standard recovery.
• No access to the email or phone. You'll need to add a new contact and confirm your identity.
• It asks for a two-factor code. You need backup codes or a fallback method.
• A temporary restriction message. The account is limited, usually after suspicious activity.
• A policy violation message. The profile is disabled, and the only route is an appeal.
• You can log in but the details have changed. The account has most likely been hacked.

Resetting the password

1. On the login screen, click the forgotten password link.
2. Enter the email, phone number, or the first and last name on the profile.
3. Choose how to receive the code — email or SMS.
4. Enter the code and set a new password.
5. When asked whether to log out of other sessions, do so if you suspect a hack.

No email arriving? Check spam and the Promotions tab, make sure you're looking in the mailbox actually linked to the profile, and wait a few minutes before requesting again.

If you've lost the email and phone

The recovery page has an option for people who no longer have their old contact details. It lets you supply a new address or number, after which Meta asks you to confirm your identity.

What's worth preparing:

• an ID whose name and date of birth match the profile;
• details only the owner would know: roughly when you registered, friends' names, the pages you managed;
• the device and browser you normally used — a familiar setup triggers fewer extra checks.

There are no guarantees: the decision is made by automation and moderators, and review times aren't fixed.

If two-factor authentication is enabled

• Backup codes. Issued when you set the protection up; one replaces a regular code.
• An authenticator app. If it's installed on another device, take the codes from there.
• A trusted device. Signing in from a browser you previously marked as remembered sometimes skips the code.
• A support request. With none of the above, the recovery form with identity confirmation is what remains.

Once you're back in, set the protection up again and store the new backup codes offline — not in a chat and not in the notes app on a phone tied to the same account.

If the account is deactivated or deleted

These are two different states. Deactivation is a temporary pause: the profile is hidden from others but the data is kept. Logging in with your credentials restores everything.

Deletion starts a delayed process. You have roughly a month to change your mind: logging in during that window cancels it. Once the period ends, the data is erased and the profile can't be brought back.

If the account was hacked

1. Try a standard password reset — that logs the intruder out.
2. Check your mailbox: attackers usually change the linked address first, and the notification goes to the old one.
3. Use the link in that email to reverse the change.
4. Open the security section and end any unfamiliar sessions.
5. Remove suspicious apps and services that have access to the profile.
6. Check whether the name, photo and login details have been altered.
7. Warn your friends: hacked profiles are used to send scam links and money requests.

If you can't regain access, use the dedicated form for compromised accounts in the help centre — it follows its own verification path.

If the account was disabled for a violation

With a ban, the system usually states the reason and offers an appeal link. In the form, give your real name, the linked email and a brief account of the situation: what happened and why the decision looks wrong to you.

A few practical points: file one appeal and wait for a reply, and don't create parallel profiles — that's a violation in itself and it hurts your chances. Attach an ID only if the form explicitly asks for one.

Recovery through the Accounts Center

If your profile is linked with Instagram in Meta's shared Accounts Center, access can sometimes be regained through the connected service: signing in to Instagram confirms your identity and opens up profile management.

Check this first — it's faster than any support request, but it only works if the link was set up in advance.

If recovery doesn't work

When the email is gone, there's no ID and appeals lead nowhere, the account stays out of reach. It's more practical to switch to rebuilding your surroundings: ask admins to add you back to work groups, restore contacts through mutual friends, and regain page access through other admins — if a business page had a second manager, it isn't lost.

If it isn't a rules-related ban but genuinely irretrievable access, some people start over: registering a new profile, or picking up Facebook accounts to get back to working with communities and ad accounts sooner.

How to protect the account afterwards

• Enable two-factor authentication through an authenticator app, not by SMS alone.
• Keep the backup codes somewhere safe and offline.
• Add a backup email address and a current phone number.
• Review the list of apps with profile access and remove anything unnecessary.
• Turn on alerts for logins from new devices.
• Use a unique password and never enter it on sites imitating the network's interface.

Common mistakes

• Creating a new profile instead of appealing. Duplicates break the rules and get in the way of the review.
• Filing dozens of requests in a row. That slows processing down rather than speeding it up.
• Ignoring the email-change notification. It contains a reversal link that's only valid for a limited time.
• Storing backup codes inside Facebook. Once you're locked out, they're useless.
• Hiring "unblocking specialists". Most are scammers, and handing them your data usually ends in losing the profile for good.

FAQ

How long does recovery take?

A password reset takes minutes. Identity checks and appeals take longer, and Meta doesn't publish exact timeframes.

Can a deleted account be brought back?

Yes, if you log in within the grace period after requesting deletion. After that the data is erased for good.

What if the attacker changed the email and phone?

Use the compromised-account form and identity confirmation with an ID — standard recovery isn't available in that case.

Will my photos and friends survive?

If you get the same profile back, yes. A new account starts from scratch and the old history can't be moved into it.

Is an ID always required?

No. It's requested when no other way to prove ownership remains.

What happens to a business page if the profile is lost?

The page continues to exist. Other admins keep control, which is why a second admin is a basic precaution.

Can I get support through Meta's other social networks?

Official requests go through the help centre and its forms. Messages from third-party accounts and messengers are a common scam tactic.

Does recovery affect the ad account?

Regaining profile access usually preserves your ad account permissions, though a ban for violations can bring separate restrictions.

In short

In straightforward cases Facebook access comes back with a password reset, and a deactivated profile revives on an ordinary login. A lost email, 2FA without backup codes, a hack or a ban all require requests and identity confirmation, where the details matter: your real name, linked contacts and a familiar device. Once you're back in, set up two-factor protection, store the backup codes offline, and add a second admin to any page that matters.