All notesField note 09

Instagram or Facebook hacked: what Meta's recovery actually needs.

The email and the phone number were changed, and the form goes in circles. What Meta checks, where to start, and what to gather before you try again.

4 min readUpdated 17 September 2026

Meta receives more recovery requests than any other platform, and it decides most of them by machine. The requests that succeed are the ones that give the machine what it is looking for. Here is what that is.

Start here, and only here

  1. Go to instagram.com/hacked or facebook.com/hacked, from a phone or computer you normally use, on your usual network. Device and location history are part of the check.
  2. Search your email for messages from Instagram or Facebook about a changed email or phone number. Each one carries a link to revert the change, and it stays valid for a while. This is the fastest door, and people miss it.
  3. If the app still opens, go to Settings, then Accounts Centre, then Password and security, and sign out of every device you do not recognise.

What Meta checks

  • The devices and locations the account was used from before the takeover. Your own phone, on your own network, matches. A new device in another country does not.
  • The original email address or phone number, even if it has since been changed.
  • A short video selfie, for accounts with your face in the photos. It is compared with the account, not stored as an ID.
  • Identity documents, for verified accounts, business accounts, and accounts without a face.
  • Receipts, for anything bought through the account: advertising, subscriptions, verification.

Gather before you try again

  • The exact handle, and the original email and phone number the account was created with.
  • The oldest security emails from Meta you can find, with their dates.
  • Receipts from your bank or your app store for anything the account paid for.
  • Two or three photographs of yourself that also appear on the account, with their originals.

If someone is posting from it

Ask a friend to report the account from their own profile as hacked, so it is frozen while the recovery runs. Tell the people close to you not to click links or send money, because the first thing a stolen account does is write to them. Do not create a replacement account under the same name yet; it confuses the review.

Disabled, not hacked

If Meta disabled the account, the question changes: it is an appeal, not a recovery. Appeal once, from inside the app or from the email that told you, on the right grounds, with the right evidence. Repeated appeals slow it down.

Send me the handle, the original email, and whatever you have found, and I tell you within a day whether the case will hold and which door it goes through.

Other notes

03Contact

Then tell me how to reach you.

One line is enough. I will ask for the rest when I have read it.

Reply within 24 hours. Messages are treated as confidential from the first word.

These are my only channels. Anyone else claiming to be KLAY is not me. Is this really KLAY?

Writing for someone else? Read this first.

  • Practising since 2013
  • Licensed freelance practitioner, Kingdom of Saudi Arabia
  • Arabic and English
  • One person on every case
Reply to

Nothing else is required. I will ask for the rest when I have read it.

Add a name, or anything you want to say

    Optional. Up to three files, 20 MB each. Screenshots, saved copies, documents.

    This form posts to klay.run and reaches me directly. No third-party form service holds your details. How your case is kept.