Facebook account hacked: what to do and how to prove what was posted in your name

What to do right away when your Facebook account is hacked

Recovery comes first, and documenting the account should never delay it.

Recovering it through Meta’s procedures

Use a device you trust and follow the steps at facebook.com/hacked and in Meta’s Help Center article on hacked accounts. Once you are back in, work through the UK National Cyber Security Centre’s guidance on recovering a hacked account: change your password, log out of all devices, turn on two-step verification, check your email for forwarding rules you never set and update your devices. Check your bank accounts and statements, and call your bank if a payment card was saved.

Once the account is secure, before you delete a post or message or undo a change the hacker made, certify it if it is still visible and you can do so safely, without holding up the recovery. If money is at stake or your contacts are at risk, do not wait: secure the account and warn people first. Whatever you have already preserved stays useful.

Warning your contacts

Call or text your friends and ask them not to pay or click links sent from your profile. A friend who received a money request can help too, if they agree, by recording only that conversation from their own phone, with screen recording in the TrueScreen App while scrolling through the chat. If someone already paid, see our insight on evidence after a hacked account asks for money.

Why document a hacked Facebook account once it is secure

A post or money request sent from your profile carries your name and photo, so anyone who saw it, or lost money, may connect it to you. Documenting what the hacker did can help show what appeared on your profile, and a lawyer can tell you whether you need to worry about the consequences of those posts.

Posts, messages and money requests sent in your name

Once the account is secure, capture the posts and messages you did not write, the comments under them and changes to your name, email or phone number. A possible case: overnight your profile asks friends for an urgent loan; the next day you secure the account and, while the post is still visible, capture it, its comments and the sent conversations before deleting anything.

Meta’s law enforcement guidelines state that it does not retain data for law enforcement purposes unless it receives a valid preservation request before a user has deleted that content. Content is best documented while it is online: once removed, it can no longer be acquired and certified, though other evidence may still help.

Unauthorized access and reporting it

Internationally, the Council of Europe’s Budapest Convention on Cybercrime asks the states that have joined it to criminalize illegal access to computer systems, among other offenses.

Report what happened to the police or the competent authority. You can file a report without evidence, but a verifiable record makes it easier to assess. Some offenses have short deadlines, so talk to a lawyer early. See also our insight on evidence of unauthorized account access.

How TrueScreen certifies the evidence of a hacked account

TrueScreen, the Data Authenticity Platform, certifies the posts, comments and Messenger conversations of a hacked account through a forensic acquisition. Content is captured in a controlled environment, verified and described in a technical report, and the certification carries a qualified electronic seal and qualified timestamp, recognized internationally. The certification shows how and when content appeared on your profile, not who wrote it: identifying the hacker is a job for investigators. TrueScreen does not recover accounts or access anyone else’s account.

1. 1

   Capture the hacker’s posts before you delete them

   Once the account is secure, if a post is still on your profile and you can do this without delaying the recovery, capture it before deleting it. The Browser Extension for Chrome and Edge takes a screenshot of the visible area or full page, or a video of the tab, in the session you already have open; the Forensic Browser suits a capture that may be challenged.

2. 2

   Record the account with the Login inside the capture session

   When content shows only after Login, do the Login inside the acquisition session: a full recording in the Forensic Browser on a computer, or the Web Browsing Acquisition in the TrueScreen App on a phone. Then go through the posts, the Messenger conversations sent in your name and the changed settings. Keep passwords, verification codes and recovery codes off the screen. Messenger conversations show other people’s names and messages. Open only the conversations that matter and share the package only with your lawyer or the police.

3. 3

   Certify alert emails and existing files, then hand over the package

   Meta’s security emails, such as an alert that your password was changed, can also be certified by forwarding them to your workspace’s dedicated Mail Certification address; certification starts when TrueScreen receives each email. TrueScreen certifies only emails from an enabled sender, so enable the address you forward from. Fake security emails are common after a hack, so forward only messages you recognize as genuine. Use any security link or code in the email first, and do not post or share the certified email beyond your lawyer or the police. Earlier screenshots can be certified as files: certification dates them from that moment; it does not show when they were created. Give the package to your lawyer or the police rather than posting it on social media; anyone can verify it independently of TrueScreen, for example on the public verifier.

Conclusion