Recommended Free Tools
If you clicked a suspicious link or entered your Facebook or Instagram password on a fake page, stop interacting with that message and secure any exposed accounts through Meta’s official recovery routes. If you can still log in, change the affected password from a trusted device, check your contact details, and review security settings. If you are locked out, recovery depends on Meta’s checks and whether you can access the email address or phone number tied to the account; restoration is not guaranteed.
First, contain the phishing attempt
- Stop clicking links, replying, or downloading attachments from the suspicious message. Meta advises verifying both the sender and the content before opening links or files. A logo or urgent wording alone does not prove a message is genuine.
- Use a trusted route to reach Facebook or Instagram: open the app or type the service’s address yourself. Do not use the link in the message to change your password or sign in.
- If you entered a password, change it as soon as possible from a device and connection you trust. If you reused that password elsewhere, change it on those accounts too, using a different password for each.
- If you downloaded or opened a file, avoid entering more passwords on that device until you have checked it for malicious software. Meta’s account-security guidance notes that malware can be designed to steal login information.
Meta’s phishing advice is available in its Advanced Protection guidance.
As an Amazon Associate I earn from qualifying purchases.
Recover or secure Facebook
If you are locked out
Go directly to facebook.com/hacked, preferably on a device you have used to log in to Facebook before. Follow the recovery checks shown for your account. Meta’s process may vary, and using it does not guarantee that access will be restored.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIf you can still log in
Change your Facebook password to a fresh, unique one. Then check the email addresses and phone numbers on the account; remove details you do not recognize and make sure you can access the remaining recovery methods. Review the account’s security features and recent activity using the options available in your current app or browser. Meta documents login alerts and two-factor authentication as account-security features, but interface labels and paths can change.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Meta’s overview of Facebook account security and its Facebook account recovery guidance describe these protections and recovery checks.
Recover or secure Instagram
If you are locked out
Start with Instagram’s password-help flow from the login screen, or use its account-protection route. Follow the prompts for your situation, such as a forgotten password or a changed account email. The steps available depend on the account and the verification information Instagram can confirm.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If your registered email or phone is unavailable
Try to regain access to the email account or phone number associated with Instagram through that provider. Meta’s Instagram guidance says this can be necessary for recovery; Meta cannot recover an unrelated email account for you. If you can still log in to Instagram, update the account’s contact information to an email address or number you control securely.
There is an important limit: Meta says that if you cannot access the registered email and did not link Instagram and Facebook, it may not be able to provide access through the described recovery route. Do not assume that linking the accounts after losing access will bypass verification.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you can still log in
Change your Instagram password to a unique one, confirm the email and phone listed on the account, and review available security settings. Meta’s Instagram password recovery guidance and contact-information recovery guidance explain the available routes.
Check both accounts and any shared access
Treat Facebook and Instagram as potentially affected if you reused a password, shared a recovery email or phone, or enabled connected login features. Secure each account separately with its own password and check each account’s contact details; one account’s recovery information does not automatically verify the other.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Accounts Center can manage connected experiences and information across Facebook and Instagram when those accounts have been added. Check it in the app or account settings you can access, and review which accounts are actually connected. Its presence does not mean the accounts share recovery details or that both are linked. See Meta’s Accounts Center information.
After you regain access, strengthen account security
- Set distinct passwords. Use a different, hard-to-guess password for Facebook and Instagram, and replace any password exposed in the phishing attempt wherever else you reused it.
- Turn on two-factor authentication. Use the current security prompts in each app or account. Meta lists two-factor authentication as an account-security feature; available methods and menu labels may vary.
- Enable login alerts. Review the alert options offered in the account’s security settings so you can notice unfamiliar sign-ins.
- Recheck account details and activity. Look for unfamiliar email addresses, phone numbers, connected accounts, or other changes. Remove or correct details you do not recognize, and secure the email account used for recovery.
- Keep recovery methods accessible. Make sure you can use the email address and phone number on each account. Store any recovery codes or backup methods securely if the app offers them.
Should you use a security key?
A physical security key is an optional extra factor, not a prerequisite for account recovery. Meta says Facebook users can use a compatible third-party U2F or FIDO2 key, but compatibility depends on the key, device, browser, and connection type. Keys may connect through USB, Lightning, NFC, or Bluetooth depending on the product and device; not every combination works.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before buying one, check that it works with the devices and browsers you actually use and that you can keep a backup key or securely retain other recovery methods. Meta does not endorse a particular brand or model in its Facebook security-key guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
