Stop using the suspicious page, then open Facebook or Instagram through the app you already have or by typing the official address yourself. If you can still sign in, change the exposed password and check your security settings. If you cannot, use Meta’s official recovery route. Entering your password puts the account at risk, but does not by itself prove someone has accessed it.
First, stop and go to the real service
- Close or leave the suspicious page. Do not follow more prompts, submit another password, or provide a login code or other information there.
- Open Facebook or Instagram independently. Use the official app already installed, or type the service’s address into your browser. Do not use links from the suspicious page or messages connected to it.
- Use an official recovery route if needed. For Facebook, Meta’s Help Center says: “If someone hacked your account, visit www.facebook.com/hacked on a device you’ve used to log into Facebook before.”
If you can still sign in
Change the password for the account where you entered it, using the official app or website. Choose a new, unique password that you have not used on another service. Then review the account’s security settings and recent activity.
As an Amazon Associate I earn from qualifying purchases.
- Check that the email address and phone number on the account are yours and that you can access them.
- Review recent activity and sign-ins for anything you do not recognize, and follow the official prompts to secure the account.
- Turn on or review two-factor authentication and login alerts. Meta lists both as Facebook security features in its account security guidance.
If you cannot sign in
Use Facebook’s official hacked-account recovery page at facebook.com/hacked. Meta recommends trying it on a device you have used to log into Facebook before. Follow the current prompts rather than relying on links sent by someone offering to recover the account.
For Instagram, use the official app or Instagram Help Center’s account-access guidance. If you cannot access the email address or phone number linked to the account, Meta says you may be able to regain access through that provider or update account details if you can still access Instagram. The available options can depend on how the account was set up; Meta notes restrictions for people who cannot access their registered email and did not link Instagram and Facebook.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Avoid third-party “account recovery” offers. Do not give anyone your password or a login code, even if they claim they can restore access. Recovery outcomes and timing are not guaranteed.
Change any reused password elsewhere
If you used the exposed password on other services, change it on those accounts too. Start with your email account and financial or other high-impact accounts, then work through the rest. Give each account its own password. This is general security advice; Meta’s recovery pages do not provide a cross-service password-reset process.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Check other Meta accounts without assuming they were accessed
If you use Facebook and Instagram, check both—especially if they share the exposed password or are connected through Accounts Center. Accounts Center manages connected experiences and settings across Meta services, but a password entered on a fake page does not establish that every connected account was accessed. Review the accounts and follow the current security prompts in the official app or site; settings and feature availability can vary.
Optional: add a security key for future sign-ins
After securing access, you can consider a compatible FIDO2 or U2F security key as an optional second factor. Meta’s security-key instructions explain that a third-party key can be added for Facebook two-factor authentication and advise checking that it works with your browser and device before buying. A key is for future sign-ins; it does not undo a password disclosure or guarantee account recovery. You do not need to buy one to follow the recovery steps above.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
