Last materially reviewed: September 6, 2026
Direct Answer
Secure the email address linked to Facebook first, then start recovery at facebook.com/hacked from a device you have used before. An attacker who still controls your email can retake the account no matter how many times you reset the Facebook password. Once you are back in, remove unknown logins and devices, turn on two-factor authentication, and check for linked payment methods and Page roles.
Key Takeaways
- Email first, Facebook second. Recovery fails if the attacker still holds the recovery inbox.
- Screenshot the damage before you clean it up — sent messages, changed settings, login alerts and scam posts disappear once you delete them.
- Unauthorised access to your account is illegal access under RA 10175 §4(a)(1); using your name and photos to deceive others is computer-related identity theft under §4(b)(3).
- If money moved through GCash, Maya, a bank or a card, notify the provider immediately — RA 12010 lets institutions hold disputed funds for a limited window.
- If the attacker took over your mobile number, report the SIM to your telco at once; RA 11934 obliges them to deactivate within 24 hours of notice.
- If the hijacked account is being used to threaten you with intimate images, that is a separate and more urgent matter — see our sextortion guide.
On This Page
- First hour · Decision snapshot · Governing law · What is criminalised · Overlaps and minors
- Scenarios · Evidence · Procedure · Realistic outcomes · Common mistakes
- Checklist · Where to get help · FAQs · Official sources
Immediate Steps in the First Hour
- Secure the linked email account. Change its password, sign out all sessions, turn on two-factor authentication, and check for forwarding rules the attacker added to hide Facebook alerts. Do the same for any backup email.
- Start Facebook recovery at facebook.com/hacked, from a device and browser you have logged in from before. Familiar devices are recognised and shorten the process.
- Change the Facebook password to something unique that is used nowhere else, and choose the option to log out of all other devices.
- Review active sessions in the Accounts Center security settings, remove any device you do not recognise, and turn on two-factor authentication — an authenticator app rather than SMS, with the recovery codes saved offline.
- Screenshot the damage before deleting it — sent Messenger threads, posts, Marketplace listings, changed email or phone, new admins on your Pages, and every Facebook security email.
- Check what is attached: saved payment methods, ad accounts, Business assets, Page and group roles, linked Instagram, and connected apps. Remove what you do not recognise.
- Warn your contacts through another channel that the account was compromised and that messages asking for money or one-time codes are not from you.
- If money moved, call your bank or e-wallet now. If your mobile number was ported or SIM-swapped, call the telco now.
Decision Snapshot
| Situation | What may apply | What changes it | Next step |
|---|---|---|---|
| You still control the linked email | RA 10175 §4(a)(1) illegal access | Whether the attacker changed the recovery address | Secure email, then recover at facebook.com/hacked |
| Recovery email and phone both changed | Same, plus §4(a)(3) data interference if content was deleted | Whether you have a previously trusted device | Use Facebook’s compromised-account flow and ID verification |
| Account is messaging contacts for money | RA 10175 §4(b)(3); estafa with the §6 uplift | Whether anyone paid | Warn contacts; screenshot the threads; report to PNP ACG or NBI |
| Money left your bank, GCash or Maya | RA 8484 if card or account credentials were used; RA 12010 | How quickly you report it | Notify the institution immediately, then file a police report |
| Your mobile number was taken over | RA 11934 obligations on your telco | Whether the SIM was swapped or the number ported | Report the SIM to the telco for deactivation within 24 hours |
| A separate fake profile is impersonating you | RA 10175 §4(b)(3) | Whether your own account is also compromised | Report the impostor profile; see our impersonation guide |
| The attacker threatens to publish intimate images | RA 9995 and RA 11930 where a minor is involved | The age of the person depicted | Follow the sextortion guide and report immediately |
Governing Law and Authorities
- RA 10175, the Cybercrime Prevention Act of 2012 — the central statute for account compromise.
- RA 8484, the Access Devices Regulation Act of 1998 — where card, account or credential details were used.
- RA 12010, the Anti-Financial Account Scamming Act — money mules, social engineering and disputed-fund holds.
- RA 11934, the SIM Registration Act — telco duties where a mobile number is involved.
- Disini v. Secretary of Justice, G.R. No. 203335, 11 February 2014, which upheld §4(a)(1), §4(a)(3), §4(b)(3) and §6 of RA 10175 while striking down §12 and §19.
What the Law Actually Criminalises
RA 10175, element by element
- §4(a)(1) illegal access — “the access to the whole or any part of a computer system without right.” Logging into your account without permission is complete on access; the attacker does not have to do anything further.
- §4(a)(3) data interference — “the intentional or reckless alteration, damaging, deletion or deterioration of computer data, electronic document, or electronic data message, without right.” This covers deleted messages, wiped photos and altered settings.
- §4(b)(3) computer-related identity theft — “the intentional acquisition, use, misuse, transfer, possession, alteration or deletion of identifying information belonging to another … without right.” Using your name and photos to solicit money from your contacts falls here, and the Supreme Court upheld this provision in Disini.
- §6 — Revised Penal Code offences such as estafa, committed “by, through and with the use of information and communications technologies,” carry a penalty “one (1) degree higher.”
RA 8484 where credentials or cards were used
RA 8484 defines an access device as “any card, plate, code, account number, electronic serial number, personal identification number … or other means of account access that can be used to obtain money, good, services, or any other thing of value or to initiate a transfer of funds.” Saved card details and account credentials fall within it. Section 9(c) covers “using, with intent to defraud, an unauthorized access device”; Section 9(k) covers possession “without authority from the owner of the access device or the access device company.”
RA 12010 where a financial account was drained
The Anti-Financial Account Scamming Act penalises money mule activity and “social engineering schemes” — where “a person … obtains sensitive identifying information of another person, through deception or fraud, resulting in unauthorized access and control over the person’s Financial Account.” It also lets institutions temporarily hold funds subject to a disputed transaction for a period “which shall not exceed thirty (30) calendar days,” which is why reporting speed matters more than anything else you do about the money.
Boundaries, Overlaps and Cases Involving Minors
When a hacked account becomes extortion
A compromise often turns into coercion — the attacker finds photos in Messenger or cloud backup and threatens to send them to your friends list. RA 9995, the Anti-Photo and Video Voyeurism Act, then applies alongside the account offences, and the priority changes: preserve the threat messages before you block, and do not pay. Our sextortion guide covers that sequence.
If the account holder or the person depicted is under 18, RA 11930, the Anti-OSAEC and Anti-CSAEM Act, governs instead. Under that Act consent is not a defence, and a child who produced the material is treated as a victim rather than an offender. Report directly to the PNP Anti-Cybercrime Group or the NBI rather than handling it informally.
Where the SIM Registration Act fits
If the takeover ran through your mobile number, RA 11934 requires subscribers to “immediately inform the PTE through its facility established for such purpose” when a SIM is lost, and obliges the provider to “deactivate said SIM within twenty-four (24) hours.” Disclosure of subscriber information to investigators, however, requires a subpoena from a competent authority — your telco cannot simply hand you the attacker’s identity.
What the law does not do
No Philippine agency can order Meta to restore your account or take content down administratively. Section 19 of RA 10175, which would have permitted the Department of Justice to block or restrict access to computer data, was declared unconstitutional in Disini. Recovery runs through Meta’s own process; the criminal case runs in parallel and does not speed it up.
Philippine Scenarios
These are hypothetical illustrations, not real cases or predictions of outcome.
Hypothetical 1 — the Page verification phish. A business owner in Quezon City gets a message warning her Page will be unpublished, and clicks through to a lookalike login form. The attacker adds themselves as Page admin and runs ads on her card. Illegal access under §4(a)(1) applies; card misuse engages RA 8484; the ad spend is a chargeback matter with her bank.
Hypothetical 2 — the borrowed identity. A student’s account is taken over and used to message his friends asking for GCash “emergency” loans. Three people pay. The takeover is §4(a)(1); using his identity to deceive is §4(b)(3); the estafa against each contact carries the §6 uplift, and each contact has their own complaint.
Hypothetical 3 — the SIM swap. A worker in Cebu loses mobile signal, then finds her Facebook and GCash both changed. The number was swapped, letting the attacker intercept SMS codes. Reporting the SIM triggers the telco’s 24-hour deactivation duty under RA 11934; the e-wallet loss falls under RA 12010.
Evidence and Documentation
Screenshots alone rarely carry a case. Capture each of these layers before you clean up the account:
| Layer | Why it matters |
|---|---|
| Screenshots of scam messages and posts | Readable, but carry no independent metadata |
| Messenger or Facebook data export | Structured timestamps and identifiers produced by the platform, not by you |
| Facebook security emails | Independent record of when the password, email or phone was changed |
| Login and device history from account settings | Shows unfamiliar sessions, times and approximate locations |
| Profile URL of any impostor account | Survives a name change; what a preservation request is served on |
| Full email headers of the phishing message | Contain routing and origin data a screenshot lacks |
| Transaction records and reference numbers | Trace money to a registered financial account |
| Contacts’ own screenshots and receipts | Each person who paid is a separate complainant with separate proof |
| The platform’s response to your report | Proves you reported, and when |
Preserve before you clean up. Deleting the scam posts is the natural first instinct, and it destroys the record. Screenshot and export first, then remove; keep the originals uncropped plus one backup. See screenshots as admissible evidence and electronic evidence preservation.
Procedure and Next Steps
- Platform first. Work through facebook.com/hacked and the Meta Help Center. If identity confirmation is requested, submit it through Facebook’s own form and nowhere else. Report any impostor profile separately. Save every confirmation.
- Financial institutions second, and fast. Call your bank, card issuer, GCash or Maya, report the unauthorised transactions and ask them to hold or reverse them, and get a reference number for each dispute. If the institution does not resolve it, escalate through the Bangko Sentral ng Pilipinas consumer assistance channels published at bsp.gov.ph; confirm the current process there.
- Telco third, if your number was involved: report the SIM as compromised so it is deactivated, then register a replacement.
- Prepare complaint documents: a dated chronological narrative, the printed screenshots plus the digital export on a USB drive, Facebook security emails, login history, transaction records, and a government-issued ID.
- File with law enforcement. The PNP Anti-Cybercrime Group (acg.pnp.gov.ph) or a regional Anti-Cybercrime Unit, or the NBI Cybercrime Division at the NBI main office, Filinvest Cyberzone Bay, Diosdado Macapagal Boulevard, Pasay City, or an NBI regional office. See our PNP ACG and NBI complaint guides, the general cybercrime reporting guide, and the online scam complaint procedure where contacts lost money.
- Consider a data privacy complaint. Where personal data was exposed, the National Privacy Commission accepts complaints at privacy.gov.ph/file-a-complaint.
- Then prosecution. Investigators refer the case onward, with the DOJ Office of Cybercrime coordinating prosecution and international cooperation. See what happens after reporting.
Remedies and Realistic Outcomes
- Platform. Recovering the account is the most achievable outcome, usually within days where you still hold the linked email. It is markedly harder once the recovery email, phone and password have all been changed, and some accounts are never recovered.
- Financial. Reversal depends almost entirely on speed and on whether the funds have already been moved out of the receiving account. Report the same day. There is no guarantee of refund.
- Criminal. Illegal access and identity theft carry real penalties, but identifying the person behind a mule account takes time; cases move in months and years, not days.
- Civil and administrative. Damages can be claimed against an identified defendant; the NPC handles the data-protection dimension. Neither restores the account.
Be realistic about sequence: recovery, then money, then the case. A criminal complaint does not accelerate Meta’s review, and Meta’s review does not affect the complaint.
Common Mistakes
- Resetting Facebook before securing the email. The attacker simply resets it again.
- Deleting the evidence while cleaning up. Screenshot and export first.
- Paying a “recovery service” or “ethical hacker.” These are a second fraud; Meta account recovery is free and only Meta can do it.
- Clicking a link in a recovery email. After a compromise, fake recovery emails follow. Type the address yourself.
- Sharing a one-time code with anyone, including someone claiming to be Facebook support or a friend “verifying” an account.
- Creating a new account and abandoning the old one while it keeps scamming your contacts.
- Forgetting the attached assets — Pages, ad accounts, Business Manager, linked Instagram and saved cards — or leaving the old password in use elsewhere.
Recovery and Reporting Checklist
| Done | Item |
|---|---|
| ☐ | Linked email secured: password changed, sessions ended, 2FA on, forwarding rules checked |
| ☐ | Facebook recovery started at facebook.com/hacked from a familiar device |
| ☐ | Facebook password changed and all other devices logged out |
| ☐ | Unknown sessions and devices removed; two-factor authentication enabled |
| ☐ | Scam messages, posts and changed settings screenshotted before deletion |
| ☐ | Facebook security emails, login history and data export saved |
| ☐ | Pages, ad accounts, Business assets, linked Instagram and connected apps reviewed |
| ☐ | Saved payment methods removed; card or e-wallet provider notified |
| ☐ | Contacts warned through another channel |
| ☐ | Telco notified if the mobile number was involved |
| ☐ | Impostor profiles reported and their URLs saved |
| ☐ | Complaint filed with PNP ACG or NBI; passwords changed wherever reused |
Support and Where to Get Help
- Meta / Facebook — account recovery at facebook.com/hacked and the Meta Help Center. These are the only legitimate recovery routes; no third party can restore a Facebook account.
- PNP Anti-Cybercrime Group — the police unit for cybercrime, with regional Anti-Cybercrime Units: acg.pnp.gov.ph. Confirm hotline numbers there or at your nearest police station.
- NBI Cybercrime Division — main office at Filinvest Cyberzone Bay, Diosdado Macapagal Boulevard, Pasay City; NBI trunkline (02) 8523-8231, as published at nbi.gov.ph/contact.
- Cybercrime Investigation and Coordinating Center — runs the government’s inter-agency cybercrime response centre and hotline. We could not load cicc.gov.ph to confirm the current hotline number on the review date, so we do not publish one; check cicc.gov.ph.
- DOJ Office of Cybercrime — cybercrime prosecution and international cooperation: doj.gov.ph.
- Bangko Sentral ng Pilipinas — consumer assistance for banks and e-money issuers, after you have raised the dispute with the institution itself: bsp.gov.ph.
- National Privacy Commission — privacy.gov.ph/file-a-complaint; The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Barangay Paligsahan, Quezon City; complaints hotline (+63) 2 5322 1322, local 114 or 115.
Frequently Asked Questions
Can a hacked Facebook account actually be recovered?
Often yes, particularly where you still control the linked email or phone number and can log in from a device you have used before. It becomes much harder once the attacker has changed email, phone and password together, because every automated route depends on one of those; Facebook may then ask you to confirm identity through its own form. Some accounts are never recovered, which is why securing the email first matters so much.
Should I just make a new account?
Not as a first move. While the compromised account stays active it keeps messaging your contacts, and a second account under your name adds confusion about which is genuine. Pursue recovery, warn contacts through another channel, and report the account so Meta can restrict it. Create a new account only once recovery has clearly failed.
My friends sent money to the hacker. What can they do?
Each of them has their own complaint. They should notify their bank or e-wallet the same day, keep the receipts and reference numbers, and file with the PNP Anti-Cybercrime Group or the NBI. Under the Anti-Financial Account Scamming Act, institutions may hold funds subject to a disputed transaction for a period that “shall not exceed thirty (30) calendar days,” so same-day reporting changes the odds. Your screenshots support their cases as well as yours.
The hacker is threatening to post private photos. What now?
That is extortion layered on top of the account compromise, and it changes your priorities. Do not pay and do not delete the threats — preserve them, then report. RA 9995 applies to intimate images even where you consented to them being taken, and RA 11930 governs where anyone depicted is under 18. Follow our sextortion guide, which sets out the sequence step by step.
Related Cybercode Guides
- Sextortion in the Philippines: What Victims Should Do First
- How to Report Cybercrime in the Philippines
- PNP Anti-Cybercrime Group Complaint Process
- NBI Cybercrime Complaint Process
- What Happens After Reporting a Cybercrime
- Unauthorized Account Access
- Computer-Related Identity Theft
- Fake Accounts and Impersonation · Online Scam Complaint Procedure
- Electronic Evidence Preservation · Are Screenshots Admissible Evidence?
Official Sources
- RA 10175 — Cybercrime Prevention Act of 2012
- RA 8484 — Access Devices Regulation Act of 1998
- RA 12010 — Anti-Financial Account Scamming Act
- RA 11934 — SIM Registration Act
- RA 9995 — Anti-Photo and Video Voyeurism Act of 2009
- RA 11930 — Anti-OSAEC and Anti-CSAEM Act
- Disini v. Secretary of Justice, G.R. No. 203335 (11 February 2014)
- National Bureau of Investigation — Contact
- PNP Anti-Cybercrime Group · CICC · Department of Justice
- National Privacy Commission — File a Complaint · Bangko Sentral ng Pilipinas
- Meta — Hacked Account Recovery · Meta Help Center
Disclaimer
Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.