Social media: hacked friends, fake profiles, and what you share

A message from a friend’s account doesn’t tell you who’s typing.

If it’s happening now

You didn’t reply, send anything, or tap a link. You’re done. If it came from a friend’s account, tell them another way.

A friend’s account asks for money, a code, or a vote. Don’t send anything or open the link. Call or text them on the number you already have. If you can’t reach them, wait.

A code arrived by text and you didn’t ask for one. Someone typed your phone number into a sign-in or a password reset. Don’t pass it to anyone, however they ask. Delete it. Then open the app it names yourself and change the password.

A message from “Meta,” “Facebook,” or “Instagram” says your account or page will be deleted. Don’t tap the link. Open Facebook yourself: profile picture or Menu > Help & support > Account Status. On Instagram: Menu > Settings > Account Status. Real restrictions show there. Meta says its staff won’t ask for your password or payment details in a chat or email.

Someone replied to your “I got hacked” post offering to get your account back. That isn’t support. Go to facebook.com/hacked or instagram.com/hacked yourself. Full steps: Someone got into my account.

A second friend request from someone you’re already friends with. Ask them by text or a call. If it’s a copy, open it, choose the Options button below the cover photo, then Report profile.

Someone you’ve been chatting with has photos of you and wants money. Don’t pay. Save the messages and their profile before you block. Someone is threatening to share photos of me.

What to say

• Hi, it's me. Did you just message me on Facebook asking for a code? I'm calling instead of answering there, in case someone's in your account.

• Someone's in your Facebook. They just messaged me asking for a code. Go to facebook.com/hacked from your own phone, and text people that it wasn't you.

• Someone made a copy of my Facebook profile. If you get a new friend request from me, don't accept it. Report it.

If something already left your hands

You sent money

Stop replying in the chat. Call your bank or the payment app, on the number on your card or inside the app. Ask them to stop or reverse the payment, and get a case number. If you paid by wire or crypto, file at ic3.gov at the same time as you call the bank.

If you sent it yourself, by Zelle, wire, a payment app, gift cards, or crypto, the bank or app may treat it as authorized and not pay it back. Ask for that decision in writing. If it’s no, file a complaint at consumerfinance.gov/complaint. Steps for each way you paid: I paid or sent money.

Then screenshot the chat and the profile; the account may disappear. Report it at ReportFraud.ftc.gov, and tell your friend another way. Anyone who offers to get the money back for a fee is a second scam: Someone offers to get my money back.

If you’re 60 or older, the National Elder Fraud Hotline can help with the reports.

You sent the code

Assume they’re signing in as you. The text names the app it’s for. Open that app yourself and change the password. On Facebook or Instagram, go to Accounts Center > Password and security > Where you’re logged in and sign out every device you don’t recognize. Check that the email and phone number are still yours: Accounts Center > Personal details > Contact info. Then lock the sign-in (below). Some accounts now show Meta Account where this page says Accounts Center.

Already locked out: go to facebook.com/hacked or instagram.com/hacked from a phone or computer you’ve used with that account before. If they changed your email, Facebook sent your old address a message with a link that reverses it. On X: X’s steps for a compromised account. Full steps: Someone got into my account. Then text close friends and family. Whoever has your account will ask them next.

You typed your password into a link

Change it in the app, then anywhere else you used it. Then lock the sign-in (below). More: I gave out a code, password, or card number.

You accepted a fake friend request

Unfriend and report it. It could see your friends list and what you share with friends. Tell the real person.

What it looks like

8:41 p.m. A Facebook message from Carol, a friend from church. You've been messaging each other for years.

Messenger Carol Whitfield

8:41 PM

Hi, hope you're doing well. Can I ask you a quick favor?

My granddaughter Emma entered a photo contest for a college scholarship and she made the final round. Voting closes tonight.

To stop fake votes they text a 6 digit code to each voter. I put your number in, can you send me the code when it comes?

Of course. Hang on.

It should be there now. Just type it here and I'll submit it for you. Thank you so much

A text from Facebook with a 6-digit code just arrived on your phone. What do you do?

• Send her the code. It's Carol's real account, and the text came from Facebook, not a stranger
• Ask her something only the real Carol would know, then decide
• Don't send it. Call or text Carol on her phone number

Show the answers

• Wrong move Send her the code. It's Carol's real account, and the text came from Facebook, not a stranger The text came from Facebook because someone typed your phone number into a sign-in or password reset. The code finishes it. Whoever is typing as Carol gets your account.
• Wrong move Ask her something only the real Carol would know, then decide Whoever has her account can scroll back through years of your messages and her photos. A right answer only proves they read them.
• Best move Don't send it. Call or text Carol on her phone number If it's her, she'll tell you, and you've lost nothing. If it isn't, she needs to know her account is asking her friends for codes. Delete the code.

A code that lands on your phone is for your account, whoever asks for it. Check the request with the person by phone.

7:15 a.m. This is waiting in your Facebook messages.

Messenger Meta Policy Center

7:15 AM

FINAL WARNING. Your account has been reported for violating our Intellectual Property and Community Standards policies.

Your account is scheduled for permanent deletion within 24 hours. This decision cannot be reversed after that time.

If you believe this is a mistake, submit an appeal so our team can review your case: meta-policyreview-center.com/appeal/case-58120447

Thank you, Meta Business Support Team

The sender's picture is Meta's logo. What do you do?

• Tap the link and appeal. You can't lose 15 years of family photos
• Reply and ask for a case number before you click anything
• Open Facebook yourself and look at Account Status
• Report the message and block the sender

Show the answers

• Wrong move Tap the link and appeal. You can't lose 15 years of family photos Appeal pages like this ask you to sign in, then for the code Facebook texts you. Whoever gets both has your account.
• Wrong move Reply and ask for a case number before you click anything They'll give you one. Anything the sender says about itself comes from the sender.
• Best move Open Facebook yourself and look at Account Status Real restrictions show in Account Status (profile picture > Help & support). If nothing's there, there's nothing to appeal. Report the message and block the sender.
• Okay Report the message and block the sender Safe. Looking at Account Status as well tells you whether the account has a real problem.

Anyone can name a page Meta and use its logo. If a message says your account is in trouble, look for the trouble in the app yourself.

8:05 a.m. Your cousin Dana texts from her usual number: "My Facebook got hacked and I can't get back in. Made a new one and just sent you a request." It's in your friend requests.

facebook.com/friends/requests

Friend requests

Dana Kessler
2 mutual friends · 2m

Confirm Delete

Her new profile has one photo and no posts. What do you do?

• Confirm it
• Delete it. One photo and no posts is what fake profiles look like
• Message the new account first and ask if it's really her

Show the answers

• Best move Confirm it Dana told you herself, from the number you already had, that a request was coming, and there it is. That's the check. A new account has no posts yet.
• Wrong move Delete it. One photo and no posts is what fake profiles look like It's also what every replacement account looks like on its first day. How the profile looks can't settle it. Dana's text did.
• Okay Message the new account first and ask if it's really her Harmless, but it proves nothing. Whoever runs an account will say it's them. Her text already answered it.

A new account gets the same check as a strange request: the person tells you on a number you already had. If it later asks for money or a code, check again the same way.

What they’ll ask for

When it comes from a friend’s account, the move is the same: check with them on a number you already have.

“Can you vote for my granddaughter? They’ll text you a code.” The code is for your account, not a contest.

“I sent my code to your number by mistake. Can you send it back?” It’s your code, for your account. Delete it.

“Is this you in this video?” The link usually opens a page that asks you to sign in. Don’t open it. Tell your friend another way.

“I made $8,000 with this investment coach. Want her number?” Hacked accounts post this to their whole friends list. Friends still inside the scam say it too: the app shows gains until they try to take money out. Either way, don’t contact the coach. An investment that can’t lose.

“I got a $50,000 government grant. The agent can get you one too.” No agency contacts you about a grant you didn’t apply for. Call your friend.

“Selling my camper cheap before I move. Zelle me the deposit to hold it.” Call your friend first. Buying or selling on Facebook Marketplace, OfferUp, or Craigslist.

“Your page will be deleted in 24 hours. Appeal here.” Check Account Status in the app instead.

“I can get your account back for $200.” Recovery through facebook.com/hacked and instagram.com/hacked is free. Strangers who charge for it are a second scam.

An ad: “Everything 70% off, store closing.” Check the store before you buy: Is this store real? More than 40% of people who lost money to a social media scam in 2025 said it started when they ordered something from an ad.

What you share

Settings won’t stop a hacked friend’s account. They limit what strangers can see. If a menu doesn’t match, search Settings for the name in bold.

Hide your friends list. It’s public unless you changed it. A copied profile works by sending requests to the real person’s friends. On Facebook: Menu > Settings & privacy > Settings > Audience and visibility > How people find and contact you > Who can see your friends list? Choose Friends or Only me.

Make old public posts friends-only. Settings & privacy > Settings > Audience and visibility > Posts > Limit who can see past posts. It can’t be undone in one step.

Run Privacy Checkup once. Settings & privacy > Privacy Checkup. It covers who sees your phone number, email, and birthday, who can send you friend requests, and which apps are connected to your account.

On Instagram, if you post for family: Profile > Menu > Settings > Account privacy > Private account.

Make up your security-question answers. First car, mother’s maiden name: answer with something false and save it in your password manager, as the FTC suggests. Then a quiz post asking for your first car or the street you grew up on can’t give anything away.

Lock the sign-in. In Facebook or Instagram: Accounts Center > Password and security. Add a passkey if it’s offered, or turn on Two-factor authentication with an authentication app. Text-message codes are better than nothing. More: Lock down your accounts in 30 minutes.

Check whether an email from Facebook is real. Accounts Center > Password and security > Recent emails lists the security emails Meta sent you in the past year.

For a child’s or teen’s account: Kids and teens online.

What not to waste time on

Studying the profile photo. Fake profiles use AI-made faces and photos stolen from real people, and a stolen photo has nothing wrong with it. A call to the person, or to a friend you both know, settles it.

Deciding whether the message sounds like them. Whoever is in the account can read your whole chat history and copy it.