Overview

Over the years I have helped friends, family, and colleagues deal with Facebook security issues. Figuring out what went wrong, and preventing the same thing from happening in the future, can be a frustrating experience. If ever you believe your account has been compromised, here is a guide to recovery. During the process of account recovery, you need to try to ask the question: "How was my account hijacked in the first place?" The most common answers are:
  1. Poor password security
  2. Lack of 2-Factor Authentication
  3. Malware

Check Login History

In your Facebook Security Settings, there is a menu that will tell you "Where You're Logged In". Look at the various devices you are signed in through, and see if anything is out of the ordinary. If you have an iPhone and there is someone logged into your account from "Facebook for Android", someone may be accessing your account from a device that isn't yours. You can click "End Activity" on that device to stop them. Each device also lists helpful identifying information such as the date, time, and city/state of last access.

Change Your Passwords

I emphasize passwords, plural, because there is more than one way into a Facebook account. Your email is the primary recovery method for resetting your Facebook password. Therefore you should update your email password as well as Facebook. For tips on making strong passwords: Guide to Creating Strong Passwords

Turn on 2-Factor Authentication (2FA)

2-Factor Authentication is the best optional security layer you can implement to secure most consumer apps and services. Facebook refers to this process as "Login Approvals" and has integrated the feature directly into the Facebook mobile app.

Scan for Malware

Scan your computer and mobile device for malicious software. I recommend using Malwarebytes on your computer. Facebook also offers their own list of partnered security services in their help documentation.

Check Your Facebook Activity Log

Facebook's Activity Log documents everything you do on Facebook. If you are concerned that someone may be in control of your account, this is a very useful tool to determine when you lost control, and what has happened since. Common signs of illicit activity include:
  • Change to your name
  • Change to date of birth
  • Posting spam links to your wall
If you find unwanted activity, you can delete or undo most of those actions in the Activity Log.

Follow-Up with Friends

Once you have looked through the activity log, take a look at Facebook Messenger. Between the two, you should have a sense for what the attacker did while using your account. If they contacted any of your friends, make sure to follow-up with them (ideally through something other than Facebook) to let them know that you are back in control.

TL;DR

  1. Kick the attacker out
  2. Change password to Facebook and your email
  3. Turn on 2-Factor Authentication
  4. Scan for Malware
  5. Try to undo any actions taken by the attacker
  6. Follow-Up with Friends