Facebook and Instagram accounts hacked and Meta has closed the case? How we got a solicitor's accounts back within days

By Yair Cohen, Solicitor specialising in internet law

This case study is part of our social media account recovery section.

If your Facebook and Instagram accounts have been hacked, the hacker has changed the email and password, and Meta has told you the case is closed, you can still get the accounts back. The route is a properly framed legal communication to the lawyers who act for Meta, rather than another report through the app. That is how we recovered both accounts for our client, a solicitor herself who runs her own small law firm, within days of her instructing us. Names and some details have been changed to protect the client; what happened, what we did and how it ended are as they were.

Facebook and Instagram accounts hacked: what happened to the client

Our client is a solicitor who runs her own small law firm. Like a growing number of professionals, she had built her practice on social media rather than on a marketing budget. Around ten thousand people followed her on Facebook and about the same number on Instagram, and a good share of her new clients found her there first. The accounts were in her own name, but they were, in every practical sense, her practice's front door.

In 2024 she found out from her followers that something was wrong. Several of them messaged her to say that strange posts were appearing on her Facebook page. By the time she tried to log in, she was locked out. Whoever had got in had changed the password, the email address on the accounts and even her profile picture. Everything Meta would normally use to confirm she was the owner now pointed at the hacker.

Being a solicitor, she set about handling the matter herself. She reported the hack through Meta's own channels, more than once. She sent various communications under her own name and that of her firm, including a letter to Facebook's UK company. She reported the crime to Action Fraud, the national reporting centre for fraud and cyber crime; hacking an account is a criminal offence under the Computer Misuse Act 1990, though a police report is a record of the crime rather than a way back into the account. All of it was to no avail. Meta's answer, when it came, was that the matter was closed.

Meanwhile her name and face were in the hands of a stranger who could post as her, message her followers as her, and reach her clients as her. For a regulated professional that is far more than an inconvenience. It is a risk to her reputation, her clients' confidence and, potentially, their confidential information.

Why Meta's recovery process fails when the hacker has changed your email address

Meta's account recovery tools are built on one assumption: that the person asking for help still controls at least one of the contact details on the account. The recovery code goes to the email address or phone number on file. Once a hacker has replaced those, the code goes to the hacker. The identity check that follows tends to fail for the same reason, because the account has stopped looking like the person in the photograph. The owner is then told, in effect, that she is unable to prove she is herself.

Writing to Facebook's UK company has the same problem. For users in the UK the accounts are operated by Meta Platforms Ireland, as Meta's own privacy policy sets out, and a letter sent to a London office tends to go nowhere. The client's letter had been well written. It had simply gone to a company that was in no position to act on it.

Meta's recovery tools assume you still control the email address on the account. Once a hacker has changed it, every code and every check goes to them instead of you.

Communicating with the lawyers who act for Meta: what we did and why we did it that way

We began by going through everything she had: her account of events, the communications she had sent, the notifications from her followers, the reports to Meta and to Action Fraud. The aim was a clear, dated chronology that showed she was the owner and that she had done everything a reasonable person could, which Meta's own forms had already failed for a structural reason rather than for want of effort.

Then we communicated with the law firm that acts for Meta in matters of this kind. Because we have dealt with this type of case many times, we know which firm that is. Meta uses different law firms for different issues and different kinds of matter, and knowing which one handles hacked and disabled accounts is part of the job. It is also worth saying that a member of the public who writes to Meta's lawyers directly is highly unlikely to be dealt with: without instructions from Meta, a law firm will usually decline to engage. A communication from solicitors, framed as notice of a legal claim, is read by a person and treated as what it is.

The communication was framed in law rather than as a complaint. The accounts held years of the client's personal data, and under UK data protection law she had rights over that data which the platform was obliged to respect, including the right to know what was held and to have it kept secure (the right of access under Article 15 of the UK GDPR is one of them). Allowing a stranger to carry on using her name, her image and her private messages also engaged her rights in misuse of private information. We set out the facts, the law, the harm to the client and to the practice she ran, and asked for one thing: that Meta restore her rightful control of both accounts.

The client checked the communication and signed an authority confirming that what it said was true. It went out within days of our instruction, because every day the hacker held the accounts was a day he could do more damage.

Outcome: both accounts recovered within days

Within days of our communication the client had both accounts back, with her own email address and password restored. Proceedings were unnecessary and so was a hearing. She could go back to doing what the accounts were for, which was telling people about her practice and taking on the clients who found her there.

Her message to us when it was over was short: "Everything has been resolved. Thank you for the work."

Within days of our communication she had both accounts back, with proceedings and a hearing both avoided, and a practice that could get back to work.

Advice if your Facebook or Instagram account has been hacked and Meta's recovery process has failed

Act quickly, and make the effort count. Make one report through Meta's hacked-account process so that there is a record, then move on. Once the hacker has changed your email address, the process is working for them rather than for you, and every week spent repeating it is a week the hacker has your name.

Keep everything. Screenshots of the posts the hacker made, the messages from friends or followers who noticed, the dates you reported it, the reference numbers Meta gave you, your Action Fraud report. The communication that gets your account back is built on that chronology, and so is any claim that follows if the platform fails to act.

Tell the people who matter. If the account is how clients or customers reach you, tell them by another route that it has been compromised and that anything coming from it is from someone else. It protects them, and it shows later that you behaved responsibly.

Then get the matter in front of someone at Meta who is obliged to read it. In our experience that means a legal communication to the lawyers who act for the platform, framed on your rights in data protection and private information. Our guide to recovering a lost social media account explains the law in more detail, and how we recover a lost social media account when the platform says no sets out the steps we take. If your accounts were hacked and then disabled by Meta for what the hacker did, the route is slightly different and is told in legal steps to regain access to Meta accounts. Other business matters are collected under business case studies.

Lawyers' thoughts about the case

What this matter taught us, and what we now tell every professional who comes to us, is why the client's letter to Facebook UK went unanswered. She had assumed, reasonably, that a company called Facebook with an office in London would be the right place to write. For UK users the accounts sit with an Irish company, and the London office is, broadly, a sales and marketing operation. A well-written letter to the wrong entity is a letter to nobody. Knowing who actually runs the service, which law firm acts for them on which kind of matter, and how to get that firm to engage, is most of the battle, and it is knowledge that comes from having done it before.

The second lesson is about what the word "closed" means. When Meta closes a hacked-account report, it has reached the end of its automated steps, which is a different thing from deciding that you are the owner or otherwise. That is a dead end for the recovery tool, and the law carries on past it. The platform remains responsible for your personal data whoever is sitting in the account, and a legal communication that says so, to the right people, reopens a door the app has shut.

The third is for professionals in particular. If your social media is how clients find you, it is a business asset, and it deserves the care you would give the office keys: two-factor authentication through an app rather than a text message, a recovery email that differs from the one printed on your website, and someone other than you who knows the account exists and would notice if it changed. This client's followers were the ones who raised the alarm. Having people who will do that for you is worth more than any setting.

Frequently asked questions

My Facebook account was hacked and the hacker changed the email. Can I still recover it?

Yes. Meta's own recovery tools will struggle, because the codes and checks go to the hacker's email, but that is a limit of the tools rather than of your rights. A legal communication to the lawyers who act for Meta, framed on your data protection rights, is how we recovered both accounts in this case within days.

Meta says my hacked-account case is closed. Is that the end?

Far from it. "Closed" means the automated process has finished. In this case the client had been told the matter was closed before she came to us, and both accounts were restored within days of our communication with Meta's legal representatives.

Should I report the hack to the police or Action Fraud?

Yes, and keep the reference number. Hacking an account is a criminal offence and the report is part of your record of what happened. Getting the account back is a separate, civil matter against the platform, which is where we act.

I wrote to Facebook UK and heard nothing. Why?

Because the UK company is separate from the one that operates the accounts. For UK users that is Meta Platforms Ireland, and in practice legal communications are dealt with by the law firm that acts for Meta on that kind of matter. We write to them directly, and because we have done so many times, they engage.

Can I write to Meta's lawyers myself?

You can, but a law firm acting for Meta is highly unlikely to deal with a member of the public without instructions from Meta. A communication from solicitors, framed as notice of a legal claim, is treated differently.

How long does it take to get a hacked Facebook or Instagram account back?

In this case, days from our communication to recovery. Other matters have taken longer, particularly where Meta has also disabled the account for what the hacker did with it. We tell you at the first call what we expect in your case.

The hacker is posting as me. Can I stop that while the account is being recovered?

The quickest protection is to tell your followers and clients by another route that the account is compromised. Our communication also asks the platform to secure the account and the data in it at once, separately from restoring your access.