The short answer: set your posts to Friends instead of Public, accept friend requests only from people you know, and turn on two-factor authentication. Treat any message asking for money, gift cards or a login code as a scam, even when it seems to come from a friend. If you’re locked out or your account is posting things you didn’t write, go to facebook.com/hacked on a computer or phone you trust.
Facebook changes its menus often, so some names below may look a little different on your screen.
Why it matters
In 2025, social media was where people reported losing the most money to fraud: more than $2 billion, according to the FTC (FTC, 2026). Scammers also use what you post, like family names, your town or your vacation dates, to make their stories more believable (FTC).
Five settings to check
- Who sees your posts: when you write a post, tap the audience button under your name and choose Friends. Facebook’s Privacy Checkup (under Settings & privacy) walks you through your other choices.
- Who can find you: in the same Privacy Checkup, limit who can look you up by email or phone number.
- Two-factor authentication: this means signing in takes your password plus a code. The FTC calls it one of the best ways to protect an account (FTC). On Facebook it’s in the security section of Accounts Center.
- A strong, unique password you don’t use anywhere else.
- Login alerts so Facebook tells you when someone signs in from a new device.
Common Facebook scams
- Duplicate friend requests. A second request from someone you’re already friends with is often a copycat account. Message your friend on their real account, or call them.
- “Friends” who need money. A hacked account may send pleas for help or money to everyone on the list (FTC). Call the person before you send anything.
- Investment and crypto tips from new contacts. Investment scams caused about half of all reported fraud losses in 2025 (FTC, 2026).
- Marketplace buyers or sellers who want to move to another app, pay with gift cards, or send you a “verification code.”
- “Your page will be disabled” messages with a link. Check your account by opening the Facebook app yourself.
- Romance scams. A stranger who becomes a close friend or sweetheart quickly, but never meets in person, and eventually needs money. See how to spot a romance scam.
- Fake celebrity endorsements and AI-made profiles. The FBI warns that scammers use AI-generated photos and videos for fake profiles and celebrity-endorsed “investments” (FBI). See fake investment scams on Facebook and how to spot AI scams.
- “You won!” posts and messages. If you have to pay a fee to collect a prize, it’s a scam (FTC).
If your Facebook account is hacked
Signs: posts or messages you didn’t send, friends you didn’t add, or a password that stops working (FTC).
- Go to facebook.com/hacked and follow the steps to get back in.
- Change your password. If you used the same password anywhere else, change it there too.
- Sign out of all other devices and turn on two-factor authentication.
- Check that your recovery email and phone number are yours, and remove anything you don’t recognize.
- Delete posts the hacker made, and tell your friends that recent messages from you may be fake (FTC).
If you lost money, report it at ReportFraud.ftc.gov.
