How to Report a Security Issue or Suspicious Activity in the Facebook App (2026 Guide)

How to Report a Security Issue or Suspicious Activity in the Facebook App: Complete 2026 Step-by-Step Guide

By App World Team | Published August 2026 | Updated with the latest Meta security tools and official reporting flows

Reporting a security issue or suspicious activity on Facebook quickly can protect your account, your personal data, and the wider community. Whether you notice an unfamiliar login, a phishing attempt, a compromised password, a scam message, or a technical problem that affects security features, Meta provides multiple official channels inside the Facebook app and on the web. This guide walks you through every current method using the most recent information available from Meta Help Center resources.

Official ways to report security problems and suspicious activity inside the Facebook mobile app and Meta Accounts Center.

Why Reporting Security Issues Matters in 2026

Facebook (part of Meta) continues to face sophisticated phishing campaigns, account takeover attempts, and social-engineering scams. Recent updates from Meta include expanded scam-detection alerts for suspicious friend requests, device-linking warnings on related apps, and stronger AI-assisted review tools. Users who report problems promptly help Meta identify patterns faster and reduce the success rate of attacks.

Common security issues people need to report include:

• Unrecognized logins or devices in “Where you’re logged in”
• Sudden password or email changes
• Phishing messages claiming to be from Meta support
• Fake profiles impersonating you or someone you know
• Scam ads, Marketplace fraud, or malicious links
• Technical glitches that prevent security features (two-factor authentication, login alerts) from working

Acting within minutes or hours of noticing suspicious activity greatly improves the chance of recovering full control of your account.

1. Report a Compromised or Hacked Facebook Account

If you believe someone has gained unauthorized access to your account, Meta’s primary recovery tool is the dedicated hacked-account flow.

Official method (recommended)

1. On a device you have previously used to log into Facebook, open a browser and go to www.facebook.com/hacked.
2. Follow the on-screen questions. You will be asked whether you can still log in, whether your password or contact information has changed, and other details about the situation.
3. Meta will guide you through identity verification and, when appropriate, lock the account temporarily while reviewing the report.

You can submit this report even if you can still log in but suspect unauthorized access. You can also submit it if you have been completely locked out.

If you can still access the account

While waiting for Meta’s review (or in parallel), take these immediate steps inside the Facebook app:

1. Open the Facebook app and tap the Menu icon (☰).
2. Tap Settings & privacy → Settings.
3. Tap Accounts Center (or “See more in Accounts Center”).
4. Select Password and security.
5. Tap Change password, choose your Facebook account, and create a strong, unique password. Choose the option to log out of other sessions if offered.
6. Return to Password and security → Where you’re logged in. Review every device and location. Log out any session you do not recognize.
7. Enable or confirm Two-factor authentication using an authenticator app or security key rather than SMS when possible.
8. Run Security Checkup (available in the same Password and security section) to review login alerts, connected apps, and other settings.

Additional recovery tips

• Check your email for messages from Facebook or Meta about password changes or new contact information. Verify the sender domain is facebookmail.com, metamail.com, or an official Meta domain.
• Review your Activity Log for posts, messages, or friend requests you did not create and delete them.
• If the attacker changed your recovery email or phone number, the facebook.com/hacked flow remains the correct path; Meta will ask for alternative verification.

2. Report Phishing Attempts and Suspicious Messages

Phishing remains one of the most common ways accounts are compromised. Attackers frequently impersonate Meta support, send fake “account will be deleted” warnings, or attach PDF files that lead to credential-harvesting pages.

Immediate actions

1. Do not click any links or open attachments in the suspicious message.
2. Report the account as compromised at www.facebook.com/hacked even if you have not entered any credentials yet (preventive measure).
3. In the Facebook or Messenger app, open the conversation, tap the sender’s name or profile, and choose Report or Something’s wrong. Select the closest reason (scam, impersonation, etc.).
4. Block the sender.
5. Forward suspected phishing emails to phish@fb.com.

Recognizing official Meta communications

Legitimate messages from Meta come only from domains such as facebook.com, fb.com, facebookmail.com, meta.com, metamail.com, or their subdomains. Meta will never ask for your password in an email or message, nor will it send a password as an attachment.

3. Report Technical Security Problems or Bugs in the Facebook App

If a security feature itself is broken (login alerts not arriving, two-factor authentication failing, “Where you’re logged in” not loading, etc.), report it as a technical problem so Meta’s engineering teams can investigate.

Method 1 – Shake to report (fastest on mobile)

1. Reproduce the problem or return to the screen where it occurs.
2. Shake your phone.
3. Tap Report problem.
4. Choose whether to include diagnostic data and screenshots.
5. Describe exactly what happened, the steps to reproduce it, and your device model and operating system version.
6. Tap Send.

Method 2 – Through Help & Support

1. In the Facebook app, tap Menu (☰).
2. Scroll down and tap Help & support (or Help and Support).
3. Tap Report a problem → Something Isn’t Working (or Continue to report a problem).
4. Select the relevant product/feature category.
5. Describe the issue in detail, attach screenshots if possible, and submit.

Providing clear reproduction steps and screenshots significantly increases the usefulness of the report.

4. Report Suspicious Profiles, Posts, Pages, or Ads

For content or accounts that appear malicious but have not (yet) compromised your own account:

• On a post, Reel, or comment: tap the three dots (⋯) → Report → choose the reason (scam, harassment, impersonation, etc.).
• On a profile or Page: open the profile → three dots or “Find support or report” → select the appropriate category (Pretending to be someone, Scam, etc.).
• For Marketplace listings: open the listing → Options → Report listing → Scam.

Reports are reviewed against Meta’s Community Standards. The person or Page you report is not notified of your identity.

5. Use Meta Accounts Center for Ongoing Security Monitoring

Accounts Center is the modern hub for all Meta accounts linked to your profile (Facebook, Instagram, etc.). Key security sections include:

• Password and security – change password, two-factor authentication, where you’re logged in, login alerts, Security Checkup.
• Connected experiences and apps – revoke access to any third-party app you no longer trust.
• Personal details – verify that email and phone numbers are still under your control.

Make it a habit to open Accounts Center at least once a month and run Security Checkup.

6. What Happens After You Submit a Report

Meta reviews reports using a combination of automated systems and human reviewers. Response times vary:

• Technical “something isn’t working” reports are used to improve the product; you may not receive a personal reply unless more information is needed.
• Compromised-account reports often result in temporary locks, identity checks, and password-reset flows. Many users regain access within hours to a few days when they follow the guided process on a familiar device.
• Content and impersonation reports are evaluated against Community Standards. You can check the status of some reports by visiting facebook.com/support while logged in.

If your account remains locked longer than expected, return to the same recovery flow and provide any additional requested information promptly.

7. Proactive Steps to Reduce Future Risk

Reporting is reactive. Prevention is stronger:

• Enable two-factor authentication with an authenticator app or hardware security key.
• Turn on login alerts so you are notified of new device or location logins.
• Use a unique, long password (or passkey where supported) and a reputable password manager.
• Regularly review “Where you’re logged in” and log out unused sessions.
• Be skeptical of any message that creates urgency (“your account will be deleted in 24 hours”) or asks you to click a link to “verify” information.
• Keep the Facebook app updated so you receive the latest security patches and scam-detection features.

8. Special Cases

Business or Page accounts: If a Facebook Page you manage has been taken over, use the dedicated Page recovery form available through Meta Business Support or the Help Center after securing your personal profile.

Impersonation of you: Go to the fake profile → Find support or report → Pretending to be someone. You may be asked to upload a government ID for verification. There is also a public form for cases where you cannot log in or the impersonator has blocked you.

Marketplace or payment fraud: Report the listing or the other party as a scam through the Options menu, then contact your bank or payment provider if money has already moved.

If a crime has occurred: In addition to reporting inside Facebook, contact local law enforcement. Meta cooperates with valid legal requests.

Frequently Asked Questions

Can I report a security issue without logging in?
Yes. The facebook.com/hacked page and certain Help Center forms work even when you are locked out. Use a device you have previously logged in on whenever possible.

Does Meta tell the other person I reported them?
No. Content and profile reports are anonymous to the reported party.

How long does account recovery take?
It varies by case. Many straightforward compromised-account reports are resolved within hours to a couple of days when users complete the guided steps promptly.

Should I use third-party “Facebook recovery” services?
No. Only use official Meta channels (facebook.com/hacked, Accounts Center, Help & Support). Third-party services frequently lead to further scams.

What if the Facebook app itself is behaving strangely after a security event?
Update the app, clear its cache (Android) or reinstall if necessary, then report the remaining technical issue via Shake or Help & Support.

Final Checklist – Act Now If You Suspect a Problem

1. Go to www.facebook.com/hacked on a familiar device.
2. Change your password and log out unknown sessions via Accounts Center → Password and security.
3. Enable or strengthen two-factor authentication.
4. Report any phishing messages and the sending accounts.
5. Run Security Checkup.
6. Monitor your email and Facebook notifications for the next few days.

Staying calm and following Meta’s official flows is the fastest way to regain control and limit damage. The tools described in this guide reflect the current processes available in the Facebook mobile app and on the web as of mid-2026. Meta continues to refine its security and support systems, so always check the in-app Help & Support section for any newly added options.

By reporting security issues and suspicious activity promptly, you protect not only your own account but also help Meta detect and disrupt larger campaigns that target millions of users.

Written by App World Team for https://www.appworld.work. This article is based on publicly available Meta Help Center documentation and recent platform updates. Always verify critical recovery steps on official Meta domains.

© 2026 App World. All rights reserved.