Short answer: open Facebook’s Security Checkup from the official app or facebook.com, review account security, and enable alerts for logins from devices or browsers Facebook does not recognise. Then review active sessions and turn on two-factor authentication so an alert is not your only protection.
Use the official Security Checkup
Type facebook.com directly or open the official Facebook app. Go to Settings and privacy, then look for Accounts Centre, Password and security, or Security Checkup. Menu names can vary as Meta updates the app. Avoid links in messages claiming that your account will be disabled; navigate to settings yourself.
Security Checkup can recommend a password review, two-factor authentication, and login alerts. Confirm that the email address and mobile number on the account belong to you and are still accessible.
Enable alerts and choose a reliable destination
Under Password and security, find login alerts or alerts about unrecognised logins. Turn on the available notification methods. Email is useful even if the Facebook app is signed out; SMS may help when data is unavailable, but delivery can be delayed. Keep at least one recovery channel independent of the phone that usually runs Facebook.
Meta says it may use an email address or number added for login alerts to help protect and recover the account. Read the current privacy explanation before adding a new contact method.
Review where you are logged in
Open the section showing recent sessions or where you’re logged in. A city can be approximate because mobile networks and VPNs may route traffic elsewhere, so compare the device type, browser, time, and activity as well. Log out of a session you do not recognise, then change the password from a trusted device.
If you use private browsing or regularly clear cookies, Facebook may treat the same computer as new and send repeated alerts. That is not automatically an attack, but every alert deserves a quick check.
Add stronger protection
Turn on two-factor authentication with an authenticator app or another method offered by Facebook. Save recovery codes somewhere secure and offline. Use a unique passphrase that is not shared with email, banking, or e-wallet accounts. Check that your email account also has strong protection, because it may be used to reset Facebook.
For a broader response plan, see the PHWhy guide on what to do if a Facebook account is hacked.
How to verify alerts are working
Review the settings screen and confirm the selected email or number. Meta may not provide a safe “send test alert” button in every version. Instead of forcing suspicious logins, check that normal Facebook security emails arrive and that messages come from a legitimate Meta domain. Never enter a password through an alert email link when you can open Facebook directly.
Keep screenshots of the enabled settings, but hide email addresses, phone numbers, QR codes, and recovery codes before sharing them with support.
What to do when an alert is not yours
Use the official app or type facebook.com, review the session, log it out, change your password, and run Security Checkup. Remove unknown contact details or connected apps. If the same password was used elsewhere, change those accounts too, starting with email. Scan devices if you installed a suspicious app or browser extension.
When to contact Meta
Use Facebook’s official account-recovery flow if you cannot log in, contact information was changed, or an unknown administrator controls a Page or business account. Do not pay a social-media “recovery agent”; Meta does not need your password, OTP, or authenticator code to review a report.
Philippines-specific tips
Keep your registered SIM active and update recovery details before changing numbers. If an alert is followed by requests for GCash, Maya, bank transfers, or OTPs, warn close contacts through another channel. Report financial fraud promptly to the provider and relevant Philippine authorities while preserving screenshots and transaction references.
