The first thing you should do if you suspect that your Facebook account has been compromised is to change your password. Then, if you use Facebook to sign in to apps such as Spotify or Instagram, change those logins as well. This will stop hackers from gaining access to these third-party apps through your compromised Facebook account.

Hackers can access a digital rights management wealth of personal information in hacked Facebook accounts. Hackers could use this information for malicious purposes, such as taking credit card numbers and spamming people with fake credit card offers or scams using phishing. Hackers may also use compromised accounts to send out spam messages or post on your timeline (as as if it was you who made the mistake).

One of the most popular ways hackers can gain access to an account is to exploit a flaw in Facebook’s app code. For example, a bug in iOS’s Facebook app allowed hackers to hack cookies and take an iPhone user’s so-called “access token.” These tokens are digital keys that give them full control of the user’s Facebook account and because of Single Sign-On, any other websites that the user connects to using their Facebook credentials.

Hackers may also gain access to a user’s account through brute force attacks. This method involves figuring out passwords, generally the most common ones like 1234567890 or 123456789. Hackers also gain access to accounts by scanning compromised credentials. There are several free tools that can be used for scanning for stolen data, including a popular website called HasbeenPwned.