Messenger says a key changed. Does that mean I was hacked?
The short answer
Not necessarily. Meta’s explanation dated November 20, 2025 says adding or re-registering a device can change its key. It also describes automatic key verification for one-to-one chats, while retaining manual checks. This guide is for people who can open the relevant end-to-end encrypted chat. It does not recover account access.
What this answer is based onWhat to do
Have your device, the alert text and an independent way to contact the person ready, such as a long-established phone number. Compare public device-key information, never passwords, login codes or recovery PINs.
- Open the details of the specific conversation and check its end-to-end encryption status. Look for the key-verification option the app offers. Meta’s 2023 technical paper describes this area; we have not tested the current menu labels in your account. A missing option is not proof of a hack.
- For a manual check, contact the person through an independently known channel. Compare the displayed device list and identity-key information for each corresponding device. Meta’s paper says devices need separate verification. Do not check just one phone if other devices are listed. Compare information for the same device with what its owner sees; your phone’s key is not expected to match your contact’s phone key.
- If available, enable key-related alerts in privacy and security settings. If comparison fails or a device remains unexplained, pause sensitive exchanges and payments. Keep the warning text without secrets; use the app’s offered problem-reporting option for a technical error, or the unknown-login guide if your own account has an unfamiliar login. Do not reset chat storage to check a key.
The situation
Illustrative example: a friend changes phones and Messenger shows an alert. Confirm the device change using their known number rather than immediately assuming a takeover.
The situation and an improvement
Treat every key change as proof of an account takeover.
Confirm the device change and check its keys separately.
More examples
A new phone and a changed key
Illustrative example: the other person has genuinely replaced their phone.
What to do
Confirm this independently and, if needed, check the corresponding device keys again.
An urgent payment request
Illustrative example: the key check succeeds, but a friend sends an unusual request for money.
What to do
Verify the request through a separate call. A key check does not establish the circumstances behind a message.
What this answer is based on
Engineering at Meta · Messenger key transparencyengineering.fb.comMeta · Messenger End-to-End Encryption Overview (2023), p. 25Guide based on Meta’s materialReview details
Source reviewed:
We read the official source listed for this topic. Other Meta rules are reviewed separately.
Public primary sources read on November 2, 2026: Meta Engineering, November 20, 2025, and the December 6, 2023 technical paper, page 25. This is not a new launch today or an independent audit. Authenticated menus and availability by country and device were not tested. Precautionary actions when uncertain are ClearRules guidance.
Material published: November 20, 2025
Include the guide link, language and wording that needs checking. Add an official source link if you have one. Do not send passwords, login codes or photos of identity documents.
Examples are made up to explain the guidance. Meta decides individual account and content cases.
Sources and related topicsPolicy Graph · Demo in development