In our continued battle against cyber criminals, one of the biggest challenges we face is helping people whose accounts have been compromised by spammers understand how it happened and how to fix the problem. The vast majority of people who use Facebook have never experienced a security problem. For the small number who do, knowing how to fight back is key.

It can be an embarrassing experience to log in to Facebook to find that unauthorized messages have been sent from your account and then face questions from friends who have received spam from you.

We've spent the last few months improving the way to guide people through the process of regaining access to their account after it's been compromised and used to send spam. Currently, we send emails explaining what happened and provide links to remedy the situation. Now we're moving towards a new model that also involves clear and simple steps taken within Facebook itself. In doing so, we can ensure that the person logging in is the true owner of the account, thereby preventing hackers from using it to send spam in the future.

Going forward, we'll continue to send a notification email to the tiny percentage of people whose Facebook accounts have been compromised. What's new is that when these people try to access the site, they'll first see a page explaining what happened, as shown below.