Recovering a Hacked Business Social Account

Why this matters

A hijacked business page is not just an embarrassment. The thief can message every follower as you, run ads on the card saved in the ad account, post a fake "50 percent off, pay by link" promotion that collects card numbers, or simply delete years of reviews and photos. The recovery is slow and the platform's support is mostly automated, so the order you do things in decides whether you are back in a day or locked out for a month. This article is the account-specific path; the general first hour of a suspected breach is its own procedure. See related: The First Hour After a Suspected Breach SOP.

First, understand what was actually taken

Most business pages are not accounts in their own right. They are assets owned by one or more personal accounts (the platform's term is usually admin, owner or manager), and the business page has no password of its own. That changes where the attack happened and where the recovery starts.

• If a personal admin account was taken over, the thief logged in as your office manager or as you, then added himself as an admin of the page and often removed everyone else. Recovery starts with the personal account, then the page.
• If the page was handed over through a fake "verification" or "copyright violation" message, someone clicked a link and approved a request that gave another business account control. Recovery runs through the platform's business support, because no personal password was stolen.
• If the login was a shared username and password for the business (common on platforms that do not use the admin model), the account itself was taken, and recovery runs through that account's own reset.

Before you start, spend five minutes establishing which of the three it is: who still has access, who is listed as admin, and what the last message or email from the platform said. The rest of the steps depend on it.

The recovery, step by step

1. Check every device for a session that is still logged in. Phones and tablets often stay signed in for weeks. If anyone on the team still has the page or the admin account open on any device, that session may let you change the password, remove the thief and turn on multifactor authentication before he notices. Skip it and you may go through a two-week identity process to regain an account you were still logged into on a tablet in the truck.

2. Secure the email account behind the social account first. The FTC's hacked-account guidance puts the email first for the same reason. The recovery email for the admin account is the key to everything. If the thief got the social login, assume he may have the email too, especially if the passwords were the same. From a clean device, change that email password, turn on multifactor authentication, sign out all other sessions, and check the email's forwarding rules and filters for anything that sends platform messages to another address or straight to trash. Skip it and every reset code you request goes to the thief as well, and he resets it back faster than you can.

3. Use the platform's own recovery flow from a device and network it already knows. Start the "hacked account" or "can't log in" path from the official app or site, typed in yourself, not from a link in any message. Use a phone or computer the account has logged in from before, on the office or home network, because platforms weigh familiar devices and locations heavily when deciding whether you are the owner. Skip it and a recovery attempt from a new laptop at a coffee shop can look like the second attacker.

4. Prove identity with what the platform asks for, exactly as it asks. Expect some combination of a government ID matching the account name, a video selfie turning your head, a code sent to an old email or phone, and for the business side, documents showing you own the business (a business license, a utility bill or bank statement in the business name, the domain's email). Have the documents ready as clear photos before you start. Submit once, completely; repeated partial submissions can reset the queue. Skip it and a blurry ID or a mismatched name puts you at the back of the line.

5. Warn customers through every channel you still control. While recovery runs, post on your other platforms, add a line to your website and send a short text or email to recent customers: our page on that platform was taken over, do not pay any link or respond to any messages from it, call the office at the number on your invoice. Skip it and the thief's "flash sale" collects cards from your most loyal customers under your name while you wait in a queue. See related: Customers Got Texts Pretending to Be Your Company.

6. Stop the money leak on the ad account. If the page has an ad account with a card attached, call your card issuer and ask about blocking charges from the platform, or freeze the card, the moment you know the page is compromised. A thief with ad access can spend in hours what the shop spends in months. Dispute the charges with the issuer once recovery is underway and report them through the platform's ad support, which is often a faster, human channel than the general recovery queue. Skip it and you discover the spend on the next statement.

7. Once you are back in, clean every role, not just the password. Open the page's admin or roles list and remove every person and business account you do not recognize. Remove former employees while you are there. Check connected apps and partner businesses and remove anything unfamiliar. Restore any changed details: the website link, phone number, address and the business name itself, which a thief sometimes edits so customers call him. Skip it and a secondary admin the thief added quietly is still there, and he walks back in next week.

8. Lock it down so the same attack does not work twice. Turn on multifactor authentication with an authenticator app (not text message, which can be redirected) on every admin account, see related: Turning On Multifactor Authentication Without Locking Yourself Out. Give the page at least two admins who are real people at the shop, so one compromised or departed account cannot orphan it. And change the recovery email for each admin to an address the shop controls on its own domain, used for nothing else and protected by its own multifactor authentication.

The recovery email deserves its own paragraph because it is the root cause in most of these cases. The typical setup is an owner's personal email from fifteen years ago, with a reused password, sitting in a data breach list, as the recovery address for a page that now carries the whole business. That address was the actual door. An address the shop controls, such as social@ on your own domain, with a unique password in the shop's password manager and multifactor authentication, closes it.

Worked example: a lawn care shop loses its page on a Friday afternoon

A lawn care shop with about 4,000 followers runs its page from two admin accounts: the owner's personal account and the office manager's. Friday at 3 p.m., a customer calls asking about the "end of season half-price special" with a "pay now" link. The office manager tries to open the page and gets "you no longer have access."

Establishing what was taken (3:10 p.m.). The office manager's personal account still logs in, but she is no longer an admin of the page. The owner's account is logged out and its password no longer works. On Tuesday, the owner had received a message saying his page would be deleted for a copyright violation unless he "verified" through a link; he had entered his login there. So: a personal admin account taken over, then the page captured, and the owner removed.

Step 1 (3:15 p.m.). Nobody has a live session on the owner's account. The truck tablet that ran the page had been signed out by the thief's password change. No shortcut.

Step 2 (3:25 p.m.). The owner's account recovery email is an old personal address with the same password as the social account. The owner gets into it before the thief has changed it, changes the password, adds multifactor authentication, signs out all sessions and finds a filter, created Tuesday, that moved every email from the platform straight to trash. That filter is why he never saw the "password changed" warning. He deletes it.

Step 6 before steps 3 and 4 (3:40 p.m.). The order here is deliberate: money first, because recovery will take days and spend accrues by the hour. The card on the ad account is the shop's business card. The owner calls the issuer and freezes it. The issuer shows two pending platform charges from that morning, both new. He disputes them on the same call.

Steps 3 and 4 (4:00 p.m.). From his own phone on the home network, the owner starts the hacked-account recovery. Because his email is now secured, the reset code reaches only him. The platform also asks for a video selfie, which he completes. The page itself is a separate recovery: he submits a business ownership request with a photo of the business license and a utility bill in the shop's name.

Step 5 (4:30 p.m.). The office manager posts on the shop's other platform and texts the 600 customers on the active service list: the page was taken over, there is no special, do not click anything from it, call the office. Over the weekend, eleven customers call; two had entered card numbers and are walked through calling their card issuers.

Outcome. The owner's personal account is restored Saturday morning, about 18 hours after the call. The page takes until Thursday, six days in total, because the thief had made himself the only admin. On getting it back, step 7 turns up a second admin entry, a business account the thief added, which would have let him back in after a password change alone. The office manager removes it, along with a former seasonal employee who still had editor access from two summers earlier.

Step 8. Both admin accounts move to multifactor authentication by authenticator app. Recovery email for both becomes social@ on the shop's domain. The fake promotion post is deleted and replaced by a short notice that stays pinned for a month.

What would have changed the answer. Had the thief also changed the recovery email's password before 3:25 p.m., step 2 would have become its own recovery and the whole timeline would have stretched by days, which is why that email was the owner's first move, not the social account. Had the office manager's account still been an admin, step 1 would have ended the incident in ten minutes.

How to verify you are actually back

• Every admin listed on the page is a person at the shop you can name, and there are at least two.
• Each admin account has multifactor authentication on and a recovery email the shop controls.
• The recovery email has no filters or forwarding rules you did not create.
• The page's name, phone, website link and address match what is printed on your trucks and invoices.
• The ad account's payment method is one you added, and its recent spend matches only your own campaigns.
• The account's active-sessions list shows only devices you recognize.

If any of those fails a week later, treat it as still compromised and start again at step 2.

References

• FTC guidance on recovering a hacked account (consumer.ftc.gov), for the general sequence of securing email first.
• See related: The First Hour After a Suspected Breach SOP
• See related: Turning On Multifactor Authentication Without Locking Yourself Out
• See related: The Account Inventory Every Shop Should Keep
• See related: The Business Profile Was Hijacked