Recover a Hacked Business Social Media Account and Lock It Down

TL;DR — If your business social media account was taken over, do three things first: preserve evidence, start the platform's official recovery flow, and secure the email account and phone number tied to the profile. The most common reason recovery fails is that the attacker still controls the linked email, phone, or another admin seat, so remove their access before you treat the incident as closed. Reading time: ~5 min

Goal

When you finish, your business social media account is back under your control, the attacker no longer has access, your legitimate admins are restored, and the account is protected with a new password, two-factor authentication (2FA, a login code after your password), and a checked list of recent changes.

Prerequisites

• Access to the email inbox currently or originally linked to the social media account
• Access to the phone number linked to the account, if one was added
• A photo ID and business documents if the platform asks for identity or business verification
• A password manager, or a secure place to store a new unique password
• Access to your business records: exact account handle, profile URL, creation date if known, billing receipts for ads if applicable
• Access to any linked business tools: Meta Business Manager, Google account, Apple ID, Microsoft account, or other single sign-on (SSO, sign-in with another account)
• A second trusted person from your business who should keep admin access after recovery
• A device you have used to log in before, if available; recovery systems often trust familiar devices more

Steps

Step 1: Preserve evidence before changing anything

⚠️ Do this first. Screenshots, emails, and timestamps help with platform recovery, insurance claims, legal follow-up, and ad-spend disputes. If you skip this, you may lose proof when the attacker deletes messages or changes settings again.

Capture these items now:

• Screenshot the profile page, including the handle, display name, and any suspicious posts
• Screenshot password reset emails, login alerts, and "your email was changed" messages
• Screenshot the list of current admins, page roles, or connected business assets if you can still view them
• Save the profile URL and suspicious links in a note
• Write down the first time you noticed the takeover

What you should see when this succeeds: you have a folder with screenshots and a note containing dates, profile URLs, and any attacker changes.

Step 2: Secure the linked email account first

If the attacker controls the email inbox, they can usually retake the social account after you recover it.

Use your email provider's security page. In your provider's dashboard, go to the security area (for example: Security or Account → Security), then do these literal actions:

• Change the email password to a new unique password
• Turn on 2FA
• Review recent sign-ins and click "Sign out" or "Log out" on unknown sessions
• Remove unknown recovery email addresses and phone numbers
• Check mail forwarding and filters; delete any rule that forwards or hides security emails

If you use Gmail, the usual path is:

Google Account → Security → Password
Google Account → Security → 2-Step Verification
Gmail → Settings → See all settings → Forwarding and POP/IMAP
Gmail → Settings → See all settings → Filters and Blocked Addresses

If you use Microsoft 365 or Outlook, the usual path is:

Microsoft Account or Entra admin center → Security
Outlook → Settings → Mail → Forwarding
Outlook → Settings → Mail → Rules

What you should see when this succeeds: the email account shows your new password, 2FA is enabled, and no unknown forwarding rules or recovery methods remain.

Step 3: Start the platform's official account recovery flow

Use the platform's own "My account was hacked" or "I can't access my account" flow. In the login screen or help center, choose the recovery option for a compromised account, then enter:

Your exact username or profile URL
Your original email address
Your current reachable email address
Your linked phone number

If the attacker changed the email address, open the security email that says the email was changed and click the reversal link if it is still valid.

What you should see when this succeeds: you receive a case number, recovery email, or identity check request from the platform.

Step 4: Reset the password and sign out other sessions

Once the platform lets you back in, immediately change the password and force other devices out.

Use the platform's security settings. The usual path is:

Account/Profile → Settings → Security → Password
Account/Profile → Settings → Security → Where you're logged in / Sessions / Devices → Log out of all other sessions

Set a new password with this pattern:

4 random words + 2 numbers + 1 symbol
Example: River-Lemon-Atlas-Window42!

What you should see when this succeeds: the account accepts the new password and shows only your current device, or prompts other devices to sign in again.

Step 5: Remove the attacker from admins, roles, and connected apps

⚠️ This is the step people miss most often. If the attacker still has an admin role, page role, business asset role, or connected app token, they can return without the password.

Open each of these areas and remove anything you do not recognize:

Settings → Security → Active sessions / Devices
Settings → Account Center or Accounts → Linked accounts
Settings → Business settings / Page roles / Admins / People
Settings → Apps and websites / Connected apps / Integrations
Settings → Ad account / Billing / Payment methods

Delete or remove:

Unknown admin users
Unknown partner businesses
Unknown connected apps
Unknown payment methods
Unknown phone numbers and email addresses

What you should see when this succeeds: only your approved people, devices, apps, and payment methods remain.

Step 6: Turn on 2FA and add a backup recovery method

In the social platform's security settings, enable 2FA and save backup codes.

Use this path if available:

Settings → Security → Two-factor authentication → Authenticator app
Settings → Security → Backup codes → Download or Copy

Prefer an authenticator app over SMS if the platform offers both.

What you should see when this succeeds: the platform shows 2FA as enabled and gives you backup codes to store securely.

Step 7: Check for damage and reverse business-impacting changes

Review the account for changes the attacker made.

Check these areas:

Profile → Posts / Reels / Videos / Stories
Settings → Profile information
Settings → Messaging / Auto-replies
Settings → Ads / Promotions / Billing
Settings → Linked accounts / Cross-posting

Reverse anything suspicious:

Delete scam posts
Remove malicious links from bio/profile
Pause active ads you did not create
Remove unknown billing methods
Restore your business name, logo, and contact details

What you should see when this succeeds: the public profile matches your business again and no unauthorized ads or posts remain.

Step 8: Re-add the right people and document the incident

Add back one trusted coworker as admin, then record what happened.

Use the platform's admin or page-role area:

Settings → Business settings / Page roles / People → Add person
Role: Admin

Record this in your incident note:

Date and time discovered
How access was recovered
What the attacker changed
What was removed or restored
Which email, phone, and admins are now authorized

What you should see when this succeeds: a second trusted admin can log in, and you have a short incident record for future audits or disputes.

[You] ---- 1. secure email ----> [Email Account]
  |
  | 2. start hacked-account recovery
  v
[Social Platform] ---- 3. reset password ----> [Your Account]
  |
  | 4. remove attacker sessions/admins/apps
  v
[Clean Account] ---- 5. enable 2FA ----> [Protected Account]

Verify it works

Run these checks end to end:

• Log out of the social platform on your device
• Log back in with the new password
• Complete the 2FA prompt successfully
• Open the security page and confirm there are no unknown sessions
• Open admins/page roles and confirm only approved people are listed
• Open billing or ads and confirm there are no unknown payment methods or active campaigns
• Ask your second trusted admin to log in and confirm their access works
• Wait 30 minutes, then refresh the security page again to confirm no unknown device has reappeared

What you should see: login works with your new password and 2FA, only approved admins and devices remain, and no unauthorized ads, posts, or billing items return.

Common pitfalls

The linked email is still compromised

Mistake: You recover the social account before changing the email password.

Symptom: The attacker resets the password again within minutes or hours.

Fix: Change the email password first, enable 2FA there, and remove forwarding rules and unknown recovery methods.

The attacker still has an admin or business role

Mistake: You changed the password but did not check page roles, business settings, or connected partner access.

Symptom: Unknown people still publish posts, run ads, or change settings.

Fix: Open the admins/business roles area and remove every person or partner you do not recognize.

A connected app still has access

Mistake: You forgot to revoke third-party apps or cross-posting tools.

Symptom: Spam posts continue even after password reset.

Fix: Open "Apps and websites" or "Connected apps" and remove unknown integrations.

You rely only on SMS for 2FA

Mistake: You turn on text-message codes only, and your phone number later gets ported or intercepted.

Symptom: You lose access again even with a strong password.

Fix: Switch 2FA to an authenticator app and save backup codes offline.

You skip billing and ad account review

Mistake: You recover posting access but do not inspect ads, payment methods, or invoices.

Symptom: Charges continue after the account looks normal.

Fix: Open the ad account and billing pages, pause unknown campaigns, and remove unknown cards or bank methods.

You close the incident too early

Mistake: You stop after the first successful login.

Symptom: The attacker returns through a cached session, linked account, or another admin seat.

Fix: Recheck sessions, admins, linked accounts, and billing after 30 minutes and again the next business day.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.