Finding out your business account has been hacked is horrible. Suddenly someone else is posting as you, messaging your customers or, worse, running ads on your card.
The good news is that most accounts can be recovered if you act quickly. This guide covers the signs your account has been hacked, what to do in the first hour, how to recover accounts on Facebook, Instagram, X and LinkedIn, and how to stop it happening again.
The first five minutes matter most
If you can still log in, change your password and turn on two-factor authentication straight away, then log out of every other session.
If you can't log in, go straight to the platform's hacked account page. The sooner you start, the more likely you are to get the account back.
How to tell your account has been hacked
Any one of these is worth checking straight away.
You can't log in
Your password no longer works, even though you know it's right.
Emails you didn't expect
Messages saying your email, phone number or password has changed.
Posts you didn't write
Strange links, offers or messages appearing on your page.
Unknown admins
New people with access to your business page or ad account.
Ads you didn't create
Unexpected charges or campaigns in your ad account.
Customers asking questions
"Did you just message me?" is often the first sign.
What to do in the first hour
Work through these in order.
Change the password on the email linked to your accounts first. It's the key to everything else.
Use the platform's hacked account page, linked below.
Check who has access to your page and ad accounts, and remove anyone you don't know.
Look for ads or charges you didn't make and contact your bank if needed.
Post on your other channels warning people not to click links or reply to messages.
Where to go to get your account back
Each platform has its own recovery process. Use the official pages only.
Go to facebook.com/hacked and follow the steps to secure your account.
Go to instagram.com/hacked. You may be asked for a video selfie to prove it's you.
Facebook and Instagram business pages
Check who has access in Meta Business Suite and remove anyone you don't recognise.
X (formerly Twitter)
Use the password reset, then X's help centre form for hacked or compromised accounts.
Use LinkedIn's help centre to report a hacked account and reset your password.
Google Business Profile
Check the people and access settings and remove unknown owners or managers.
How to stop it happening again
Do
- Turn on two-factor authentication, ideally with an authenticator app
- Use a different strong password for every account
- Use a password manager
- Have at least two trusted admins on every business page
- Give agencies and staff access through business tools, not your password
- Check who has access every few months
Don't
- Click links in messages about copyright breaches or page deletion
- Share your password with anyone
- Use the same password on more than one account
- Give admin access to people who only need to post
- Ignore emails about login attempts
- Connect apps you don't recognise
Keep your accounts in safe hands
We work through proper business access tools, so we never need your password, and we keep an eye out for suspicious activity on the accounts we manage.
Find out more about our social media management plans, including Facebook, Instagram and X management.
Hacked account FAQs
How do I recover a hacked Facebook or Instagram account?
Go to facebook.com/hacked or instagram.com/hacked and follow the steps. You may be asked to confirm your identity, for example with a video selfie on Instagram. Act quickly, before the hacker changes more details.
Why do hackers target business pages?
Business pages have followers to scam, and they're often linked to ad accounts with payment details. Hackers use them to run ads, sell fake products or send scam messages to customers.
What's the most common way business accounts get hacked?
Phishing. Fake messages claiming your page will be deleted for a copyright breach or policy violation link to a fake login page. Facebook and Instagram won't ask for your password in a message.
What's the best way to protect my business accounts?
Turn on two-factor authentication with an authenticator app, use a different strong password for every account and have at least two trusted admins on your business pages.
Can an agency help keep my accounts secure?
Yes. A good agency works through proper business access tools rather than your password, and can help you spot problems early. Our social media management plans keep access secure.
