Your business Facebook or Instagram was hacked: what to do in the first hour

A customer messages to ask why you're selling cheap sunglasses. Or your login stops working, and the email address on the account is one you've never seen. Or your card statement shows $2,000 of ads you didn't run.

Someone else is in your business's Facebook or Instagram. For a lot of small businesses, that account is the shop window, the booking line and half the marketing budget, so treat it as an emergency.

This is the plan for the next hour, in order.

First: where is the money?

If the account is connected to Meta ads, an attacker's first move is often to run their own ads on your card. Before anything else, call your card company and tell them there are fraudulent charges from Meta. Ask them to block further charges from that merchant, or to cancel the card. You can sort out the refund later; stopping the next charge matters now.

The first fifteen minutes: get back in

1. Secure the email account first. Whoever controls the email address on your Facebook or Instagram account can reset everything else. Change that email password from a device you trust, sign out of all sessions, and turn on two-step sign-in. If the attacker got into your email too, start with what to do when your work email is hacked.

2. Use Meta's own recovery pages, typed in by hand.

• Facebook: go to facebook.com/hacked
• Instagram: go to instagram.com/hacked

If Instagram emailed you about a change of email address, that message usually includes a link to reverse the change. Use it, but only from the real email, and check it came from Instagram before you click.

Meta may ask you to confirm who you are, sometimes with a short video selfie. It can take a day or more. Keep going with the steps below while you wait.

3. Ignore anyone offering to "recover" your account. Hacked businesses get flooded with messages and comments from "Meta support" and "recovery experts." Meta has no phone support line for this, and it won't message you about account security in your inbox or direct messages. Anyone asking for money, your password or a code is the second scam.

Fifteen to forty-five minutes: find what they changed

Once you're back in, assume the attacker left a way back. Look through Meta Business Suite, under Settings.

4. Remove people and partners you don't recognize. Attackers add themselves as admins, then remove the real owners. Check People, and also Partners. A partner business connected to your Page can keep access after you change every password.

5. Check the ad account. Pause any campaign you didn't create. Remove unfamiliar people with ad access. Look at Payment methods and remove any card or account that isn't yours, and note what was spent for your dispute.

6. Check the Page and profile details. Contact email, phone number, website link, the link in your Instagram bio. Attackers swap these to send your customers somewhere else.

7. Remove apps you don't know. Look at apps and websites connected to the account and remove anything you don't use. A connected app keeps its permission after a password change.

8. Turn on two-step sign-in for every admin, not just you. One admin without it is the door. Use an authenticator app rather than text messages where you can.

Forty-five to sixty minutes: tell people

9. Warn your customers, briefly. A short post or story from the recovered account, and a line on your website or Google Business Profile if the account was used to message people:

Our Facebook and Instagram accounts were accessed by someone else between [date] and [date]. If you received a message, offer or link from us in that time, please ignore it. We will never ask for payment through social media messages. Questions? Call us on [number].

10. Report the fraud. File a report at ic3.gov, especially if money was taken or customers were targeted. Keep screenshots of the ads, messages and changes before you delete them. Your card company and Meta may both ask for them.

How they got in

Almost always one of these:

• A fake "copyright" or "policy violation" message. It says your Page will be disabled unless you appeal through a link. The link is a fake Meta sign-in page.
• A reused password. The one on Facebook was also used on a site that was breached. See passwords on the dark web.
• A former employee or agency who still had admin access, whose own account was then taken over.
• No two-step sign-in on one of the admins.

What stops the next one

• Two-step sign-in on every account that can touch the Page, including the email accounts behind them. See why multi-factor authentication comes first.
• The fewest admins possible. Give people the lowest role that lets them do their job, and remove access the day someone leaves. Our same-day offboarding checklist covers social accounts too.
• A password manager, so every account has its own long password, and a reused one can't open the rest.
• Staff who recognize the fake "your Page will be deleted" message. See security awareness training that works.
• A spending limit on the ad account, so a takeover can only cost so much.

What it costs, against what's at stake

	What it comes to
Our Business plan for five people	$745 a month. Includes email security, multi-factor authentication on your Microsoft 365 or Google accounts, and training staff to spot fake messages.
Fraudulent ad spend	Whatever limit was on the card, plus the time it takes to dispute
A week without your account	The bookings, orders and messages that would have come through it
Your customers' trust	The scam messages they received in your name

We don't manage Facebook or Instagram for you; that's your marketing. What we do is lock down the email accounts, passwords and computers that attackers use to get into them, which is where most takeovers start.

If this is happening right now

Work through the steps above. Once you're back in control, book a free Security Check and we'll go through what would have stopped it. While you're thinking about it, check the other account customers find you through: see what to do if someone takes over your Google Business Profile.