What to do if your business social media account is hacked

Most social media takeovers start with, or end with, control of the email address on the account. If an attacker can read that inbox, they can reset every password you change. So start there: change the email account's password from a clean device, sign out all sessions, check for forwarding rules and filters, and make sure MFA is on with a method the attacker hasn't changed.

If the email account is a work Microsoft 365 or Google Workspace mailbox, have IT check it properly; see What to do if a Microsoft 365 account is hacked.

Use only the platforms' own recovery pages. Search for them directly rather than clicking links in messages; 'recovery services' that contact you in comments or DMs are almost always scams.

• In Meta Business settings, review everyone with access to the Page, Instagram account and ad accounts. Remove anyone you don't recognize, and any partner business you didn't approve.
• Check connected apps and integrations, and remove ones you don't use.
• Reset passwords and turn on two-factor authentication for every remaining admin, preferably with an authenticator app or security key.
• On LinkedIn, review Page super admins and content admins.
• Review recent posts, messages and changes to the page name, URL and contact details.

Attackers use hijacked business accounts to message followers with fake giveaways, 'verify your account' links, cryptocurrency offers or payment requests. Once you have control, post a short notice; if you can't, use your website, email list and other channels.

Suggested wording: "Our [platform] account was accessed by someone else between [dates]. Please ignore any messages or posts from us in that period asking for payment, logins or personal details. We never ask for payment through direct messages. If you clicked a link or sent money, contact your bank and report it at reportcyberandfraud.canada.ca."

Hijacked ad accounts are often used to run scam ads charged to your card. Check billing and ad history, pause unknown campaigns, remove payment methods you didn't add, and call your card issuer about fraudulent charges. Report the unauthorized ad spend to the platform through its business support channels and keep screenshots of everything.

• Keep at least two trusted admins, using personal accounts with strong MFA, and remove former staff and agencies promptly.
• Register social accounts to a role mailbox the company controls (with MFA), not a former employee's address.
• Don't share passwords; give each person their own access through the platform's business tools.
• Train admins on fake 'copyright violation' and 'page will be disabled' messages, a common phishing lure aimed at page managers.
• If customers lost money or personal information was exposed, call our 24/7 line at (289) 582-9930.