Hijacked business account on Facebook: how to recover and secure it

You wake up in the morning and on your company’s Facebook Page there are posts you didn’t write, ads paid with your money, or you can no longer log in. That is what a typical takeover of a business account looks like. The faster you react, the greater the chance of recovering the Page and the smaller the losses.

In this guide you get a plan for the first hour after an attack, a description of the most common scam and a security list you can implement in 10 minutes. I write it for people who run a business and don’t have to know IT. I give option names according to the Meta Help Center, as of 22 October 2026. Meta often changes how settings look, so yours may differ slightly.

What a typical attack looks like: a fake “Meta Support”

The most common scenario starts with a message or a comment under a post. The author claims to be “Meta Support” or the “copyright team” and writes that your Page violated copyright or will be blocked within 24 hours. They attach a link to an “appeal form”.

The link leads to a page that looks like a Facebook login. When you enter your password and a code from the app there, the attacker gets access. Then they add themselves as an administrator, remove you and change the account details.

Such messages share common features:

• time pressure: “you have 24 hours”, “the Page will be deleted”,
• a link to a form instead of a request to go to Facebook in the usual way,
• a strange sender: a private profile, a new account or an email address outside Meta’s domains (according to the Help Center, correspondence from Meta comes only from the domains fb.com, facebook.com, facebookmail.com, instagram.com, meta.com and metamail.com),
• a request for a password or a code from a text message or an authenticator app.

Never click links in such messages, even if they came from a genuine Meta address. Meta warns that scammers send collaboration invitations in Business Manager with phishing links, and notifications about them come from the authentic facebookmail.com domain. If you want to check whether there is a problem with the account, go to Facebook yourself, without clicking a link, and look at your notifications, at the Page status section (“Status strony”) and at Meta Business Suite.

The first hour after the takeover: a step-by-step plan

Act calmly, but immediately. Every minute means potentially paid-for ads, messages to your customers and scams impersonating your company.

1. Try to log in to your personal account that was an administrator of the Page. If that works, change the password right away to a new, long and unique one.
2. Log out unknown devices. In the Accounts Center (Centrum kont) choose “Password and security” (Hasło i zabezpieczenia), then “Where you’re logged in” (Miejsce logowania). There you will see active sessions with the date, place and device type. Using “Choose devices to log out” (Wybierz urządzenia do wylogowania), end the sessions you don’t recognize, and if in doubt, tick “Select all” (Wybierz wszystkie).
3. Check who has access to the Page. Switch to the Page and, in its settings, review the people with Facebook access and with task access, then the list of people in Meta Business Suite. Remove people you don’t know. You can do this only if you still have full control of the Page.
4. Check the email address and phone number linked to the account. Attackers often change them first.
5. Pause ads and payments if you have access to them. Look at the payment methods and remove a card you don’t want to use. In case of unfamiliar charges, contact your bank.
6. Report the takeover to Meta. If you can log in to your account but no longer have access to the Page, submit the form from the Help Center article “Recovering a hacked Facebook Page you manage” (facebook.com/help/738660629556925). Meta tries to reply within one day. The form works only when you are logged in and only if access to the Page was lost recently. If you can’t log in, go to facebook.com/hacked on the device you usually use to log in to Facebook.
7. Take screenshots of unfamiliar posts, messages from “Meta Support”, notifications about changes and unfamiliar logins. They will be useful for the report.
8. Warn your customers through another channel: your Google Business Profile, your website, text message or newsletter. Say that the Facebook account has been taken over and that they should not click suspicious links.

A ready-made text to copy:

Attention: our Facebook Page has been taken over by people unconnected with our company. Please do not click any links or reply to messages from it until we have recovered the account. We will publish new information here and on our website.

When you can’t log in

If the attacker changed the password, email and phone number, go to facebook.com/hacked. Meta advises doing this on the device you usually use to log in to Facebook. The wizard will ask for the phone number or email address saved on the account. If the attacker changed them, try the ones that were linked earlier. Meta may also ask you to confirm your identity, for example with a short selfie video (Meta describes it as optional) or a photo of an ID document.

Prepare evidence that the Page belongs to your company:

• the address of the website that links to Facebook,
• company details from CEIDG (Centralna Ewidencja i Informacja o Działalności Gospodarczej, Poland’s business activity register) or KRS (Krajowy Rejestr Sądowy, Poland’s national court register) and your Google Business Profile,
• invoices for Meta ads or payment confirmations,
• old screenshots from the admin panel.

Don’t create a new Page or a “backup” account instead of recovering the old one. A new Page starts from zero, with no followers and reviews, while the hijacked one keeps operating under your company’s name.

What about Meta Verified?

Meta offers a paid Meta Verified subscription for businesses. On the Polish Meta for Business page (as of 22 October 2026), the cheapest plan, Business Standard, costs $14.99 per month for one Facebook Page, Instagram account or WhatsApp number, and the higher plans cost $49.99, $149.99 and $499.99. Meta states that plans, prices and availability depend on the region and the account, so you will see the amount for your Page only at purchase. Even the cheapest plan gives a verification badge, protection against impersonation and 24/7 contact with an agent via chat or email, although Meta notes that this support may not yet be available to all subscribers. Since September 2026, Meta Verified features are also in the new Meta One subscription, which Meta describes as still being tested and not available everywhere.

Before buying, keep two things in mind. The subscription is turned on from the business Page, so it is more of a safeguard for the future than a rescue after you have already lost access. Besides, Meta recommends that even Meta Verified subscribers submit the ordinary, free Page recovery form, because it is the fastest route. So don’t treat the subscription as a guarantee of getting the account back, and don’t pay under the influence of emotions.

A 10-minute security checklist

After you recover the account, and preferably even before an attack, do these things. Each takes a minute or two.

• [ ] Turn on two-factor authentication on the account of everyone with access to the Page (Accounts Center > Password and security > Two-factor authentication). Preferably through an authenticator app or a security key, not by text message.
• [ ] Save the recovery codes (Facebook gives 10 one-time codes in case you don’t have your phone) in a safe place, for example in a password manager.
• [ ] Give full control of the Page to two people: yourself and one trusted person. Each should have their own, separate account.
• [ ] Use a separate email address for the administrator account. Don’t publish it, and don’t use the same one as the company email visible on the website.
• [ ] Set a unique, long password and keep it in a password manager. Don’t use the same password as for your email.
• [ ] Check in Meta Business Suite the list of people with access and their permissions. For employees who only publish posts, give partial control or task access, not full control.
• [ ] Remove former administrators: a former employee, an agency, a friend who once helped.
• [ ] Turn on alerts about logins from unrecognized devices (Accounts Center > Password and security).
• [ ] Check the account recovery email address and phone number. They should be yours and up to date.
• [ ] Write down in the company who has access to the Page and ads, and what to do in case of an attack.

Remember that your email password is also a key to Facebook. If someone takes over your email, they can reset the password to everything. Turn on two-factor authentication for email too.

Two administrators: why it matters so much

In many small businesses one person manages the Page: the owner or “someone who knows Facebook”. When that account is taken over, there is nobody to take the permissions away from the attacker. Two administrators, that is, in Facebook’s language two people with Facebook access and full control, are the simplest insurance. Such a person has the same permissions as you, including removing you from the Page, so choose someone you trust.

Rules:

• both people have their own accounts with two-factor authentication turned on,
• nobody shares a password with other people,
• for everyday tasks such as publishing posts, you give others partial control or task access,
• once every few months you review the list of people with access.

What to do after you recover the Page

When you regain access, don’t stop at changing the password. Go through the whole history and the traces of the attack:

1. Remove unfamiliar posts, ads, apps and integrations.
2. Check whether the attacker changed the Page name, link, category or contact details.
3. Look into the ad account and check spending and payment methods.
4. Check that no unfamiliar apps, Pages or Instagram accounts were connected to the Page.
5. Tell customers the problem has been solved.
6. If there was customers’ personal data in messages or on the account, check your GDPR obligations on uodo.gov.pl (the website of UODO, Poland’s data protection authority) or consult a lawyer. When a breach may endanger customers, the report to the President of UODO must be sent within 72 hours of establishing it (Art. 33 GDPR). This is general information, not legal advice.

It is also worth checking other places where you use the same password or email address: email, the website admin panel, Google Business Profile, the store. If any of them has been exposed, change the passwords right away.

How to check whether the rest of your business online is safe

A hijacked Facebook account often turns out to be the beginning of a longer story: the same password works in the website panel, in email or in the store. It is worth checking once whether the rest is well secured. You can do a quick website review in the free tool Check your website. Among other things, it checks security and the email setup of your domain (SPF, DMARC).

When you want a more thorough assessment of forms, login and bot protection, I will carry out a security audit with a report and concrete fixes. If a business social media account has been neglected, I can also set up and configure profiles and groups from scratch, with clear roles and rules. I write about securing domain email in the guide on company emails landing in spam (SPF, DKIM, DMARC).

Summary

When a business Facebook account is taken over, a quick reaction counts: changing passwords, logging out devices, checking who has access to the Page, and reporting through the Page recovery form or facebook.com/hacked. The best defenses are two-factor authentication, two people with full control of the Page and a separate email address for the account.

If you need help with a security review or tidying up your company’s profiles, write to me. I reply within 24 hours, and new clients get 20% off their first order.