Protecting company social media accounts from hacking

A company's Facebook or Instagram page is often its main channel to customers. Once it is taken over, attackers run ads charged to the company card, post fraudulent messages in its name or demand money to give it back. Access is almost always lost through the personal account of one of the page administrators.

How accounts are taken over

• Phishing messages posing as Meta: "your page violates copyright" or "your account will be suspended within 24 hours", with a link to a fake appeal form that asks for the password and a confirmation code.
• Files presented as an advertising report or a partnership offer. They are in fact programs that steal saved passwords and active sessions from the browser. With a stolen session the attacker logs in without a password and without a second factor.
• Passwords leaked from other sites and reused.
• Former employees and agencies that still have administrator rights.

Security settings

1. Turn on two-factor authentication for every administrator, using an authenticator app or a hardware key. SMS codes are weaker because they can be intercepted through SIM swapping.
2. The page should have at least two administrators with personal accounts. If the only administrator loses access, recovery can take weeks.
3. Manage pages and ad accounts through a business portfolio in Meta Business Suite. Roles are granted and removed centrally there, and access does not depend on one personal profile.
4. Once a quarter, review who has access, including agencies and connected apps, and remove anyone who no longer needs it.
5. Use an email address on the company domain for administrator accounts and turn on alerts for logins from new devices.
6. Do not open files sent in messages to the page. Meta does not send violation notices as attachments.

Privacy settings for employees

Public information in personal profiles helps fraudsters write convincing emails. LinkedIn and Facebook often reveal who the managing director is, who the accountant is and who approves payments. Recommend that employees restrict:

• who can see their friends and connections;
• who can find them by phone number or email address;
• posts they are tagged in, by turning on review before tags appear on their profile;
• sharing their location and office photos that show screens, documents or access badges.

Content in public groups is visible to anyone and can be indexed by search engines. In private groups only members see it, but you do not know who has been admitted, so internal company information does not belong there either.

If the account has already been taken over

1. Use the official recovery pages: facebook.com/hacked and instagram.com/hacked.
2. If another administrator still has access, they should immediately remove the compromised account from the page and from the business portfolio.
3. Check the ad account for new campaigns and payment methods, and contact the bank if there are unauthorised charges.
4. Change the password of the email linked to the account and check the administrator's device for malware. If the session was stolen from the computer, changing the password is not enough.
5. Warn customers through your other channels that messages from the page during this period did not come from you.