Postora

A handbook for people who run social media for a business or for clients

Account access, ownership and security

Hacked business social media account: what to do first and how to recover it on each platform

By the Postora editorial teamUpdated 12 min read

Short answer

Secure the email inbox first, then use each platform's own route: facebook.com/hacked and Meta's Page recovery form, instagram.com/hacked (also for Threads), Google account recovery for YouTube and Business Profile, LinkedIn's unauthorized access form and X's support request.

Secure the email inbox first, then use each platform's own route: facebook.com/hacked and Meta's Page recovery form, instagram.com/hacked (also for Threads), Google account recovery for YouTube and Business Profile, LinkedIn's unauthorized access form and X's support request.

This guide is for small businesses, freelancers and small agencies running brand or client accounts. Every route below was read on the platform's own help pages on 2026-10-17. No step comes from a third-party blog. Where a platform's page that loaded does not say something, this guide says so rather than filling the gap.

A business account is rarely hacked on its own. On Meta, LinkedIn, YouTube and Google Business Profile, the business asset hangs off a person's account, so the person's account is what gets taken. Meta describes the pattern: a hacker "might have stolen your password, logged into your personal account, added themselves to your Page, then removed your access to the Page" (Facebook Help).

What should you do in the first hour after a business account is hacked?

In this order. The early steps stop the attacker from locking you out of the recovery routes themselves.

  1. Secure the email account behind the social account. Recovery links and codes go there. X tells users to make sure the email address on the account "is secure and that you are the only one with access to it" (X Help); LinkedIn tells members to secure the personal email accounts linked to LinkedIn (LinkedIn Help). Change that inbox's password and check its 2-step verification first.
  2. Look for the "reverse this change" email. When a Facebook email address is changed, Meta sends "a message to the previous email account with a special link" to reverse it (Facebook Help). Instagram's comes from security@mail.instagram.com (Instagram Help), and X also sends a reversal link for an email change (X Help).
  3. Start the platform's own recovery route from a familiar device. Facebook asks you to visit facebook.com/hacked "on a device you've used to log into Facebook before" (Facebook Help). Google's recovery tips say to use a device and browser you usually sign in with, from a usual location (Google Account Help). The table in the next section has each route.
  4. If you can still log in, change the password and end unknown sessions. Facebook lets you log out devices in "Where you're logged in"; TikTok's steps end with Manage devices, where you remove unwanted or suspicious devices (TikTok Support); LinkedIn says to review active sessions (LinkedIn Help). On X, a password change "does not automatically log the account out" of the iOS or Android apps; you revoke them under Apps in settings (X Help).
  5. Revoke third-party apps you do not recognise. Instagram, Threads and X all list this step. Meta's warning is blunt: apps given your login details "can gain complete access to your account" (Instagram Help).
  6. Check who holds roles on the business asset. Meta says to look through your Page and business portfolio "and undo any changes you don't recognize" (Facebook Help). YouTube's cleanup steps include removing unknown users from the channel or Brand Account (YouTube Help). X recommends Pro teams users check the members list and remove anyone they don't recognize.
  7. Write down what you know. X's support request asks for the username and "the date you last had access to your account" (X Help). Note dates, the emails you received and what changed while you still remember.
  8. Ignore anyone offering to help for a fee or a code. "Google will never ask for One Time Password (OTP) or Personal Identification Number (PIN)" (Google Business Profile Help), and Meta says "Facebook never asks for access to a Page" (Meta Business Help).

Where is each platform's official recovery route?

One row per platform, read on each platform's help pages on 2026-10-17.

Platform Official recovery route What the platform asks for or says Source
Facebook personal account facebook.com/hacked, on a device you've used to log in before. Without the account email or phone: facebook.com/login/identify, then "No longer have access to these?" New contact information "must not have been used for your Facebook account before"; you follow prompts to confirm the account belongs to you Recover a hacked account
Facebook Page The hacked Page recovery form Only available "if you're logged in and recently lost access to a Page". Meta updates you by email: "We aim to reply within a day, but some reviews may take longer." It acts only "if we can confirm that the Page was compromised" Recover a hacked Facebook Page you manage
Meta business portfolio Recover the hacked admin's profile at facebook.com/hacked, then the Page form above Check whether another admin removed you and ask them to add you back; "only admins can add or remove people". No separate portfolio recovery form is published on the pages that loaded How do I secure a hacked account?
Instagram instagram.com/hacked; or Forgot password? and Send login link; then a support request with a secure email Account with photos of you: "a video selfie of you turning your head in different directions". Without photos: the email or phone you signed up with and the device type used at sign-up Instagram Help
Threads The same instagram.com/hacked page, linked from Threads help Same Instagram flow. If the profile was created with an Instagram account, check Accounts Center for linked accounts you don't recognize Threads profile posts unauthorized content
TikTok In the app: Settings and privacy, Account, Password; link a phone; remove suspicious devices. The help page offers "Chat with us" Signs listed: password or phone changed, username changed, videos deleted or posted, messages you did not write. A route for a fully locked-out account is not published on the page that loaded My account has been hacked
YouTube and Google Account accounts.google.com/signin/recovery, then YouTube's hacked channel assistant Google asks you to "answer the questions as best you can". YouTube: "Support is limited to potential hacking incidents that occurred within the past 9 months" Google Account Help, YouTube Help
LinkedIn account The Report Unauthorized Account Access or Changes form Include your profile URL if you have it. A restricted account: "login and follow the steps on screen to verify your identity" Report a compromised account, Account restrictions
LinkedIn Page On the Page: More, Request admin access If the Page is actively managed, current super admins "must approve your request". No response: contact LinkedIn after adding the Page as your current employer and verifying a work email where offered LinkedIn Help
X Forgot Password on the login page, then the hacked or compromised support form Use the email address on the compromised account and include "both your username and the date you last had access to your account" Help with my compromised account
Pinterest Reset the password, or log in with Google if connected After strange activity Pinterest itself resets the password and logs everyone out. Without the account email and no Google or Apple login: "we can't verify that the account belongs to you" We protected your account, Email inaccessible
Google Business Profile Recover the owner's Google Account first; if no one has access, business.google.com/add, then Request Access (storefront or hybrid businesses; a service-area business contacts Google) The current owner "has 3 days to respond". After that "you may have the option to claim the profile", which "isn't always available"; a denial can be appealed Request ownership
Bluesky Email support@bsky.app "If you believe your Bluesky Account has been compromised, report it to us at support@bsky.app." No self-service recovery flow is published on the pages that loaded Terms of Service

Meta, Instagram, Threads and Google lean on the device and the details you used before. That is why the first-hour list says to recover from a familiar device. X and LinkedIn run on forms. LinkedIn asks for your profile URL if you have it; X asks for the username and the date you last had access. Pinterest and Bluesky give the least room. Pinterest says that without the account email and with no Google or Apple login set up, it cannot give you access, "For security reasons", and suggests a new account.

What does Instagram's identity check involve?

Instagram's help page sets out the order. Request a login link to your email or phone. If that fails, request support on a mobile device and "enter a secure email address that only you can access" (Instagram Help). Then the check depends on the account:

  • Account without photos of you: you are asked for "the email address or phone number you signed up with and the type of device you used at the time of sign up".
  • Account with photos of you: a video selfie turning your head. Meta says the video "will never be visible on Instagram and will be deleted within 30 days", and if it cannot confirm your identity "you can submit a new video and we'll review it again".

For a brand account, this is the strongest argument for recording the sign-up email, phone and device somewhere the business keeps.

How do you get a business Page back when the admin's personal account is lost?

If the personal account cannot be recovered, the Page is reached through another person who still has a role. That only works if one exists.

  • Facebook Page. Meta: "Contact a Page admin and ask them to add you back", and "only admins can add or remove people" (Meta Business Help). Its own advice is to plan for this: "We recommend that you add more than one admin to your Page. That way, if you ever lose access to your Page, someone you trust can help get you back in" (Meta Business Help). If the only admin was hacked, they go through facebook.com/hacked and then the Page form.
  • LinkedIn Page. "All Pages must have at least one super admin", and a sole super admin must assign another before leaving (LinkedIn Help). With no reachable super admin, the route is Request admin access, then LinkedIn support, which "can't provide admin information to members or employees of the page" (LinkedIn Help).
  • Google Business Profile. "A Business Profile can have multiple owners but only one primary owner", and owners can add or remove users (Google). Another owner can restore you directly. A newly added owner or manager has "to wait 7 days before you can manage some profile features", so add the backup before you need it. With no owner left, use the Request Access route in the table.
  • YouTube. The channel sits on a Google Account or a Brand Account; the recovery is Google's, and the cleanup includes removing users you do not recognise from the channel or the Brand Account (YouTube Help).

If the account that disappeared belonged to an agency or a former contractor, treat it as an ownership problem. Granting roles without passwords is covered in how to give an agency access without sharing passwords; taking assets back, including Meta's Page release request, is in agency offboarding: remove access and take back your accounts.

How do you stop it happening again?

Each item traces to a platform's own advice.

  1. Two-step verification on every account and every inbox behind it. Instagram, Threads, Pinterest and X all list two-factor authentication in their post-hack steps. X calls it "a critical security feature" that "significantly reduces the risk of unauthorized access" (X Help).
  2. Passkeys or a security key where offered. Google: "A hardware security key is a small device that you can buy to help verify it's you when you sign in", and "Passkeys are a simple and secure alternative to passwords" (Google Account Help). TikTok's help centre has a Passkeys on TikTok article; Meta's pages read here point to Advanced Protection after a Page recovery.
  3. Backup codes stored offline. Google: "If you lose your phone, you can use a backup code for the second step."
  4. At least two admins, both people the business employs. Meta recommends more than one admin; LinkedIn requires at least one super admin; Google allows multiple owners. A second owner-level person is what makes the previous section work.
  5. Few people with the top role. Google: "The fewer people who have access to your Business Profile, the less likely it is to be compromised", and "owners can edit and transfer ownership of your business, so add them with extra care" (Google). Remove ex-employees.
  6. Review connected apps and revoke what you don't use. Instagram's manage access page, X's Apps settings, and the same review on every other platform. A tool you stopped paying for may still hold access.
  7. A unique password per account. X: "Always use a strong, new password you don't use elsewhere". Pinterest says the same.
  8. Treat access requests and "support" messages as suspect. Meta: "Don't accept requests from people you don't know" (Meta Business Help). Google warns about people "claiming to be Google support or Google employees".

These rules belong in the business's written policy; the social media policy template has an ownership and 2FA section to copy them into.

Frequently asked questions

How long does Meta take to recover a hacked Facebook Page?

Meta's help page for the Page recovery form says "We aim to reply within a day, but some reviews may take longer." It updates you by email, and acts only if it can confirm the Page was compromised. Meta publishes no timeframe for facebook.com/hacked itself on the pages that loaded.

Do I need to send Instagram a video selfie?

Only if Instagram asks. Its help page says an account with photos of you leads to a video selfie request; an account without photos of you leads to questions about the sign-up email or phone and the device used at sign-up. Meta says the video is deleted within 30 days.

Can I still recover a YouTube channel hacked a year ago?

YouTube says its support "is limited to potential hacking incidents that occurred within the past 9 months due to our data retention policy". A channel terminated after a hack can be appealed once you recover the Google Account.

The hacker changed the account email. Is the account lost?

Not necessarily. Facebook sends the previous address a message with a link to reverse an email change. Instagram and X say that if you get their email about an email change, you can undo it from that message. Facebook also has a route for when you no longer have access to the account email or phone, through facebook.com/login/identify and "No longer have access to these?".

My Page admin left the business and their account was hacked. What now?

Ask any other admin to add you back. If there is none, Facebook routes it through the hacked admin's own recovery and the Page form; LinkedIn through Request admin access; Google Business Profile through Request Access, where the current owner has 3 days to respond.

Should I pay a recovery service?

The routes in the table are the platforms' own flows and forms. Google says it never asks for a one-time password or PIN and never tries to convince you to pay to maintain a Business Profile; Meta says Facebook never asks for access to a Page.

Sources

All read on 2026-10-17.