The Emergency Protocol for Hacked Social Accounts
When someone unauthorized breaks into your Facebook Page, Instagram account, or Business Manager, every minute counts. Attackers move fast: they change the primary admin email, attach their own two-factor authentication apps, and can drain linked ad accounts within hours.
The biggest mistake we see people make is panic-submitting the same recovery form over and over with wrong passwords. That triggers rate-limiting and can lock you out longer. Take a breath, then work the protocol below in order. For professional assistance and enterprise implementation, explore our official Cyber Security & Digital Asset Defense.
What You're Up Against in 2026
Modern account takeovers aren't just lucky password guesses. The attacks targeting high-value pages right now include:
Session hijacking through fake brand deals. Attackers send "sponsorship inquiries" with PDF or ZIP portfolios that contain info-stealer malware. It extracts live browser session cookies, which lets them walk straight past your 2FA.
Rogue admin injections. A compromised employee's personal account gets used to quietly add an attacker-controlled account as an admin on your Business Manager assets.
Fake Meta copyright notices. Phishing emails that mimic Meta Support lure admins onto lookalike login pages to harvest credentials. The email looks urgent and official, and that's the point.
Knowing the vector matters because it tells you what to clean up first. If you fell for a fake portfolio file, your device is compromised, not just your password.
Your First 30 Minutes After a Hack
Don't start with appeals. Start with containment. Work this checklist before you touch a single recovery form:
- Quarantine the device. If you clicked a suspicious file or link, stop using that browser and device for anything sensitive. Run a full malware scan with reputable antivirus software before logging in anywhere.
- Lock down your email first. Your email is the master key to every recovery flow. Change its password from a clean device and turn on two-factor authentication using an authenticator app or hardware key, not SMS.
- Revoke active sessions. In Facebook's security settings, log out of all active sessions you don't recognize. In Instagram, do the same under Login Activity.
- Check for forwarding rules. Attackers often set up email forwarding or filters so they keep seeing your recovery emails. Look for rules you didn't create and delete them.
- Screenshot everything. Capture the hacker's email changes, new admin names, unauthorized ads, and any weird activity. You'll need this for your appeal.
- Alert your team. Tell every admin on the Page or Business Manager what happened so nobody clicks a "please re-verify" link the attacker sends.
Only after containment should you start the formal recovery process.
How to Document Evidence for Your Appeal
Meta's review teams (human or automated) respond to evidence, not emotion. A well-documented appeal gets reviewed faster and denied less often. Build a simple evidence file before you submit anything:
Proof of ownership. Your Business Manager ID, the original email the account was created with, business registration documents, and utility bills in the business name. A government-issued ID for the account holder.
Proof of the attack. Screenshots of unfamiliar login locations, the attacker's added email addresses or phone numbers, unauthorized admin additions, and any phishing emails you received (with full headers if you can get them).
A clear timeline. Write a short, factual timeline: when you last had access, when you noticed the breach, what changed. Keep it to the facts, no speculation about who did it.
One clean submission. Send everything through the correct official recovery channel once, with all documents attached. Resubmitting the same request repeatedly with incomplete info is what triggers automated denial loops.
If your first appeal is denied, don't just hit "try again." Add the missing evidence first, then resubmit. Each appeal should be stronger than the last.
The Step-by-Step Recovery Roadmap
Secure your linked infrastructure. Sanitize admin devices, revoke active browser sessions, and reset email credentials with hardware security keys (FIDO2 or YubiKey) where possible. Hardware keys are far harder to phish than codes sent by text.
File Business Manager ownership disputes. Submit your ownership statements, business registration documents, and utility verification through Meta's official asset dispute channels. This is where your evidence file does the heavy lifting.
Escalate through partner channels if you have them. Businesses working with certified agency partners can often get manual human review routed faster than the standard automated queue. If you have that option, use it.
How to Tell If Recovery Is Working
A few honest signals to watch for: you receive confirmation that a security change was reversed, unfamiliar admins disappear from your asset list, or you get an email acknowledging a manual review is underway. If weeks pass with only automated rejections and no human touchpoint, that's your cue to escalate, not to keep resubmitting the same form.
Lock the Door Behind You: Preventing a Repeat Takeover
Getting your account back is only half the job. Attackers routinely re-target accounts they've breached once, because they know the security was weak. Before you call it done:
Switch everyone to hardware keys or authenticator apps. SMS-based 2FA can be intercepted through SIM-swapping. Move every admin to an authenticator app at minimum, and to a hardware security key for high-value assets.
Audit your admin list quarterly. Remove ex-employees, old freelancers, and anyone who doesn't need access today. Every admin is a potential entry point.
Set up login alerts. Turn on notifications for unrecognized logins on Facebook, Instagram, and your email. Early warning turns a takeover into a 10-minute scare.
Separate business from personal. Admins should manage Pages through Business Manager with business emails, not personal accounts that are easier to phish. Keep work and personal logins on different browsers or profiles.
Train your team on the fake-deal trick. The malicious portfolio file is the number one entry point we see. Make it a rule: never download attachments from unsolicited brand inquiries, and verify sponsorship offers through official channels first.
Recovering a hacked account is stressful, but it's a solvable problem when you work the process methodically instead of panicking. And if the stakes are high, say a revenue-driving Page or an ad account with real spend behind it, you don't have to go it alone. Neviax's account recovery specialists handle compromised Pages, Instagram accounts, and Business Managers end to end: evidence gathering, escalation, and lockdown, so you can get back to running your business.
