Facebook Page hacked? What to do in the first hour

If your Facebook Page was hacked, or someone removed you as an admin, the fastest way back is Meta's own Page recovery form, sent while you are logged in to your personal Facebook account. Everything else in the first hour is about locking the door behind the intruder and protecting your customers and your card. Here is the order that works, step by step.

Take a breath first. A hacked Page feels like losing the shop sign overnight, but Meta has a set route for exactly this situation, and most of the work is done in the first hour.

Minute 0 to 5: find out what was actually taken

A Page has no password of its own. It is run from the personal Facebook accounts of its admins. So the first question is not "is my Page hacked?" but "can I still log in to my own Facebook account?"

Meta lists the usual signs of a taken-over account: a profile picture you did not change, posts or messages you did not write, trouble logging in or with two-factor codes, and e-mails saying your password, e-mail address or phone number was changed when you did not do it.

Step A: you cannot log in to Facebook

1. Use a phone or computer you have logged in to Facebook with before. Meta asks for this, because a known device helps it trust you.
2. Go to facebook.com/hacked and follow the steps on the screen.
3. Search your e-mail for a message from Facebook saying your e-mail address was changed. When the e-mail on an account is changed, Meta sends a message to the old address with a link that reverses the change. Use it.

Only when you are back in your personal account can you move on to the Page.

Step B: you are logged in, but the Page is gone

This is the "admin removed" case. Meta describes how it usually happens: someone steals an admin's password, logs in, adds themselves to the Page and removes everyone else. Or a scammer tricks an admin into handing over control, often inside Business Manager or Meta Business Suite.

The fix is Meta's Page recovery form, linked from its help page "Recover a hacked Facebook Page you manage" (see the sources below). A few things Meta says about it:

• You can only send it while you are logged in, and only if you recently lost access to a Page.
• If the form does not let you pick your Page, Meta does not see that you lost access recently.
• Meta says it aims to reply by e-mail within a day, but some reviews take longer.
• It can only act if it can confirm the Page was compromised.
• Even if you pay for Meta Verified or have another support channel, Meta still recommends the form as the fastest route.

If more than one person had admin rights, each of them should check whether they can still see the Page. One admin who still has access can put the others back.

Step C: you can see the Page, but something is wrong

1. Change your Facebook password now, from a device you trust.
2. In your settings, find the list of places where you are logged in. Log out of every device and location you do not recognize.
3. Open the Page's access list and remove every person and partner you do not know. If you are not sure where that is, our guide to Meta Business Suite explains how the pieces fit.
4. Delete posts and messages the intruder sent, so customers are not led to their links.

Minute 15 to 30: protect your money and your customers

Your ad account. If there was a card on the Page or in Business Suite, open your ads and look for campaigns you did not create. Pause them, then check your card statement. If you see charges you did not make, call your bank. It is easy to forget in the panic, and it is where a hack can cost real money.

Your Instagram. If your Instagram account is linked to the Page, check that you can still open it. If not, go to instagram.com/hacked. If Instagram sent a message from security@mail.instagram.com about a changed e-mail address, that message may let you undo the change. Instagram may also ask for a short video selfie to confirm it is you.

Your customers. The Federal Trade Commission's advice after any hacked account is to tell your contacts, so they do not click links sent in your name. For a business, that means a short note wherever you can still post: your Instagram stories, your Google profile, your e-mail list, a sign at the counter. Something like: "Our Facebook Page was hacked. Please do not click links or answer messages from it until we post here that it is fixed."

Minute 30 to 60: lock the door

Once you are back in, the FTC and Meta give the same short list:

1. Use a strong password that you do not use anywhere else.
2. Sign out of all devices.
3. Turn on two-factor authentication, so a stolen password alone is not enough to get in.
4. Check that the e-mail address and phone number on the account are yours and still work.
5. Go through the Page and your business portfolio and undo any change you do not recognize.

Meta's recovery page also suggests turning on Advanced Protection, extra security for accounts that are likely targets. If Facebook offers it to you, you will find it under Accounts Center, then Password and security.

What not to do

• Do not pay anyone who offers to recover your Page. Strangers who comment "I can get your account back" under your posts are the next scam, not the cure. Recovery goes through Meta.
• Do not open a new Page right away. Your followers, reviews and history live on the old one. Send the form first and give Meta time to answer.
• Do not answer "Meta support" messages that ask for your password or a code. Meta's help pages say it will never ask for your password in an e-mail.

After the scare: set it up so it cannot happen the same way

Both of Meta's examples above start with one admin: a stolen password, or a person tricked into handing over control. The fewer people who can do that, and the harder their accounts are to get into, the smaller the risk. Three habits help:

• Two people you trust with full control, each with two-factor authentication on.
• Nobody else with full control. Employees and helpers get only the access they need.
• Your Page, Instagram account and ad account kept in a business portfolio in your own name.

To be clear: only Meta can give a hacked Page back, and no outside service, ours included, can speed that up. Once you are back in, though, our Business Manager Setup can help with the last point. On one video call we build or tidy up your business portfolio with you, connect your Page, Instagram and ad account, and you stay the only owner. It is listed with our one-time jobs on the pricing page.