You try to open Instagram and it asks you to log in. Your password does not work. A few minutes later a regular customer calls to ask why your shop is messaging people about a cryptocurrency investment. Your business Instagram account has been hacked, and the people who trust you most are being targeted from it.
With a hacked business Instagram account or a Facebook page taken over, speed and order matter. This guide covers the signs, what to do first, the general recovery routes Meta offers, how to recover a Facebook page if you lost access, how to warn customers, and the habits that make a repeat far less likely. Problems with ad accounts are covered separately.
Signs your account has been taken over
Some takeovers are obvious. Others are quiet, and the attacker uses the account for a while before you notice.
- You are logged out and your password no longer works.
- You receive an email saying the email address or phone number on the account was changed, and you did not do it.
- Login alerts mention a device or location you do not recognise.
- Posts, stories or messages appear that you did not make, often promoting investments, giveaways or cheap products.
- Followers say they received strange messages from you asking for money, codes or votes.
- Your profile name, bio or link has changed.
- On Facebook, a new admin appears on your page, or your own access has been removed.
- Ads you did not create are running from your page.
If you notice any of these, act straight away. The longer an attacker has control, the more damage they can do and the harder recovery becomes.
First steps if you can still log in
Sometimes you still have access, even though someone else does too. Work through this list quickly:
- Change the password to a new, long one you have never used anywhere else.
- Check the email and phone number on the account, and correct them if they were changed.
- Log out of other sessions. In the security settings or Meta’s Accounts Center, review where the account is logged in and remove any device you do not recognise.
- Turn on two-factor authentication, using an authentication app if you can, and save the backup codes.
- Remove unknown connected apps and websites that have access to the account.
- Check page and business access on Facebook, and remove any admin or partner you did not add.
- Delete posts and messages the attacker sent, and note what was sent for your warning to customers.
Also secure the email account linked to Instagram or Facebook. If an attacker got into your email, they can reset your social passwords again whenever they like. Our post on telling a hacked email account from a hacked website helps if you are not sure where the problem started.
Recovering a hacked business Instagram account when locked out
Meta changes its recovery process from time to time, so the exact screens may differ. The general routes are:
Check your email for a reversal link
When an account’s email address is changed, Instagram usually sends a message to the old address. That message may include an option to reverse the change and secure the account. Look for it in your inbox and spam folder, and act on it quickly. Before clicking, make sure the email really came from Instagram; attackers send fake security emails too. Instagram’s security settings let you check which recent emails genuinely came from it, once you are back in.
Use the app’s login help
From the Instagram login screen, choose the option for help logging in or for a forgotten password. Follow the prompts to request a login link or code by email or text message. If the attacker changed those details, look for an option saying you cannot access that email or phone.
Use Meta’s hacked account pages
Instagram and Facebook each have a help route for hacked accounts, reachable by searching their help centres for “hacked account”. These ask what happened and walk you through the options available for your situation.
Identity verification
For some accounts, Instagram may ask you to confirm your identity, for example by recording a short video selfie so it can compare your face with photos on the account, or by providing other details. A business account with no photos of the owner may be handled differently. Follow the instructions carefully and be patient; reviews can take time.
Avoid “recovery services”
People who offer to get your account back for a fee, especially those who contact you after you post about the hack, are very often scammers. Do not pay them or give them any details.
How to recover a Facebook page after losing access
Facebook pages are managed through people’s personal profiles or a Meta business portfolio. That gives you more than one way back in.
- Recover the personal profile first if it was the profile that was hacked. Use Facebook’s hacked account route from the login screen or the help centre.
- Ask another admin. If someone else still has full control of the page, they can remove the attacker and restore your access. This is exactly why a second trusted admin matters.
- Check the business portfolio. If the page belongs to a business portfolio, an admin of that portfolio may be able to reassign access. Our guide to Meta business account access explains how portfolios and roles work.
- Report the issue to Meta through the help centre options for pages you have lost access to, describing what happened and when.
If the attacker started running ads, also check your ad account and payment methods. Unexpected charges or a restricted ad account need separate attention; our guide to a restricted or disabled ad account covers that.
Warning your customers
While you work on recovery, the attacker may still be messaging your followers. Protect them, and your reputation, by warning them through every other channel you have:
- Post on your other social accounts, such as your Facebook page if Instagram was hacked, or the other way round.
- Update your WhatsApp status and message regular customers.
- Add a short notice to your website.
- Ask staff and friends to share the warning.
Keep the message simple and specific: “Our Instagram account has been hacked. Please ignore any messages from it asking for money, codes or personal details. We are working to recover it and will confirm here when it is safe.” Once you are back in, post a short update on the account itself explaining what happened and apologising for any messages sent in your name.
How business accounts usually get hacked
Knowing the common routes helps you avoid them:
| Method | How it works | How to protect yourself |
|---|---|---|
| Fake “Meta” warnings | A message or email claims your account will be deleted for copyright or policy reasons, with a link to appeal that captures your login | Never log in through a link in a message; check warnings inside the app’s own settings |
| Reused passwords | A password leaked from another site is tried on your account | A unique password for every account, kept in a password manager |
| Code-sharing tricks | Someone, often posing as a friend, asks you to send them a code you just received | Never share login or verification codes with anyone |
| Fake collaboration offers | A “brand” sends a file or link that installs malware or asks you to log in | Be wary of unexpected offers; do not install files from strangers |
| Growth or follower apps | You give your password to a third-party service | Never give your password to outside tools; use official connections only |
| Former staff or helpers | Someone who once had access still does | Review access regularly and remove people who no longer need it |
Habits that keep accounts safe
- Two-factor authentication on every account, including the email account linked to them. An authentication app is generally safer than text messages.
- Backup codes stored offline, somewhere you can find them if you lose your phone.
- At least two trusted owner-side admins on every Facebook page and business portfolio.
- Staff and agencies given only the access they need, through Meta’s business tools, never by sharing the password.
- A regular review of who has access, which devices are logged in and which apps are connected.
- Business-controlled email and phone on the accounts, not a personal number that might change.
- Healthy suspicion of urgent messages about your account. Real platform warnings appear inside the app, not only in a direct message.
The same principles apply to your website. If you run WordPress, our guide to setting up two-factor authentication on WordPress covers the site side.
For where account security fits in day-to-day social media work, see our small business social media overview. For how social fits with search, ads and email, see our online marketing services overview.
Frequently asked questions
How long does it take to recover a hacked Instagram account?
It varies a great deal. If you catch it early and use the reversal email, it can be quick. If the attacker changed every contact detail and identity checks are needed, it can take much longer, and some accounts are not recovered. Acting immediately and following Meta’s official routes gives you the best chance.
Should I create a new account while I try to recover the old one?
A temporary account can help you warn customers, but name it clearly, for example with “new” or “temporary” in the bio, and explain why it exists. Keep trying to recover the original account, since it holds your followers and history. Once recovered, point followers back to it and close the temporary one.
Can the hacker see my customers’ messages?
Yes, anyone with control of the account can read its direct messages and contact followers. That is why warning customers quickly matters. Once you regain access, review what was sent, tell anyone who may have been targeted, and consider whether any personal information customers shared with you in messages needs further action.
Will my followers and posts come back after recovery?
Usually, if the attacker did not delete them. Some attackers change the username, remove posts or alter the profile. Check everything once you are back in, restore the name, bio and link, and repost anything important that was removed. Follower counts may change a little if the attacker followed or unfollowed accounts.
Account access and security are among the first things we check when taking on an account. Our social media management work sets accounts up with ownership kept firmly in your name.
