A compromised social account is a public problem rather than a private one, and recovery depends on somebody at a large company reviewing your case. Prevention is cheap, recovery is not, and the account tied to a personal profile is the usual weak point.

Why this differs from other accounts

Three things make a social account a distinct problem.

It is public. A compromise is visible to customers immediately, and whatever gets posted attaches to your name.

Recovery is slow and uncertain. There is frequently no support line, only a form and a queue. Businesses have waited weeks and some never recover the account.

The attacker gains reach. Your followers trust the account, which is why these are targeted at all.

That combination means the cost is not the account itself. It is the period during which somebody else is speaking as you and you cannot stop them.

The structural weakness

On most platforms a business page is controlled through a personal profile.

Which means the security of your business presence is the security of somebody's personal account, including their password habits, their personal email, and their phone.

It also means that if that person leaves, loses access, or is compromised, the business page goes with them. This is the most common way small businesses lose access to their own accounts, and it involves no attacker at all.

The fix is having more than one person with full control, so no single personal account is a single point of failure.

How these are actually taken

Rarely by technical means. Almost always through the person.

A message claiming a policy violation, with a link to appeal it. The link collects the login.

A brand collaboration offer requiring you to log in somewhere to accept.

A fake support account responding helpfully to a public complaint you posted.

A reused password exposed in an unrelated breach elsewhere.

The first is the most effective, because it creates urgency and fear about losing the account, which is exactly the state in which people stop checking links.

The rule that defeats all four: platforms do not ask you to log in through a link in a message. Navigate to the platform yourself, always.

What to actually do

  1. Two-factor authentication on every personal profile with control of the page, not just yours.
  2. An authenticator application rather than text messages, since numbers can be taken over.
  3. Save the recovery codes somewhere that is not the phone running the authenticator.
  4. At least two people with full control, so a departure or a lockout is survivable.
  5. Roles scoped properly, so somebody who posts does not have the ability to remove other administrators.
  6. A business email on the account, not a personal one.
  7. Review who has access twice a year, including agencies and former staff.

The fifth is the one that limits damage. An attacker who reaches an account with posting rights can embarrass you; one who reaches full control can remove everybody else and lock you out entirely.

The agency question

Worth handling deliberately because it recurs.

Where an agency or a contractor manages your accounts, they should be granted access to accounts you own rather than creating accounts they own.

An account created by an agency, under their profile, is an account you may not be able to recover when the relationship ends. That situation is common and it is entirely avoidable at the outset.

The same applies to advertising accounts, which additionally hold payment details and spending history.

If it happens

Speed matters and the options are limited.

Attempt recovery immediately through the platform's own process, from the account's registered email if you still control it. Change that email password first, since it is frequently how they got in.

Tell customers, briefly and factually, through channels you still control. A short note that the account is compromised and that you are working on it prevents somebody acting on a fraudulent message.

Check what else used the same password, and check whether the same email is the recovery address for anything more important. A social compromise is frequently the visible part of a larger one.

Do not pay anybody offering to recover it. Services claiming inside access to platform support are not what they say they are.

The proportionate view

This is worth an hour, once.

Two-factor on the profiles that control the page, recovery codes saved somewhere sensible, a second person with control, and a check of who else has access.

That removes nearly all of the realistic risk, and the alternative is a public problem you cannot fix on your own timetable, which is the same access-inventory discipline described in knowing who can get into what.

Frequently asked questions

Why is a social account different from other accounts?

A compromise is public and immediate, recovery depends on a queue at a large company with no support line, and the attacker gains the trust of your followers.

What is the structural weakness?

Business pages are usually controlled through a personal profile, so your business presence depends on somebody's personal password habits, email, and phone.

How are these accounts usually taken?

Through the person. A fake policy violation notice with an appeal link, a collaboration offer requiring a login, a fake support account, or a password reused elsewhere.

What rule defeats most attempts?

Platforms do not ask you to log in through a link in a message. Navigate to the platform yourself, always.

What should be set up?

Two-factor with an authenticator application on every profile controlling the page, recovery codes saved separately, at least two people with full control, and scoped roles.

What about agencies managing accounts?

They should be granted access to accounts you own rather than creating accounts they own, or you may be unable to recover them when the relationship ends.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Business page controlled through one personal profile?

We add the second controller and the two-factor setup, which is an hour against a problem you cannot fix on your own timetable.

Start a Conversation