Right away
- Check your email for messages from MetaIf the attacker changed your email or password, Meta usually sends a message to the old address with a link to reverse it. Use that link first.
- Use Meta’s recovery pagesInstagram and Facebook both have “hacked account” recovery flows that may ask you to confirm your identity, sometimes with a video selfie for Instagram accounts that have photos of you.
- Secure your emailIf your email was taken too, recover that first; it’s how everything else gets reset.
- Check your payment methodsLook in Meta’s ad account for ads or charges you didn’t make, and contact your card company if needed.
- Warn your followersFrom another account or your website, tell people not to trust messages from the hacked account.
Once you’re back in
- Change the password and turn on two-step sign-in with an authenticator app.
- Remove people, apps and partners you don’t recognize from the account and the business portfolio.
- Delete posts and messages the attacker sent.
- Give staff and agencies their own access through Meta’s business tools instead of sharing the password.
The scam that usually starts it
Messages saying your page will be removed for a copyright or policy violation unless you “appeal” through a link. The link leads to a fake login page. Meta doesn’t ask you to log in through links in messages; check the account’s status in the app’s own settings instead.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.