Account Takeover: Protect Social Media and Ad Accounts
Your business page, your followers and the card attached to your ad account are worth real money to criminals. When an account is taken over, you can lose your audience, your reputation and your ad budget in an afternoon. This guide shows how to lock down social media and ad accounts so one stolen password cannot take it all.
Key takeaways
- Protect every social and ad account with app-based MFA or passkeys, not just a password.
- Keep at least two admins on every business page and ad account, so you are never locked out by one person.
- Use the platform's business manager and role-based access instead of sharing one login.
- Remove ex-staff and old agencies promptly, and review who has access every quarter.
- Watch for unexpected ad spend, a common sign that an ad account has been hijacked.
For many small businesses, social media is the shop window. A cafe takes bookings through its Instagram messages, a consultant finds clients on LinkedIn, and an online store spends a large share of its marketing budget on Facebook or TikTok ads. That makes these accounts attractive targets. A hijacked page can be used to scam your followers, and a hijacked ad account can run up charges on your card before you notice.
The good news is that account takeover usually relies on a few predictable weaknesses: a reused password, no multi-factor authentication, one person holding all the keys or an ex-employee who still has access. Close those gaps and you remove most of the risk. Our article on two-factor authentication explains MFA in general; this guide applies it, and more, specifically to social and advertising accounts.
How social and ad accounts get taken over
Understanding the common routes helps you see why each defense matters. You do not need technical knowledge; most takeovers rely on tricking a person rather than breaking software.
Fake platform warnings
An email or direct message claims your page has broken the rules, a post infringes copyright or your account will be deleted within 24 hours. It asks you to "appeal" by logging in through a link. The page looks real, collects your password and, if you have text-message codes, may ask for the code too.
Reused or leaked passwords
If the password for your social account is the same as one used on another site that was breached, criminals can try it automatically. This is why a password manager with unique passwords matters so much.
Shared logins and forgotten access
A single login passed around the team, a former employee who still has admin rights, or an agency you stopped working with two years ago are all open doors. If any of those people are compromised, so are you.
Malicious apps and browser extensions
Some attacks come through "free" tools that promise analytics or scheduling and ask for broad permissions to your accounts, or through browser extensions that steal session data. Only connect tools you trust and review connected apps regularly.
Common mistake
Running the business page from the owner's personal profile with no other admin. If that personal account is hacked or locked, the business page goes with it, and recovery can take a long time. Always have a second admin you trust.
The core defenses
These steps apply to every major platform. The menus differ, but the principles do not.
- Turn on app-based MFA or passkeys. Use an authenticator app, a passkey or a security key for every person with admin access. Text-message codes are better than nothing, but app-based methods and passkeys are harder for criminals to intercept or trick out of you.
- Use unique passwords stored in a password manager. Each person should have a long, unique password for their own account, never reused elsewhere.
- Set up the platform's business manager. Most large platforms offer a business management tool where you own the page and ad account as a business, then grant individuals access through their own profiles. This replaces shared logins.
- Add at least two admins. Two trusted people, both with MFA, should hold full control. If one account is compromised or someone leaves suddenly, the other can act.
- Give everyone else the lowest role they need. Someone who only posts content does not need to manage billing or add new admins. Use editor, analyst or advertiser roles where they exist.
- Secure the email behind the accounts. The email address used for login and recovery should itself have strong MFA. If criminals control that inbox, they can reset everything else.
- Turn on login and security alerts. Make sure alerts about new logins, new admins and changes to security settings go to an inbox that someone actually reads.
Pro tip
Use a shared business mailbox, such as a role address for marketing, as the owner or recovery email for your business manager, rather than one employee's personal address. Protect it with MFA, and make sure at least two people can reach it. That way recovery does not depend on one person.
Role-based access in practice
Role-based access means every person signs in with their own account and has only the permissions they need. It makes it easy to see who did what and to remove one person without changing passwords for everyone else.
| Person | Suggested access | Why |
|---|---|---|
| Owner | Full admin, with MFA | Keeps ultimate control of the business assets |
| Trusted second admin | Full admin, with MFA | Backup if the owner's account is locked or compromised |
| Social media manager | Content and messaging roles | Can post and reply but not add admins or change billing |
| Agency or freelancer | Partner access to specific assets | Easy to remove when the contract ends |
| Bookkeeper | Billing view only, if available | Sees invoices without being able to run ads |
Protect your ad accounts and budget
Ad accounts are especially valuable to criminals because they are connected to a payment method. A hijacked ad account may be used to run scam ads, promote fake products or simply burn through your budget. Some extra steps reduce the damage if something does go wrong.
- Set spending limits. Most ad platforms let you set an account spending limit or daily budget caps. Keep them close to what you actually plan to spend.
- Watch for unexpected ad spend. Turn on billing alerts and check the ad account at least weekly. New campaigns you did not create, unfamiliar ad content or a sudden jump in spend are warning signs.
- Use a dedicated card. A separate business card, or a virtual card with a set limit, for advertising keeps any fraud contained and makes odd charges easier to spot.
- Limit who can add payment methods. Only full admins should be able to change billing settings.
Example
Imagine a small candle shop that spends a modest, steady amount on social ads each week. One Monday the owner, Ana, gets a billing alert that daily spend is far above the usual level. She logs in and finds three campaigns she did not create, promoting a product she does not sell. Because her business manager has a second admin with MFA, she removes the unknown user, pauses the campaigns and contacts her card provider and the platform's support that morning. Her spending limit also kept the charges far lower than they could have been.
Offboarding and regular reviews
Many takeovers do not start with clever hacking. They start with access that should have been removed months ago. Build two simple routines.
When someone leaves
On the person's last day, remove them from every business manager, page and ad account, and revoke any partner access for agencies whose contract has ended. If anyone ever knew a shared password, change it. Check that no unknown admins were added while they had access. Keep a short list of every platform and who has which role, so nothing is missed.
Every quarter
Review all admins and roles, remove anyone who no longer needs access, check connected apps and remove any you do not recognize, confirm MFA is on for every admin and check that recovery emails and phone numbers are still current.
If an account is taken over
Act quickly, but calmly. The steps below cover most situations.
- Use your second admin. If another admin still has access, use that account to remove the attacker, reset roles and secure settings.
- Secure the email first. Change the password of the email linked to the account from a clean device, sign out all sessions and check for forwarding rules you did not create.
- Use the platform's official recovery process. Go to the platform's help center directly. Ignore anyone who contacts you offering to recover your account for a fee; they are often scammers too.
- Protect your money. Remove or freeze the payment method on the ad account and contact your card provider about unauthorized charges.
- Warn your audience. Use your website, email list or another social channel to tell customers not to respond to messages from the compromised account.
- Report it. In the US, you can report cyber crime to the FBI's IC3 at ic3.gov and scams to the FTC at ReportFraud.ftc.gov. In the UK, report fraud to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (England, Wales and Northern Ireland), or to Police Scotland on 101.
Account takeover protection checklist
- App-based MFA or passkeys for every admin on every platform
- Unique passwords stored in a password manager
- Pages and ad accounts owned through a business manager
- At least two trusted admins on every account
- Role-based access, with the lowest role each person needs
- Recovery email protected with strong MFA and reachable by two people
- Login and security alerts going to a monitored inbox
- Ad spending limits and billing alerts switched on
- Ex-staff and old agencies removed on the day they leave
- Quarterly review of admins, roles and connected apps
Frequently asked questions
Is text-message MFA good enough for social media accounts?
It is much better than no MFA, but app-based codes, passkeys or security keys are stronger because they are harder to intercept or trick out of you. Use the strongest option the platform offers, especially for admins.
Can I just share one login with my social media manager?
It is better not to. Shared logins make MFA awkward, hide who did what and are hard to revoke when someone leaves. Use the platform's business tools to give each person their own access with a suitable role.
Someone says they can recover my hacked account for a fee. Should I pay?
No. Recovery offers from strangers are a common follow-up scam. Use only the platform's official help center and recovery process, and work through your second admin if you have one.
How do I know if my ad account has been hijacked?
Watch for new campaigns you did not create, ads for products you do not sell, sudden jumps in spend, unknown users or a changed payment method. Billing alerts and a weekly check make these much easier to spot early.
Related reading
The bottom line
Social media and ad accounts are business assets, and they deserve the same protection as your bank login. Use app-based MFA or passkeys, keep two trusted admins, give everyone their own access through a business manager, remove people promptly and watch your ad spend. Those habits turn a potential disaster into a minor, recoverable incident.
