Your business Facebook Page was hacked: how to recover access and limit the damage

Confirm whether the Page, an account, or both were hacked

Losing the ability to publish does not always mean the Page was hacked. Another administrator may have changed access, the Page may be restricted, or the personal account used to manage it may be locked. A takeover is more likely when unknown people have access, unauthorized posts or messages appear, the name changes, accounts are linked, ad campaigns start, or administrators are removed.

Record the Page URL and ID, visible name, screenshots of changes, Meta emails, time of the last legitimate access, and the people who managed it. Distinguish every administrator’s personal profile, the public Page, business portfolio, ad account, payment method, and linked Instagram account. Each asset may need a separate review.

Check whether at least one authorized administrator still has full control. Do not request passwords or codes publicly, and do not share one personal account among employees. Meta explains that a person with full control can grant or remove access and even remove other administrators; excessive access can therefore turn one compromised account into a company-wide incident.

• Page URL and ID
• Last legitimate access and change
• Administrators and access levels
• Portfolio and ad account
• Instagram, payment, and linked assets

Secure the identities that administer the business first

If a personal account was compromised, Meta recommends visiting facebook.com/hacked from a device previously used to sign in. Review notices about email or phone changes; Meta says an email sent to the previous address may contain a link to reverse an unauthorized email change. Secure the mailbox too, because Facebook recovery is ineffective while the attacker controls email.

Change unique passwords, close unrecognized sessions, check two-factor authentication, and remove suspicious applications or extensions. Do this for every administrator with meaningful access, not only the person who found the incident. Preserve notices before deleting them, and do not follow links from supposed support agents sent through direct messages.

Name one incident owner and establish a secure internal channel. Marketing, customer service, finance, security, and leadership should know which assets are affected and who approves communications. Do not claim Meta suffered a breach or publicly name an attacker without evidence; describe the observable facts as unauthorized access or activity.

Use Meta’s official Page recovery process

Meta provides a specific form for a Page you managed that somebody took through hacking or deception. You must be logged in and have recently lost Page access for the form to display the Page. Meta says it can act only when it confirms compromise and will send an email update after review.

If the form is absent, sign in first. If the personal account cannot be accessed, use facebook.com/hacked from a familiar device. If the Page cannot be selected, Meta says its systems may not detect a recent loss of access. A colleague should not file under their identity when the affected person can do so; every compromised administrator should secure their own account.

Submit a short, consistent timeline: when access existed, what changed, which accounts are authentic, and which activity was unauthorized. Avoid conflicting duplicate requests. Meta says replies typically take about a day but some reviews take longer; that is guidance, not a guaranteed recovery time or outcome.

Limit harm while the review is pending

If the Page posts scam links or asks for money, warn customers through the official website, Google Business Profile, email, and social channels still under control. Identify the affected Page, approximate date, and behavior people should ignore. Do not repeat malicious links or bank details. Explain how genuine messages can be verified and where a victim can report losses or exposed data.

Preserve each post, ad, message, and change with its URL, date, and screenshot before reporting the specific content. A hacked Page, misused ad account, and fraudulent advertisement are separate assets. Review charges with finance and contact the payment provider through official channels if an unauthorized transaction appears.

If somebody shared a password, code, document, or payment, provide cautious directions: secure accounts, contact the relevant bank or provider, and use official fraud resources for their country. Spain’s INCIBE or appropriate U.S. FTC and law-enforcement routes may help depending on location. The correct action depends on facts and jurisdiction; this guide is not legal advice.

After recovery, do more than delete one post

Review the complete Page and business portfolio. Remove unknown access, confirm who retains full control, and use task access where that is sufficient. Check the name, username, information, buttons, posts, messages, automations, linked accounts, Instagram, ad accounts, pixels, payment methods, and application permissions. Keep a record of the corrections.

Meta recommends undoing unrecognized changes and enabling added protection. Maintain at least two authorized owners, each with an individual identity, unique password, and strong authentication; do not leave agencies or former employees with unnecessary full control. Schedule quarterly access reviews and an offboarding process for employees and vendors.

ReputationGeo.ai can organize evidence, coordinate warnings, review public assets, and prepare the recovery record. Meta decides independently. We do not guarantee access restoration, timing, content removal, fund recovery, or audience preservation. Incidents involving fraud, personal data, contracts, or damages may require qualified cybersecurity, privacy, or legal professionals in the relevant jurisdiction.

How to turn this guidance into a responsible plan

Begin with evidence, not assumptions. Save the exact URLs, screenshots, publication dates, search phrases, review profiles and AI answers that are creating concern. Record where each item appears, who controls the source and whether the information is inaccurate, outdated, private, misleading or simply unfavorable. These distinctions matter because removal, correction, response, suppression and monitoring are different remedies. A credible adviser should explain those differences before recommending work or discussing timing.

Next, define the audience and the decision at risk. A result seen by prospective clients in Spain may require different language, sources and local signals from a result affecting investors in the United States. Decide which names, brands, locations and search questions matter most. Prioritization prevents a campaign from becoming a vague attempt to control the internet and turns it into a measurable program focused on accuracy, trust and discoverability.

Evidence, people and measurements to prepare

Create a baseline before changes begin. It can include the first two pages of Google for agreed searches, ratings and review volume, visibility of owned pages, recurring themes in AI answers and the status of platform or publisher requests. Keep personal data to the minimum necessary and share sensitive documents only through an agreed secure process. If a legal right may apply, involve qualified counsel in the relevant jurisdiction; reputation strategy does not replace legal advice.

Assign an owner for approvals, factual verification and customer responses. Review progress consistently, but do not judge the program by one daily ranking. Useful measures include corrected or removed items, response completion, the share of credible owned and independent sources, search-result composition, branded query trends and whether public information answers real questions. The objective is a more accurate and resilient digital record, not an artificial promise that criticism will disappear.

Keep a decision record, not just a list of links

For every material item, record the exact source, the factual concern, the person responsible for verification, the proposed route and the reason that route is proportionate. Include the date of any request, response deadline, platform reference number and next review date. This record prevents duplicate or contradictory reports and helps a new decision-maker understand why an item was corrected, challenged, answered, monitored or left alone.

A sound record also separates confirmed facts from interpretations. Label legal questions for qualified counsel, service failures for operational owners and public explanations for communications review. If an item changes, preserve the before-and-after evidence without collecting more personal data than necessary. This discipline is especially important when search engines and AI systems update unpredictably: it shows what actually changed and avoids claiming credit for movements that may have several causes.

• Source, URL, date and affected search or prompt
• Verified facts, disputed claims and supporting evidence
• Chosen route, owner, status and next review date
• Privacy, amplification and escalation risks