Blue Hat Web

Hacked Facebook page or Instagram: recovering business accounts

· 4 min read

When a business Facebook page is hacked, the attacker usually got into the personal account of someone who manages it, added themselves to the page, and removed everyone else. Recovery starts with that personal account, at facebook.com/hacked, then Meta’s page recovery form. Instagram has its own recovery path, which may include a selfie video.

How to recover a hacked Facebook page or Instagram account

Recover the personal account first, then the page. If you lost access to your own Facebook account, start at facebook.com/hacked from a device you have used before; once you are back in, use Meta’s page recovery form for the business page. For Instagram, start from the security email Instagram sent you, or from its own recovery flow. This is the social media part of recovering a hacked account, and Meta’s help page on what to do if your account was hacked lists the warning signs: a changed profile picture, posts or messages you did not write, and a password or second factor that no longer works.

How business pages get taken

Meta’s help center describes the usual scenario: an attacker steals the password of someone who manages the page, gets into that person’s personal account, adds themselves to the page, and then removes your access. Some attacks start instead with a scam message inside Meta Business Suite. Either way, the page is only as safe as the personal accounts of the people who manage it.

Step 1: your personal Facebook account

  • If your email was changed, Meta sends a message to the previous address with a link to undo the change. Look for it first.
  • If you cannot sign in, go to facebook.com/hacked from a device you have used before.
  • If you no longer have access to the email or phone on the account, Meta’s recovery flow offers No longer have access to these? and asks for new contact details that were never used on the account.

Once you are back in, change the password of the email account linked to Facebook too, as Canada’s Cyber Centre advises in its guidance on social media accounts: attackers often use the recovery method to take over access.

Step 2: the business page

Meta’s Facebook Page recovery form is the main route, with conditions:

  • you must be logged in, and you must have recently lost access to the page;
  • Meta only acts if it can confirm the page was compromised;
  • Meta aims to reply within a day, by email, though some reviews take longer.

If the page does not appear in the form, Meta says it does not see a recent loss of access. Once you are back, review the page and the business portfolio, undo any change you did not make, and turn on Advanced Protection, which requires two-factor authentication or a passkey for accounts in portfolios that advertise.

Instagram

  • If Instagram emailed you about a changed email address, the message from security@mail.instagram.com includes an option to secure your account and undo the change.
  • If you can still sign in, change your password, turn on two-factor authentication, check the phone number and email, review linked accounts in Accounts Center, and remove suspicious third-party apps.
  • If you cannot sign in, request a login link from the Forgot password? screen, or request support from a mobile device; Meta also points to instagram.com/hacked.

Instagram may ask for a selfie video of you turning your head, if the account contains photos of you. According to Meta, the video is never shown on Instagram and is deleted within 30 days, and the facial data generated for the comparison is deleted immediately afterwards. Meta announced the option for the UK, the EU, and South Korea in March 2025 and extended it in December 2025 without listing countries. Meta publishes no review time.

Meta Verified for businesses has included account support since 2023; its launch price in the US was $21.99 a month per Facebook page or Instagram account, and CA$36.99 in Canada. In September 2026, Meta folded these features into a new subscription, Meta One, with business plans starting at $14.99 a month; Meta’s announcement gives no currency and says prices vary by region. Meta’s terms tie support to an active subscription and promise no recovery, and Meta still recommends the page recovery form to subscribers.

Protecting the page next time

Meta requires every page to keep at least one person with full control, and warns that full control lets that person remove anyone, including you. Our recommendation, not Meta’s: give full control to two people you trust, both with two-factor authentication or a passkey on their personal Facebook accounts, and nobody else. Review the list of people with access every few months, and remove former employees and agencies the day they leave.

The email behind the account

If your Facebook or Instagram account signs in with a Gmail or Outlook address, that mailbox is the real key. See how to recover a Google account or the Microsoft account steps.

Blue Hat Web